CN1022866C

CN1022866C - Locking method for computer memory device

Info

Publication number: CN1022866C
Application number: CN 90104529
Authority: CN
Inventors: 付怡琦
Original assignee: Tsinghua University
Current assignee: Tsinghua University
Priority date: 1990-07-14
Filing date: 1990-07-14
Publication date: 1993-11-24
Anticipated expiration: 2005-07-14
Also published as: CN1047577A

Abstract

The present invention relates to a method for locking a computer storage device which belongs to the technical field of the safety of a computer. The present invention adopts the method that a device driver in a computer system is changed to obtain explanation parameters of designated logical devices. The method is simple and practical, system hardware does not need to be changed, and proper software only needs to be compiled according to requirements to achieve the purpose that a designated storage device is used only by authorizers. Simultaneously, the present invention provides a safe and reliable measure to prevent computer virus from impacting computer physical storage media. The present invention is especially suitable for IBM-PC series microcomputers using PC-DOS or MS-DOS operating systems and various compatible machines of the IBM-PC series microcomputers.

Description

Locking method for computer memory device

The invention belongs to the computer security technique field.Specially refer to and prevent the unauthorized person by the use a computer method of physical storage device of logical device, and to prevent the method for computer virus infringement computer file system.

In field of computer technology, computer security issue is a very important problem all the time.In computer system, the mass memory unit of system all uses with sharing mode.No matter in this case, guarantee that a file can not visited, revise or delete by unauthorized user, still be the system itself concerning the user, all is very important.As a computer user, he always wishes that a storage area that has only him to use can be arranged in the computing machine.Sometimes, although need some of computing machine specific, with the physical storage medium that the logical device mode is used, only satisfying under the situation of some specified conditions, being only can be employed by logical device, yet itself does not but have this function employed computer system.For example, use PC-DOS or MS-DOS(hereinafter to be referred as DOS) the IBM-PC series microcomputer and the various compatible (hereinafter to be referred as PC) thereof of operating system, with the mass memory unit of hard disc (hereinafter to be referred as hard disk), and be that logic magnetic disc uses with hard disk partition as system.Logic magnetic disc is shared by all users, and Any user all can not be used logic magnetic disc to monopolize method.Moreover, Any user can use the disk formatting order that the logic magnetic disc on the hard disk is formatd.Therefore, there are information and the data in the computing machine in any one user, may be destroyed by other user at any time.

Again for example, IBM-PC series microcomputer regulation: system both can start from floppy disk, also can be from hard disk startup, and also floppy disk is preferential, and the two is identical to the use of hard disk.Because Any user can prepare one at an easy rate and can start the operation system of computer floppy disk, so this characteristic may throw into question to common computer.Such as, 2.00 editions of dos operating system is that first can be by the logic magnetic disc of dos operating system use on the hard disc with 3.30 editions to logic magnetic disc C() using method is inequality down together.Suppose the hard disk of a common computer, 3.30 editions dos operating systems are housed, and logic magnetic disc C is formative by 3.30 editions dos operating systems, and user has started this computing machine with his 2.00 editions PC-DOS operation system floppy disks.At this moment, logic magnetic disc C can normally use for this user, and just he can not correctly read existing content among the logic magnetic disc C.If he has write new content in logic magnetic disc C, then this content can correctly be read by him.Yet his writing disk manipulation will destroy meaningful among the logic magnetic disc C.Equally, if write new content to logic magnetic disc C again, then may destroy the content that writes logic magnetic disc C by 2.00 editions dos operating system users with the user of 3.30 editions dos operating systems startup computing machines.Use like this and may intersect destruction between the user of different operating system version repeatedly.For another example, for common computer, some protection software, for example Antivirus programs or the like often to be installed in system.If the user uses the system floppy disk of oneself to start computing machine, then can walk around set safeguard measure fully.That is to say, for the set protection software of system, to invalid from the user of tape starting floppy disk.

From above example as can be seen, the logical device one-level of computer system all can unconditionally operate in to(for) those Any user to memory device, especially wherein those users can carry the computer system of all required softwares, a kind ofly can pin logical device, making it can only be authorized to the user uses, making certain to specify physical storage medium can only be authorized to the method that the user uses in other words, obviously is very important and meaning.

The present invention is a kind of method that locks for computer memory device for solving that the existing problem of previous examples proposes, it is characterized in that adopting the device driver institute in the change computer system obtainable, the method of the explanation parameter of the logical device of appointment, comprise: make employed by the logical device of described appointment, the physical storage medium of the appointment in the physical storage device in the computer system, can be by the unauthorized person by the employed step that locks of the logical device of described appointment, and make employed by the logical device of described appointment, the physical storage medium of the appointment in the physical storage device in the computer system, can the grantee by the employed release step of the logical device of described appointment.Method of the present invention can realize with software fully.

Ultimate principle of the present invention is as follows:

In computer system, a logical device is defined and is described by one group or some group profile parameters.At least identification parameter and this binomial parameter of positional parameter of comprising this logical device in these explanation parameters.The identification parameter of logical device is indicated the type and the attribute of this logical device, is the foundation that the system or equipment driver is discerned this logical device.The positional parameter of logical device is described the situation that this logical device is used physical equipment, shows actual which physical equipment of use of this logical device, and its function by which physical medium is realized.Now hypothesis has a logical device A, and its type is K, and the physical storage medium that uses is D.At this moment the content of its identification parameter is T _k, illustrate that it is a K type logical device; The content of its positional parameter is L _D, illustrate that it uses physical storage medium D.For system and device driver, A is a K type logical device of using thing storage medium D.All device drivers when starting, are installed supposing the system.So after system start-up, logical device A is installed as K type equipment by system, and is positioned on the physical storage medium D, and is its N that allocates a device.The user can be that the K type logical device of N is used physical storage medium D by name.If can be with the identification parameter T of A _kChange T into _xSo for system and device driver, A is not a K type logical device, and A can not be that the K type logical device of N is used by the user as name after system start-up, thereby the user can not be that the K type logical device of N is used physical storage medium D by name just also.If the explanation parameter of defined all logical device all is not T in the system _x, then Ci Shi A just become in the system one can not discerned by any device driver, support " unknown device ", so it may not can be installed into system.In addition, still be T if keep the identification parameter of A _k, and can be with its positional parameter L _DChange L into _S, make positional parameter explanation A use physical storage medium S, and D and S zero lap.For system and device driver, A is a K type logical device of using physical storage medium S so, and after system start-up, A is still used by the user as the K type logical device of equipment N by name.But the user is that the employed physical storage medium of K type logical device of N is S rather than D by name.As long as the explanation parameter of logical device is specified in control change and recovery, just might reach and have only authorized user could pass through to specify logical device to use the purpose of specifying physical storage medium.In fact, to logical device explanation variation of parameter and recovery, might not be that the static data that parameter is described is carried out.As long as make that the explanation parameter that relevant code module obtained is desirable content, just can achieve the goal.

The step that locks of the present invention is: the device driver of make to support specifying logical device can only obtain the explanation parameter of the change of this logical device when obtaining the relevant explanation parameter of this logical device.Thereby make this logical device or do not become can be discerned by any device driver, use, support perhaps correctly to be positioned at " unknown device " on the physical storage medium of appointment.Thereby make the physical storage medium of appointment can appointed logical device not use.

Release step of the present invention is: the device driver of make to support specifying logical device can only obtain the explanation parameter original, that do not changed of this logical device when obtaining the relevant explanation parameter of this logical device.Thereby make that this logical device can correctly be discerned by this device driver institute, the correct use, and correctly be positioned on the physical storage medium of appointment.Thereby make the physical storage medium of appointment appointed logical device to use.

The physical storage medium of the appointment in the physical storage device in the method for the invention comprises the physical storage areas of the appointment in the physical storage medium in can random-access block device, and described explanation parameter can be stored in the described block device.

The present invention further provides and a kind ofly adopt change to be stored in explanation parameter in can random-access block device, the method that the physical storage areas of the appointment in the physical storage medium of described block device is locked, its step that locks is meant the described explanation parameter of change, and replace the described explanation parameter be stored in the described block device with the gained result, the physical storage areas that makes described appointment can not used by the logical device of described appointment by the unauthorized person; Its release step is meant and makes a code module reside in the internal memory that code module guarantees the physical storage areas of described appointment thus, can the grantee use by the logical device of described appointment when system start-up.

The also available following method of the above-mentioned step that locks realizes, promptly make generation sign indicating number module when system start-up, reside in the internal memory, code module guarantees the physical storage areas of described appointment thus, can not used by the logical device of described appointment by the unauthorized person.On PC, be applied as example with the present invention below, further elaborate method of the present invention.

PC can use several operation systems, its hard disk be one can random-access block device, various operating systems can reside on the hard disk of computing machine simultaneously, the hard disk of shared system.It is to set up an one's own subregion and this subregion is used as a logic magnetic disc on hard disk that each operating system is used the method for hard disk.That is to say that for an operating system, this on the hard disk belongs to its subregion, is exactly the complete disk that it can use.A fdisk is by one group of explanation parameter declaration that comprises subregion identification parameter and subregion positional parameter.All data that same subregion is described are arranged by permanent order, form a subregion list item.A subregion list item has 16 bytes.All subregion list items constitute a hard disk partition table, or claim partition table.This table fixedly leaves in first physical sector (i.e. the 0th road 0 and 1 sector) of hard disc of computer.The position of partition table in this sector fixed, from relative position 1BEH(sexadecimal number, beginning down together), finish to 1FDH, totally 64 bytes, can hold four subregion list items (annotate: the management system that has expands the length of partition table, but four subregion list items in this zone still do not become).Every data that each subregion is described do not leave on the fixed position of hard disk with all having copy.The identification parameter of subregion is called " System pointer ".It is a code, uniquely indicates that illustrated subregion is the subregion of what type, belongs to which operating system, and what logical device its unique this subregion of indicating is in other words, by which device driver is used.Various no subregions all have oneself different code.Because partition table do not have copy, therefore the content of the System pointer of a subregion list item is unique foundation that a system judges whether to use respective partition, and block device driver is judged unique foundation that this subregion is whether available in other words conj.or perhaps.The positional parameter of subregion is called " subregion navigation watch ", the physical location of the described subregion of its unique explanation.Comprising the data such as start address, termination address and length of illustrated subregion on hard disk.Because partition table do not have copy, therefore the subregion navigation watch in subregion list item is unique foundation of a system or a block device driver location respective partition.In the start-up course of operating system, all devices driver of system is mounted and is initialised.Each uses the logical block device driver of hard disk to read the partition table of hard disk when initialization, and scans the System pointer in each subregion list item.Only whether according to the content of resulting System pointer, differentiating respective partition is the available devices of oneself.If then only according to the data in the subregion navigation watch in the respective partition list item, this logical device of location is a logic magnetic disc on physical hard disk.After finished a logical block equipment location, respective partition list item data had just no longer been used by system before next system start-up.

Therefore, there are two kinds of methods can make the pairing appointment physical storage areas of certain subregion on the hard disk, after system start-up, can not be used in the mode of logic magnetic disc.First kind be the change device driver of supporting subregion " System pointer " content in the subregion list item of obtainable specified partition, make the device driver of supporting subregion when initialization, can only obtain the content of change of the corresponding system indicator of described subregion, thus make described subregion not become can be discerned by any device driver, use, support " unknown subregion ".At this moment described subregion is not installed in the system as logical device at all, and its pairing physical storage areas also just can not have been used in the mode of logic magnetic disc certainly.Second kind be the change device driver of supporting subregion " the subregion navigation watch " in the subregion list item of obtainable specified partition, make the device driver of supporting described subregion when initialization, can only obtain the content of change of the respective partition navigation watch of described subregion, thereby make described subregion correctly not to be positioned on the physical storage areas of described appointment.At this moment, in fact described physical storage areas has become the free area of not used by any logical device, also just can not use in the mode of logic magnetic disc certainly.

Now illustrate as follows:

Suppose that now specified partition is illustrated by n subregion list item in the partition table, claim that specified partition is n subregion of hard disk.The content of its System pointer is 1, illustrates that it is a basic DOS partition.Its start address on hard disk is d ₁, termination address is d ₂Like this, after DOS system start-up, n subregion will be positioned in hard disk memory region d ₁To d ₂On, be used as first logic magnetic disc of system.Its device number is C.All operations to logic magnetic disc C all are that n subregion carried out.The employed physical storage medium of logic magnetic disc C is the d on the hard disk ₁To d ₂The zone.That is to say the d on the hard disk ₁To d ₂The zone is used in the mode of logic magnetic disc C.

If will make the d of hard disk now ₁To d ₂The zone can not be used in the mode of logic magnetic disc, and two kinds of methods can be arranged.

First method, device driver that make to support subregion when initialization, the content of the System pointer in n the subregion list item in the getable partition table be 99H.Because the content of the System pointer of the employed any subregion of all operations system all is not 99H, therefore for dos operating system, do not have available partition on the hard disc this moment.The n subregion can not be installed into dos operating system as logic magnetic disc.After the DOS startup was finished, do not have device number in the system was the logic magnetic disc of C at all.D on the hard disc ₁To d ₂The zone can not be used in the logic magnetic disc mode certainly.

Second method, device driver that make to support basic DOS partition when initialization, the subregion navigation watch in n the subregion list item in the getable partition table, its start address is d ₃, termination address is d ₄, and d is arranged ₂＜d ₃Because the content of the System pointer in n subregion list item still is 1, so it is still discerned, installs and support by this device driver.After system start-up, n subregion is first logic magnetic disc of C as device number in the system still.All operations to logic magnetic disc C still are that n subregion carried out.Yet this moment, n subregion was positioned in the d of hard disc ₃To d ₄Zone, rather than d ₁To d ₂The zone.The employed physical storage medium of logic magnetic disc C is the d on the hard disk ₃To d ₄The zone.And the d on the hard disk ₁To d ₂The zone has become not by any logical device employed " clear area ", can not be used in the mode of logic magnetic disc certainly.

In 3.30 editions PC-DOS operation systems, the notion of subregion is expanded.It supports a kind of subregion that is called extension DOS partition.It is different with basic DOS partition, and basic DOS partition can only use as a logic magnetic disc, and extension DOS partition can only use in the mode that defines subregion therein again.The same when the regulation of definition DOS partition is with definition subregion on disk in extended partition, and the data structure of the data structure of the two and employed subregion list item and partition table is also just the same.Subregion B that explanation defines in extension DOS partition A and the partition table of C in first physical sector that fixedly leaves A in and had, and do not have copy.The relative position of partition table in the sector also is 1BEH.Like this, the basic DOS partition number that can comprise in extension DOS partition is at most one.The extension DOS partition number that can comprise in extension DOS partition is at most one.The definition subregion is different during subregion with definition on hard disk in extension DOS partition is:

1. can not have basic DOS partition in the extension DOS partition and extension DOS partition is arranged.

2. illustrate that the subregion navigation watch parameter in the subregion list item of a specified partition can not this specified partition of unique location.The position of this subregion is except that by the explanation of the subregion navigation watch of corresponding subregion list item, also comprised the influence of positional parameter of its subregion.

In order to distinguish at subregion that defines on the hard disk and the subregion that defines in extension DOS partition, the basic DOS partition that here will define in extension DOS partition is called logic magnetic disc; The extension DOS partition that will define in extension DOS partition is called the logic magnetic disc group.Correspondingly, the partition table in first physical sector that leaves extension DOS partition in and had is called the logic magnetic disc table; Its list item is called the logic magnetic disc list item; Subregion navigation watch in the logic magnetic disc list item is called the logic magnetic disc navigation watch, or the like the rest may be inferred.Behind the os starting, the device number of building the basic DOS partition on the hard disk in is C, and the device number of building the logic magnetic disc in the extension DOS partition in is a preface with their level of nesting from small to large, is followed successively by D, E ...Here said logic magnetic disc is the specific term that is based upon the basic DOS partition in the extension DOS partition, and getting in touch and distinguishing between it and the former said broad sense logic magnetic disc is fairly obvious, unless necessary especially, do not note distinguishing them.

Similar to the subregion of front narration, " System pointer " in the logic magnetic disc list item of a logic magnetic disc be described, be unique foundation that the device driver of this logic magnetic disc of support is discerned this logic magnetic disc.Therefore can with change support logic magnetic disc in the extension DOS partition device driver " System pointer " in the obtainable logic magnetic disc list item, make the device driver of supporting logic magnetic disc in the extension DOS partition when initialization, can only obtain the content of change of the corresponding system indicator of described logic magnetic disc, thereby make described logic magnetic disc not become can be discerned by any device driver, use, the method of " the unknown logical device " supported, make the pairing physical storage areas of described logic magnetic disc after dos operating system starts, can not be used in the mode of logic magnetic disc.

It should be noted that especially, because " the logic magnetic disc navigation watch " of a logic magnetic disc is not unique foundation of this logic magnetic disc of location, therefore can not expect that as in subregion the content that only changes " logic magnetic disc navigation watch " just can be reached for the purpose that the respective physical storage area locks.

In sum, the method for the explanation parameter of the logical device of employing change appointment of the present invention comprises the identification parameter or the positional parameter that change this logical device.For the subregion of PC be meant device driver that change supports subregion when the initialization the content of " System pointer " in the subregion list item of obtainable specified partition or the content of " subregion navigation watch ", logic magnetic disc to PC, be meant that change supports the content of " System pointer " in the logic magnetic disc list item of device driver obtainable appointment logic magnetic disc of institute when initialization of logic magnetic disc, reach purpose the physical storage medium of pinning appointment.

The method that locks for computer memory device of the present invention, simple and easy to do, need not change system hardware, only need work out out suitable software as required and can reach the purpose that the eliminating unauthorized person uses designated store equipment, simultaneously also for preventing that computer virus infringement computational physics storage medium from providing a kind of safe and reliable measure.

Brief Description Of Drawings:

Main Boot Record when Fig. 1 is system start-up in the embodiments of the invention one is carried out FB(flow block).

Fig. 2 is that " analog input " code module among the embodiment one is carried out FB(flow block).

Fig. 3 carries out FB(flow block) for " cancelling resident " code module among the embodiment one.

Main Boot Record when Fig. 4 is system start-up among the embodiment two is carried out FB(flow block).

Fig. 5 is that " analog input " code module among the embodiment two is carried out FB(flow block).

For more in detail and specifically describe the present invention, provide simultaneously and implement concrete reference of the present invention, now provide two concrete embodiments of the present invention, and in conjunction with the accompanying drawings they are elaborated.

Embodiment one

One exercise question

IBM-PC series microcomputer and password (PASSWORD) system of various compatible under PC-DOS and MS-DOS operation system thereof.

Two purposes

As previously mentioned, in the practical application of computing machine, often wish that certain file system can only the grantee uses, and can not be used by the unauthorized person.And use the IBM-PC series microcomputer and the various compatible thereof of PC-DOS and MS-DOS operation system not to have this function.The purpose of native system is exactly a head it off.

The present embodiment method of " System pointer " of logic magnetic disc in the change hard disc, make all with using C, D, three logic magnetic discs of E per family, but start the operating system and the content of the user that can correctly answer password and the employed logic magnetic disc D of other user is different from hard disc.Promptly start the operating system and the user that can correctly answer password is different with other user by the physical storage areas on the employed hard disc of logic magnetic disc D from hard disc.

Three conditions

1. an IBM-PC microcomputer wherein is equipped with an internal physical hard disk drive.

2. use 3.30 editions PC-DOS operation systems.

3. have a basic DOS partition on hard disc, having installed in this subregion can be for the operating system that starts.

4. on hard disc, have an extension DOS partition, have D therein successively _N, D _A, D _B, four logic magnetic discs of E.

Four requirements

1. A, B two cover passwords are set.

2. start the operating system and the user that can correctly answer password A can use logic magnetic disc D the subregion of basic DOS partition and expansion from hard disc _AAnd E, and can not use logic magnetic disc D _NAnd D _B

3. start the operating system and the user that can correctly answer password B can use logic magnetic disc D basic DOS partition and the extension DOS partition from hard disc _BAnd E, and can not use logic magnetic disc D _NAnd D _A

4. start the operating system from hard disc but can not correctly answer the user of password and can use logic magnetic disc D the basic DOS partition from the user that flexible plastic disc starts the operating system _NReach E and can not use logic magnetic disc D _AAnd D _B

5. non-dos operating system there is not influence.

Five implement

1. lock

(1) for logic magnetic disc D _NEmploying makes one " analog input " code module reside in the internal memory when hard disk startup operating system and user can correctly answer password, and code module guarantees to support that the device driver of logic magnetic disc is reading logic magnetic disc D thus _NThe content of System pointer the time, this content can only be 99H, thereby makes logic magnetic disc D _NPhysical storage areas on the employed hard disc can not be started the operating system from hard disc and can correctly be answered the locking method that the user of password uses in the mode of logic magnetic disc D.

(2) for logic magnetic disc D _AAnd D _BEmploying will be stored in the content of System pointer of the appointment logic magnetic disc in the logic magnetic disc table in the hard disc from 1(or 4, look logic magnetic disc capacity and may be different, hypothesis is 1 entirely in this example, change 99H into down together), and replace raw content with the gained result, make and support the device driver of logic magnetic disc reading logic magnetic disc D _AAnd D _BSystem pointer the time, what can only obtain it is the content of 99H, thereby makes logic magnetic disc D _AAnd D _BDo not become can be discerned by any device driver, support, employed " unknown device ", thereby make logic magnetic disc D _AAnd D _BThe user that physical storage areas on the employed hard disc can not be started the operating system from flexible plastic disc and can not correctly answer the user of corresponding password, the locking method that uses in the mode of logic magnetic disc D.

Interrupt reading Main Boot Record in hard disk first physical sector by INT 13H.According to the start address of the extension DOS partition of preserving in the subregion navigation watch in the extension DOS partition list item in the hard disk partition table in the Main Boot Record, interrupt from first physical sector of extension DOS partition, reading first order logic magnetic disc table by INT 13H.The value of the System pointer of first logic magnetic disc list item of wherein being deposited is 1, and this list item is described to be logic magnetic disc D

The content of the System pointer of second logic magnetic disc list item is 5, and what it was described is first order logic magnetic disc group.According to the start address of this logic magnetic disc group of preserving in the logic magnetic disc navigation watch in this logic magnetic disc list item, interrupt from first physical sector of first order logic magnetic disc group, reading second level logic magnetic disc table by INT 13H.The value of the System pointer of first logic magnetic disc list item of wherein being deposited is 1, and this list item is described to be logic magnetic disc D _AChange the value of its System pointer into 99H, this sector is write back with INT 13H.The value of the System pointer of second logic magnetic disc list item being deposited in the logic magnetic disc table of the second level is 5, and what it was described is second level logic magnetic disc group.With with identical just now method, with logic magnetic disc D _BThe value of System pointer change 99H into and write back hard disc.

Because any in the PC-DOS operation system uses the value of System pointer of the logical block equipment of hard disc all not to be 99H, therefore, when starting PC-DOS operation system according to a conventional method afterwards, has only logic magnetic disc D in the extension DOS partition _NCan be correctly validated, install and use with E.Their device number is respectively D and E, and is required just.And, therefore other operating system there is not influence owing to only changed the data in the extension DOS partition.

So far to logic magnetic disc D _AAnd D _BLock and finish.

2. password input and check

This function is finished by the pass word code module.The content (data) of A, two passwords of B is given in the password data district that is placed on module earlier.When system start-up, this module judges at first whether this startup starts PC-DOS operation system, if not, then carry judged result and withdraw from this code module, if the startup PC-DOS operation system then earlier to the user's query password, and is imported the password that the user provides.Then the password data preserved in the password of input and the data field is compared.Carry comparative result at last and withdraw from this code module.

3. release

(1) for logic magnetic disc D _N, because its normality is not have the lock attitude, dynamically it is locked by " analog input " code module, therefore, promptly realized release to it as long as " analog input " code module is not worked.

(2) for logic magnetic disc D _AAnd D _BEmploying makes one " analog input " code module start the operating system from hard disc and the user can correctly answer under the situation of password, resides in the internal memory, and code module guarantees to support that the device driver of logic magnetic disc is reading logic magnetic disc D thus _AAnd D _BThe content of System pointer the time, (password of answer is D when being A to that required logic magnetic disc _A, the password of answer is D when being B _B) the value of System pointer be 1, rather than 99H, thereby make that this logic magnetic disc can be by the correct understanding of described device driver institute, the correct use, thereby make the employed physical storage areas of this logic magnetic disc to be started the operating system from hard disc and can correctly return make corresponding password the user with the employed unlock method of the mode of logic magnetic disc.Its normality is to have locked attitude.

The work that makes " analog input " code module reside in internal memory is finished by one " resident " code module.This module is at first transferred to relevant module in the memory field that can not be used before withdrawing from.The password if the user fails correctly to answer then withdraws from.Otherwise intercepting INT 13H interrupts the inlet of " analog input " module, and preserves related parameter for " analog input ".

Because the logic magnetic disc table no longer is used after the device driver initialization of supporting logic magnetic disc is finished, therefore above-mentioned " analog input " code module can and should withdraw from internal memory as early as possible after the device driver initialization of supporting logic magnetic disc is finished.For easy, this function is finished by independent " cancelling resident " code module.

In 3.30 editions PC-DOS operation systems, the free area of 227 bytes is arranged in first physical sector of hard disk (what wherein deposit is hard disk master boot record).For convenience, pass word " resident " and " analog input " three code modules are placed in this free area, and relevant parameter and structure in the corresponding adjustment master boot module.To " cancel " code module resident is designed to the form of an installable device driver.

" cancel " code module resident and use as the function of initializing module of " installable device driver "." device driver " still will set form as requested write.Just in its each function allocating module, having only the function of initializing module is the valid code section.In CONFIG.SYS it being placed on all block device drivers that use hard disc installs afterwards.The function of initializing module of program is called by the installed module of " the installable device driver " of operating system.It recovers the interruption that may be intercepted when carrying out, remove the Main Boot Record that resides in internal memory, returns the module (reporting system: this driver is not mounted, and logs off) of calling it with 0 length at last.

4. execution flow process

Accompanying drawing one to accompanying drawing three is the relevant flow process of present embodiment, and existing details are as follows respectively.

Accompanying drawing one has provided the execution flow process of the Main Boot Record in the present embodiment when system start-up.Wherein the 3rd step to the 7th step is the pass word code module, and the 8th step was " resident " code module to the 12nd step, and other step all is the original function of master boot module in the Main Boot Record, but to there being related parameter to do corresponding adjustment.Wherein the 13rd step to the 23rd step is the guiding function module in the former Main Boot Record.Now details are as follows to accompanying drawing one:

The 1st step: initialization of register is provided with storehouse.

The 2nd step: vacate standard enabling address 0000:7C00.Main Boot Record is copied to from the memory field that 0000:7C00 begins in the memory field that 0000:E000 begins, forward to then and continue in the new Main Boot Record to carry out.This is former existing function of drawing leading record, and just the requirement by " resident " changes destination address into 0000:E000.This address is resident address (" analog input " code module is placed in the Main Boot Record), and it is an experiment value.In fact, can be chosen at before " cancelling resident " code module end of run not any region of memory of being used by system as resident district.This step also is the first of " resident " work.

The 3rd step: password module initialization.Password is set is masked as mistake.

The 4th step:, check the whether active partition of basic DOS partition according to the partition table in the internal memory.If not what this less important startup was described is not dos operating system,, changeed for the 13rd step by the requirement of " other system is not had influence ".

The 5th step: interrupt showing the password prompt with INT 10H.

The 6th step: interrupt password of input from keyboard with INT 16H.

The 7th step:, the password sign is set according to the password content of being imported.The password of preserving in the password imported and the password data district is compared,, password then is set is masked as A,, password then is set is masked as B if identical with B if identical with A.

The 8th step: deposit address 0000:0000 in to the data field that is used for preserving INT 13H vector.

The 9th step: if password is masked as " mistake ", explanation need not release, changes for the 13rd step.

The 10th step: multiplicity n is set.If password is masked as A, n=1 then, otherwise n=2.

The 11st step: the method that provides by the front, search logic disk table successively.Be that the physical sector address at 1 System pointer place and the content of sector deposit in respectively in the data field with first content that finds, the content with this System pointer in the data field changes 99H into again; The address of the physical sector at n content the finding System pointer place that is 99H and the content of sector are deposited in respectively in the data field, and the content with this System pointer in the data field changes 1 into again.These two sectors are exactly the hard disc sector that need carry out analog input.

The 12nd step: intercepting soft interruption of INT 13H " analog input " code module.At first with INT 13H interrupt vector (internal memory 0000:004C to 0000:004F, the INT 13H processing module entry address of preserving down together) is saved in the data field, then the entry address of " analog input " code module is inserted in the INT 13H interrupt vector.Because all disk operating all will be finished by the soft interruption of INT 13H, so in start-up course after this, the whichever functional module is carried out disk operating, control all will at first forward " analog input " code module to.Because partition table and logic magnetic disc table all exist in the hard disc uniquely, therefore support the device driver of subregion and logic magnetic disc to obtain them by disk read operation.Like this whichever support use hard disc the device driver of logical device when hard disc reads the explanation parameter of those logical device, " analog input " module all will at first obtain control.

The 13rd step: the data legitimacy of checking hard disk partition table in the internal memory.If not method changeed for the 22nd step.

The 14th step: seek active partition in the hard disk partition table in internal memory.If find, changeed for the 16th step.

The 15th step: in partition table, do not have active partition, think not have the operating system that can make startup in the hard disc, carry out the soft interruption of INT 18H, call the ROM program in BASIC.

The 16th step: the section intrinsic displacement pointer (note: its sector address is necessary for 0000) of preserving the active partition item.

The 17th step:, the booting operating system in active partition record is read in the memory field that 0000:7C00 begins according to the data in the subregion navigation watch of active partition.

The 18th step:, changeed for the 20th step if read-in process is error-free.

The 19th step:, changeed for the 17th step if the number of times of makeing mistakes is less than 5 times.Otherwise changeed for the 22nd step.

The 20th step: if the no effective marker OAA55H of the booting operating system that reads in record changeed for the 22nd step.

The 21st step: forward the 0000:7C00 place to, the executive operating system leader record.The guiding work of Main Boot Record is so far finished.

The 22nd step: show corresponding error information.

The 23rd step: changeed for the 23rd step.Endless loop.

Accompanying drawing two has provided the execution flow process of " analog input " code module that is arranged in Main Boot Record.It is existing that details are as follows:

The 1st step: function is judged.According to the address of the hard disc sector of the needs analog input of preserving in the data field, judge whether the function that this INT 13H interrupts will read that two hard disc sectors.If not, changeed for the 7th step.

The 2nd step: preserve on-the-spot.This is the regular works of Interrupt Process.

The 3rd step: with the change of the respective physical sector of preserving in the data field the content of System pointer copy in the purpose internal memory (ES:BX).

The 4th step: correct complement mark is set.Operate by the memory copying simulation because this reads to coil, do not interrupted the complement mark of generation on the one hand by INT 13H, it will inevitably correctly be finished again on the other hand.Therefore, fixing " a correct complement mark " as the Returning mark of this disk read operation, returned to the calling module of this INT 13H.The value of this " correct complement mark " is 0246H through experiment.

The 5th step: recover on-the-spot.This is that the routine of Interrupt Process when finishing handled.

The 6th step: carry out and interrupt returning.Withdraw from this interrupt operation, return the calling module of the soft interruption of this INT 13H.

The 7th step: this task of calling the soft interruption of INT 13H is not the hard disc sector of reading to carry out analog input, entry address by the INT 13H interruption processing module of preserving in the data field, far jump to former INT 13H interruption processing module, to finish the former function of this interruption.After finishing,, directly return the calling module of this interruption by former interruption processing module control.

Accompanying drawing three is execution flow processs of " cancelling resident " code module.It is existing that details are as follows.

The 1st step: judge whether to intercept and limit INT 13H to interrupt.As previously mentioned, when the user failed correctly to answer password, " resident " module did not intercept INT 13H and interrupts.Therefore must distinguish now whether whether having intercepted INT 13H interrupts, should recover it with decision.Otherwise, the mistake that INT 13H interrupts is recovered to interrupt and can't finish with the same INT of the causing 13H of leakage recovery.This problem can be by check preserving INT 13H interrupt vector the method for content of data field solve.Owing to when carrying out Main Boot Record, at first address 0000:0000 is inserted this data field, and 0000:0000 is the interrupt vector table address of system, this value will not be got in the entry address of INT 13H interruption processing module, therefore if the content in this data field is 0000:0000, then explanation " resident " module does not intercept INT 13H interruption, changes for the 3rd step.

The 2nd step: recover INT 13H interruption processing module inlet, " analog input " code module and software systems are broken away from fully.The address, actual entry of INT 13H interruption processing module is kept in the data field.Should not restore in the INT 13H interrupt vector now in this address, and should deposit in the data field of DOS.Because 3.00 and the dos operating system of above version also intercept INT 13H and interrupt, it is carried out additional treatments.Therefore, what preserved in the INT 13H interrupt vector this moment has not been the entry address of " analog input " code module, but in the dos operating system INT 13H is interrupted carrying out the entry address of the module of additional treatments.The entry address of " analog input " code module by the entry address of dos operating system as original INT 13H interruption processing module, is saved in the DOS data field and has suffered.The dos operating system of different editions is also inequality to the use of data field.In 3.30 editions dos operating systems, the entry address of original INT 13H interruption processing module is kept in the 0070:00B0 of internal memory and two region of memorys that 0070:00B4 begins.That is to say that the address, actual entry of the INT 13H interruption processing module that obtains should deposit in respectively in these two memory fields from the data field of " analog input " module.

The 3rd step: with Main Boot Record module and the data field thereof in 0 covering memory, in order to avoid in internal memory, leave over useful data.

The 4th step: log off.Return caller with 0 length.The installed module of " installable device driver ", after calling the function of initializing module of the device driver that is mounted (" cancelling resident " code module is exactly invoked as the function of initializing module of " installable device driver "), be the device driver storage allocation that is mounted according to its program length that returns.If returning length is 0, illustrate that then the device driver that is mounted is not resident.Installed module just is not installed into system with it, and the then just employed internal memory of the program that will be mounted is regained.

Embodiment two

One exercise question

IBM-PC series microcomputer and various compatible thereof, the support method of the virus monitor system under PC-DOS and MS-DOS operation system.

Two purposes

Now, computer virus is because its infectiousness and destructiveness have become a very important problem.The computer virus that many attack IBM-PC series microcomputers and various compatible and dos operating system are arranged.In the middle of them, what have takies a large amount of system resources, and the usability of computing machine is worsened; Revising of having can be held file; What have distorts user data; The caused user file that has is large quantities of to be lost.These cause heavy losses all may for user and system.Therefore, the early detection of computer virus and elimination are very important and significant.The discovery of computer virus more early, the loss that causes is just few more; The recovery of data is just easy more; The elimination of virus is just easy more.Therefore, find computer virus how in time, as soon as possible, with the hidden infection of avoiding it and broken ring the loss that may cause, become the important topic in the present computer security technique field.And the file system of protection computing machine in can random-access block device is not subjected to the infringement of computer virus, is again one of its main target.

In order to reach above purpose, people have developed many computer virus monitoring facilitieses.These program residences are in calculator memory, once find that having virus to enter in the computing machine can report to the police immediately, what have can also be directly with its elimination.Therefore, system installs after the virus monitor program, can stop the infringement of computer virus to system effectively, the file system of protection computing machine in can random-access block device.

In IBM-PC series microcomputer and various compatible thereof, hard disc as system and all users share can random-access block device, be the key protection point of anti-virus system.Want just must to satisfy " do not start the computer virus monitoring facilities and just can not use file system in the hard disc " this condition by the file system in the computer virus monitoring facilities protection hard disc.File system in the hard disc is to organize, set up and use in the mode of logic magnetic disc.Therefore, to the protection of file system in the hard disc, be unit with the logic magnetic disc; , must meet the following conditions: do not start the computer virus monitoring facilities and just can not use protected logic magnetic disc during with the computer virus monitoring facilities as salvo; Perhaps do not start the computer virus monitoring facilities and just can not use the physical storage areas at protected file system place in the mode of logic magnetic disc.

As previously mentioned, under normal circumstances,, can not start the computer virus monitoring facilities and all logic magnetic discs of the using system that does as usual, thereby make the computer virus monitoring system lose efficacy with carrying the user that floppy disk starts the operating system.The purpose of this safeguards system overcomes this problem exactly.Make the user who starts the operating system from floppy disk by locking, can not use physical storage areas on the protected hard disc in the mode of logic magnetic disc; By release, make the user who starts the operating system from hard disc, can use physical storage areas on the protected hard disc in the mode of logic magnetic disc.Ensure that with this means computer virus monitoring system uses the physical storage areas on the hard disc at protected file system place to be activated in the past in the logic magnetic disc mode the user.

Three conditions

2. use 3.30 editions PC-DOS operation systems.

3. on hard disc, have a basic DOS partition.This subregion is active partition.Its employed hard disc physical storage area is called storage area A.Having installed in this subregion can be for the operating system that starts and will (by CONFIG.SYS CONFIG.SYS or startup file AUTOEXE.BAT or alternate manner automatically) automatically actuated virus monitor system (realization of virus monitor system itself does not have direct relation with present embodiment).

4. on hard disc, have an extension DOS partition.Its employed hard disc physical storage area is called storage area B.In this subregion, have some logic magnetic discs.

5. four subregions on hard disc, have been had.

6. the storage area that does not belong to any subregion that on hard disc, also has a free time.This zone is called storage area C.

Four requirements

1. have only the user who starts the operating system from hard disc to use storage area A and B in the mode of logic magnetic disc.

2. have only the user who starts the operating system from flexible plastic disc to use storage area C in the mode of logic magnetic disc.

3. native system is only effective to dos operating system, and other operating system is not had influence.

Five implement

1. lock

(1) for storage area A, adopt the content of " the subregion navigation watch " that change the basic DOS partition in the hard disk partition table that is stored in the hard disc, and replace raw content with the gained result, make when flexible plastic disc starts the operating system, support the device driver of basic DOS partition can only obtain the content of its change, thereby make this subregion can not be positioned at storage area A to go up and can only be positioned on the storage area C, thereby the locking method that the user who makes storage area A can not started the operating system from floppy disk uses in the mode of logic magnetic disc.

(2) for storage area B, adopt the content of the System pointer that changes the extension DOS partition in the hard disk partition table that is stored in the hard disc, and replace reason with the gained result and hold, make when flexible plastic disc starts the operating system, support the device driver of extension DOS partition can only obtain the content of its change, thereby make this subregion not become can be discerned by any device driver, support, employed " unknown device ", thereby the locking method that the user who makes storage area B can not started the operating system from floppy disk uses in the mode of logic magnetic disc.

Interrupt the Main Boot Record in first physical sector of hard disc is read in internal memory by INT 13H.Earlier it is write in second physical sector that extension DOS partition had in the hard disc, use for releasing process.In first magnetic track in first physics cylinder that extension DOS partition had, have only first physical sector to deposit the logic magnetic disc table as first physical sector that expansion divides the DOS district to be had.And other sector wherein all is the free sector that are not used.After having write, change the relevant data in the disk partition table of reading in the internal memory.Earlier change the System pointer of extension DOS partition into 99H from 5, (99H is the value of a System pointer that is not defined choosing wantonly) inserted relevant datas such as the start address of storage area C, termination address in the navigation watch of basic DOS partition again.Interrupt the Main Boot Record in the internal memory is write in first physical sector of hard disc with INT 13H more at last.

All be not 99H because basic DOS partition has been positioned to the content of the System pointer of storage area C and any known subregion, therefore when after this starting dos operating system routinely, storage area A and B all can not be used as logic magnetic disc and use.Because storage area C do not use by other system, and System pointer is that the subregion of 99H can not used by other system yet, and therefore the work that locks does not have influence to other system.

The process of locking to storage area A and B leaves it at that, and this is their normality.

(3) for storage area C, to storage area A unlocking process itself, exactly to its process that locks.

2. release

(1) to storage area A and B, employing makes one " analog input " code module reside in the internal memory from the hard disc start-up operation time, code module guarantees to support in the operating system device driver of subregion thus, when from hard disc, reading partition table, the content of the navigation watch of resulting basic DOS partition is to navigate to storage area A rather than C, the content of the System pointer of extended partition is 5 rather than 99H, thereby make basic DOS partition can be properly oriented storage area A, extension DOS partition can be correctly validated, the correct use, thereby the unlock method that the user who makes storage area A and B to be started the operating system from hard disc uses in the mode of logic magnetic disc.

Release to storage area A and B is once effective.

(2) to the release of storage area C.Because the normality of storage area C is " release ", to locking of it is by the releasing process of storage area A is finished simultaneously, and this process is dynamically carried out in os starting, as long as therefore this process is not worked, can realize the release to storage area C.

Identical with situation among the embodiment one, releasing process is finished by " resident ", " analog input " and " cancelling resident " three code modules.Identical in wherein " cancelling " code module and embodiment one resident, no longer repeat herein." resident " and " analog input " code module still is placed in the free area of 227 bytes of Main Boot Record.Their groundwork principle also with embodiment one in identical.

3. execution flow process

Accompanying drawing three is to the relevant flow process of accompanying drawing five for this realization example, and details are as follows respectively referring now to one, two pairs of accompanying drawings of accompanying drawing four, five.

Accompanying drawing four has provided the execution flow process of Main Boot Record when system start-up.Wherein the 3rd step was " resident " code module that increases newly.Now in conjunction with the embodiments one and a pair of accompanying drawing four of accompanying drawing details are as follows:

The 1st step: initialization of register is provided with storehouse.

The 2nd step: vacate standard enabling address 0000:7C00.Copy Main Boot Record to terminate-and-stay-resident district 0000:E000 and change execution then.First and second step is together complete with embodiment one.

The 3rd step: intercepting soft interruption of INT 13H " analog input " code module.This step is identical with the 12nd step among the embodiment one.

The 4th～14 step is identical with the 13rd～23 step of (figure one) among the embodiment one, is the guiding function module in the former Main Boot Record.

Accompanying drawing five has provided the execution flow process of " analog input " code module that is arranged in Main Boot Record.Now in conjunction with the embodiments one and two pairs of accompanying drawings five of accompanying drawing details are as follows:

The 1st step: function is judged.Judge whether the function that this INT 13H interrupts is first physical sector of reading hard disc.If not, changeed for the 7th step.

The 3rd step: the start address of extension DOS partition on hard disc of preserving in the subregion list item by extension DOS partition in the partition table, read in the internal memory purpose district (ES:BX) by the original Main Boot Record that INT 13H interrupts being kept in second physical sector that extension DOS partition has.

The 4th the step: with the gained complement mark as Returning mark.

The 5th step: recover on-the-spot.Routine when at this moment Interrupt Process is finished is handled.

The 7th step: this task of calling the soft interruption of INT 13H is not to read hard disk first physical sector, entry address by the INT 13H interruption processing module of preserving in the data field, far jump to former INT 13H interruption processing module, to finish the former function of this interruption.After finishing,, directly return the calling module of this interruption by former interruption processing module control.

Claims

1, a kind of method that locks for computer memory device, it is characterized in that: adopt the device driver institute in the change computer system obtainable, the method of the explanation parameter of the logical device of appointment, comprise feasible employed by the logical device of described appointment, the physical storage medium of the appointment in the physical storage device in the computer system, can be by the unauthorized person by the employed step that locks of the logical device of described appointment, and make employed by the logical device of described appointment, the physical storage medium of the appointment in the computer system in the physical storage device, can the grantee by the employed release step of the logical device of described appointment, the physical storage medium of the appointment in the described physical storage device, be meant the physical storage areas of the appointment in the physical storage medium in the block device that can store at random, described explanation parameter is meant the described explanation parameter that is stored in the described block device; The described step that locks, be meant the described explanation parameter of change, and replace the described explanation parameter be stored in the described block device with the gained result, and making described appointment physical storage areas, can not used by the logical device of described appointment by the unauthorized person; Described release step is meant to make a code module reside in the internal memory that code module guarantees the physical storage areas of described appointment thus, can the grantee use by the logical device of described appointment when system start-up.

2, the method for claim 1 is characterized in that described explanation parameter, is meant the described explanation parameter that is stored in the described block device; The described step that locks is meant to make a code module reside in the internal memory that code module guarantees the physical storage areas of described appointment thus, can not used by the logical device of described appointment by the unauthorized person when system start-up.

3, the method for claim 1 is characterized in that being realized by software fully.

4, the method for claim 1 is characterized in that described computing machine, is meant the microcomputer and the various compatible thereof of IBM-PC series.

5, method as claimed in claim 4 is characterized in that describedly can being meant hard disc by random-access block device.

6, method as claimed in claim 4 is characterized in that the logical device of described appointment being meant the subregion that is based upon the appointment in the described block device; Described explanation parameter is meant " System pointer " in the subregion list item of subregion of the described appointment of explanation.

7, method as claimed in claim 4 is characterized in that the logical device of described appointment being meant the subregion that is based upon the appointment in the described block device; Described explanation parameter is meant in the subregion list item of subregion of the described appointment of explanation " subregion navigation watch ".

8, method as claimed in claim 4 is characterized in that the logical device of described appointment, is meant the logic magnetic disc of the appointment in the extension DOS partition that is based upon in the described block device; Described explanation parameter is meant " System pointer " in the logic magnetic disc list item of logic magnetic disc of the described appointment of explanation.