JP4228037B2 - Method and apparatus for controlling access and modification of information stored in a storage medium in a computer system - Google Patents

Description

[0001]
[Technical field to which the invention belongs]
The present invention relates to a method and apparatus for controlling access to and corruption of information in a computer system.
[0002]
[Prior art]
PCT / GB91 / 00261 (WO 91/13403) by the inventor (the contents of which are hereby incorporated by reference) is also a method specifically related to the detection and inclusion of hostile programs such as “virus” programs in computer systems. And an apparatus are disclosed. In this document,
The information stored in the storage medium is divided into a plurality of non-overlapping partitions including a boot partition and a plurality of general partitions, and each partition is further divided into a plurality of sectors, and the computer system is in use At any given time, any specified subset of the general partition is active
In a method (and associated apparatus) for controlling access and modification to information stored on a storage medium that forms part of a computer system,
It is independent of the central processing unit (CPU) of the computer system and has been made inaccessible to the user and is specific to the type of information stored in the previous sector and the type and status of the partition in which the sector is located. Management means (supervisor) for controlling execution of read, write and format operations based on information stored on the storage medium so that the operation can be regulated or prevented according to
If the management means attempts to perform a prohibited read, write or format operation, it requests a reset of the computer system, which causes the memory to clear and load the operating system Was characterized by
A method (and associated apparatus) is disclosed.
[0003]
In the invention disclosed in PCT / GB91 / 00261, the boot partition becomes “read only” when the system is in the supervised mode. This prevents viruses from attacking while allowing their execution, unless DOS utilities and programs are self-modifying.
[0004]
[Problems to be solved by the invention]
Changes and improvements have been made to the PC operating system since the concept of virus quarantine with PCT / GB91 / 00261. These have certain limitations in the scope of the virus isolation invention. For example,
(1) Microsoft Windows needs to be able to write a certain number of files placed in the Windows directory, even if not strictly self-modifying.
(2) The system administrator can install executable content on the boot partition without recognizing that it is self-modifying. When such executable content is installed on the boot partition, self-modification of this program is attempted when the system is in the supervisor mode, and the supervisor prevents write attempts and freezes the system.
(3) Microsoft Windows Virtual Memory Manager may require write access to either or both of the Windows directory and the boot partition root directory.
(4) Network software may require access to the boot partition.
(5) In general, making a boot partition “read only” with a complex operating system is limited, can be incompatible, and can cause high administrative overhead.
[0005]
[Means for Solving the Problems]
The object of the present invention is to eliminate or reduce the aforementioned problems.
[0006]
According to a first aspect of the invention,
A method for controlling access and modification stored in a storage medium forming part of a computer system comprising:
Dividing the information stored on the storage medium into a plurality of non-overlapping partitions including a boot partition and at least one general partition;
One of the partitions is designated as a multiple-recoverable write (WMR) so that the write command overwrites the remaining information stored in one or the WMR partition with the update information. When issued, other than the location where the or any residual information is stored and the (virtual) pointer to the update information is set or held so that the update information can be accessed according to requests in the remaining sessions The update information is written at the position of
A method is provided for controlling access and modification stored in a storage medium that forms part of a computer system.
[0007]
A system reset causes the update information to be cleared along with a list of pointers to this information. This restores the WMR partition to its original state when built in non-supervised mode.
[0008]
Thus, if the WMR partition is initially virus free, the WMR partition becomes virus free at the start of each new session.
[0009]
The boot partition on the storage medium is preferably a protected WMR. A general partition can also be a protected WMR if the user requests it.
[0010]
In order to achieve this, the basis of the method according to the first aspect of the invention is to set up a mechanism that retains the original information stored in the WMR partition without changing it, and usually overwrites it. The data to be stored is securely stored somewhere on the storage medium that can be accessed as needed during the rest of the session. The mechanism defines how to do this efficiently in terms of providing maximum security while simultaneously minimizing additional memory space and throughput.
[0011]
According to the method according to the first aspect of the invention, there is preferably provided supervisory means (supervisor) independent of the central processing unit (CPU) of the computer system and made inaccessible to the user,
The management means is information that is read from or written to a sector is operating system information or user information, whether the sector is the boot partition or a general partition, and Allow / restrict / inhibit read / write operations on the storage medium according to whether the partition is active or inactive;
The management means permits a formatting operation only on an active general partition and prohibits a formatting operation on the boot partition or on an inactive general partition,
A warning is issued to the user when a prohibited read, write or format operation is performed.
[0012]
Space is preferably reserved on the storage medium that is accessible only by the supervisor, called the dedicated area 2. This dedicated area may be a special partition, a range of sectors in the WMR partition, or an unallocated sector in the dormant partition.
[0013]
Each WMR partition has a sector reallocation table (SRT) associated with it, holding the table in the supervisor's random access memory (RAM), and each entry in the SRT is in an updated WMR partition An address of a sector in the range, an address where the update information is located, and an address where the update information is positioned are defined, and the position is in the dedicated area.
[0014]
According to a second aspect of the present invention, there is provided an apparatus for controlling access to and modification of information stored in a storage medium of a computer system, wherein the storage medium includes a boot partition and at least one general partition. In a device divided into non-overlapping partitions,
At least one of the partitions has a number of recoverable writes (WMR) and, in use, a write command is issued to overwrite (update) any information stored in the WMR partition. When the update information is stored in another location on the storage medium and a pointer to the update information is stored so that the update information is accessed according to requests in the remaining sessions, An apparatus is provided for clearing update information along with a list of pointers to the update information and thus returning the WMR partition to its original state when built in non-supervised mode.
[0015]
The apparatus preferably comprises supervisory means (supervisor) independent of the central processing unit (CPU) of the computer system and made inaccessible to the user,
The management means is information read from or written to the sector is operating system information or user information, whether the sector is the boot partition or a general partition, and If the partition is a general partition, the read and write operations on the storage medium are permitted, restricted, or prohibited according to whether the partition is active or inactive;
The management means further permits the formatting operation only on the active general partition and prohibits the formatting operation on the boot partition or the inactive general partition,
The monitoring means alerts the user if it is a prohibited read, write or format operation and attempts to perform the operation that is blocked by the supervisor.
[0016]
According to a third aspect of the invention, there is a method for controlling access and modification to information stored on a storage medium forming part of a computer system comprising:
In the method of dividing the information stored on the storage medium into a plurality of non-overlapping partitions including a boot partition and at least one general partition,
Designate at least one of the partitions as many recoverable writes (WMR), and in use, any information that the write command is or is stored in the WMR partition before executing the write command When it is issued to be overwritten, when requested, for example at system reset, the information is copied and stored elsewhere on the storage medium and copied to the WMR partition. A method of returning is provided.
[0017]
It is clear that according to the third aspect of the invention, writing is allowed to a previous “read-only” partition, such as the boot partition, without restriction during the session. However, at the start of a new session, it does not make any changes to the partition and the partition is restored to its original state. Thus, this partition may be referred to as a many recoverable write (WMR) partition. Thus, as long as the partition starts virus-free, it becomes virus-free at the start of each new session.
[0018]
In order to achieve this, the basis of the method of the third aspect of the invention is that a copy of any “cluster” in the WMR partition to be overwritten is securely stored somewhere on the storage medium and needed In such a case, a configuration that can be restored by copying is set. This configuration defines how to do this efficiently in terms of providing maximum safety while at the same time minimizing additional memory space and throughput.
[0019]
According to the method of the third aspect of the present invention, the type of information stored in the sector and the sector are preferably arranged independently of the central processing unit (CPU) of the computer system. Management means (supervisor) is provided for controlling execution of read, write and format operations based on information stored in the storage medium so as to allow, regulate or prevent operations according to the partition type and status,
If the monitoring means has attempted to perform a prohibited read, write or format operation, it will request a reset of the computer system, which will clear the memory and load the operating system. A method is provided.
[0020]
The storage medium has a special partition (virus isolation space), and each WMR partition is assigned a file allocation table (FAT), which is held in the special partition, and each entry in the FAT is changed in the WMR partition. And the address of the copy of the information originally stored in the cluster.
[0021]
Information originally stored in the cluster may be copied to the special partition.
[0022]
Alternatively, the information originally held in the cluster may be copied to an inactive partition.
[0023]
According to a fourth aspect of the present invention, there is provided an apparatus for controlling access and change to information stored in a storage medium of a computer system, wherein the storage medium includes a boot partition and at least one general partition. In a device that is divided into non-overlapping partitions
At least one of the partitions comprises a number of recoverable write (WMR) partitions, and in use, if a write command executes the write command, any information stored in one or the WMR partition is stored. When issued for overwriting, the information is copied and stored somewhere on the storage medium, and a device that is copied back to the WMR partition when necessary, for example, by a system reset. Provided.
[0024]
Furthermore, the device is preferably independent of the central processing unit (CPU) of the computer system and operates according to the type of information stored in the sector, the type and status of the partition in which the sector is located. Comprising a monitoring means (supervisor) for controlling the execution of read, write or format operations stored on the storage medium so as to allow, regulate or prevent, in use, the monitoring means is prohibited reading If an attempt is made to perform a write or format operation, a reset of the computer system is requested.
[0025]
Any of the above methods according to the features of the present invention allows a read operation to be allowed for any information in the boot partition and a write or format attempt to the boot partition can cause a system reset. .
[0026]
Further, the plurality of sectors of the storage medium may be considered to be part of the boot partition regardless of the position of the start sector of the boot partition defined by the operating system of the storage medium.
[0027]
Also, reading of any operating system information sector or user-generated information sector in the active general partition is permitted, writing to such user-generated information sector is permitted, and such operating system information sector May be regulated such that attempts to change the size and boundary of the partition cause a system reset.
[0028]
Only information is allowed to be read from the operating system sector of the inactive general partition, and attempts to perform other read, write or format operations on such partitions will be denied. Alternatively, a system reset may be generated.
[0029]
The restriction or prevention of the execution of read, write and format operations can be lifted so that the storage medium can be set up or maintained, and then reinstated.
[0030]
The storage medium may be selected from one of a hard disk, a floppy disk, an optical disk, or a tape.
[0031]
Alternatively, the storage medium may be a file server, the computer system is a local area network, and an attempt by the user computer to perform a prohibited operation will cause the user computer to reset. It uses which partition of the file server the user computer can determine to generate.
[0032]
According to any of the above features of the invention, the apparatus may comprise hardware means adapted to be associated with the computer system.
[0033]
Alternatively, the apparatus may comprise hardware means adapted to be associated with the computer system.
[0034]
Alternatively, the apparatus can provide a combination of hardware means and firmware adapted to be associated with the computer system.
[0035]
Providing a processor that is inaccessible to users and any viruses and that monitors all data transfers during and within the subdivision of the storage medium or the storage medium placed under its control it can.
[0036]
Embodiments of the present invention will now be described by way of example only with reference to the accompanying drawings.
[0037]
DETAILED DESCRIPTION OF THE INVENTION
The setup and operation of the present invention is best understood by describing the various stages of operation involved. The embodiment of the invention described below includes, for convenience, a supervisor of the type already disclosed in PCT / GB / 00261. PCT / GB / 00261 (WO 91/13403) here is therefore related by reference.
[0038]
Reference is first made to the first embodiment of FIGS.
[0039]
1.1 Initial connection
The storage medium 1 (for example, hard disk) is first connected to a computer system (not shown), and a space on the storage medium 1 that is inaccessible to the user, that is, a dedicated area is reserved.
[0040]
The password is input and stored in the dedicated area 2 or in the supervisor flash ROM (FIGS. 4 and 13). This password is used later to allow the computer system to be set to unsupervised mode.
[0041]
1.2 Unsupervised mode
To enter this mode, it is necessary to use an unsupervised mode password (reference document PCT / GB / 00261). When the computer system is in this mode, it is provided even if the default partition mechanism can be rebuilt by the user.
[0042]
(A) The default mechanism typically consists of the following partition types: read only (RO), majority recoverable write (WMR) 3 and “general” 4. A general partition is simply a RO or WMR partition and a partition other than those that can be written to. In general, the general partition is a partition other than the RO or WMR partition and the writable partition. Each WMR partition has a sector relocation table (WMR-SRT) associated with it and held in the supervisor RAM (FIGS. 4 and 14). In use, each entry in the WMR-SRT defines the address of a sector range within the WMR partition and includes a pointer to the updated sector range. Each partition may be assigned a default partition type based on a general partition. For example, partition C = WMR; partition D = RO; all other partitions = general; partition descriptors given by these partition labels.
[0043]
(B) The user can define a descriptive string for each partition that defines its contents.
[0044]
(C) The present invention allows users if they want to revise (a) and (b), add partitions, change partition boundaries, and define partition types for each partition.
[0045]
1.3. Supervised mode
(A) If the user turns off the power at the end of the session in the supervised mode, WRM-STR is ignored and it is important to remove all pointers to the updated sector. An empty WRM-STR restores the WMR partition to its original state. This reflects the WMR partition state after performing the last change when the computer system was in unsupervised mode.
[0046]
(B) WRM-STR is initialized to ready (ready) for use.
[0047]
(C) The partition boundary and the number of partitions are checked against a table stored in the dedicated area 2 or the supervisor flash read-only memory (FIGS. 4 and 13). In the unsupervised mode, if the user changes the partition configuration without rebuilding this table, the supervised mode can be rejected until it is corrected. Alternatively, every time a user enters the supervised mode, the table can be generated using a mechanism that does not require user intervention.
[0048]
(D) The user is prompted to select a partition for normal reading and writing from the list of general partitions. This is performed before the operation of the operating system and the storage medium 1. The selected partition is defined as the “active partition” and the remaining general partitions are defined as “sleep” partitions. The active partition remains active until the session ends. A new session can be restarted if the user reenters the supervised mode by resetting the computer system and clearing the system RAM.
[0049]
(E) As an update to the above at the start of the session, the user may be prompted to provide a user name or a password that can be compared with the data in the dedicated area 2. At that time, the user may be restricted to a subset of the general partitions from which the active partition can be selected.
[0050]
(F) The user is given full access to all WMR and RO partitions (of course, the selected active partition).
[0051]
4). Access to WMR partition
As already mentioned, the WRM-STR was defined for each WMR partition 3 and stored in the dedicated area 2.
[0052]
(A) During operation of the present invention, the sector range in WMR partition 3 may need to be updated. When this occurs, a supervisor (not shown) generates an entry in the WRM-STR that defines the range of sectors to be updated and sets a pointer to the location (in the dedicated area) to write the updated sector. The original sector that has not been modified is in its original position.
[0053]
(B) The updated sector may be stored somewhere in the storage medium in the dedicated area. This dedicated area may be a special partition. Alternatively, the dedicated area may be located in the dormant partition. Since the user cannot access the dormant partition during a session, it is safe to use unallocated sectors that can be released before a new session is started. This is shown in FIG.
[0054]
(C) When the supervisor issues a request to write to the WMR partition 3, it follows the flowchart shown in FIG.
[0055]
(D) When the supervisor issues a request for reading from the WMR partition 3, the supervisor follows the flowchart shown in FIG.
[0056]
(E) Other mechanisms are possible that implement a WMR partition that causes the original sector to be copied to a safe location before the write operation to the partition completes the write operation. At the start of each session, the original sector is copied back to the original location in the WMR partition, returning the partition to its original state.
[0057]
Returning to the second embodiment of FIGS.
[0058]
2.1. Initial connection
When the storage medium 101 (for example, a hard disk) is first connected to a computer system (not shown), a space that cannot be accessed by the user is reserved on the storage medium 101. This space is a special partition and can be called the virus isolation space 102.
[0059]
The password is input and stored in the virus quarantine space 2. This password is later used to set the computer system to unsupervised mode.
[0060]
2.2 Unsupervised mode
This mode requires an unsupervised mode password (reference document PCT / GB / 00261). When the system is in this mode, the user can build both the computer system and the virus quarantine space 102.
[0061]
(A) For each partition, the user defines whether the partition is read only (RO) (not shown), majority recoverable write (WMR) 103, or “normal” 104 can do. The general partition is simply a partition other than the RO or WMR partition and can be written to. Each WMR partition has a file allocation table (WMR-FAT) allocated to it and held in the virus quarantine space 102. In use, entries in WMR-FAT are kept in virus quarantine space 102. In use, each entry in WMR-FAT defines the address of the cluster that has changed in the WMR partition and includes a pointer to a copy of the original cluster that has not changed.
[0062]
(B) The user can define a description string for each partition and define its contents.
[0063]
(C) When a partition is added or the boundary is changed, the user can revise (a) and (b). When the user is not forced to do this by the computer system, defaults such as "General" status and "Partition 104 '" are employed.
[0064]
If general guidelines are in place, the mechanism will work without user intervention, so the exact housekeeping required need not be defined. For example, partition C = WMR; all other partitions = normal; partition descriptors given by these drive letters.
[0065]
2.3 Supervised mode
(A) All WMR partitions 103 are restored to their original state by referring to the WMR-FAT in the virus isolation space 102. This also occurs when entering the unsupervised mode for consistency.
[0066]
Each WMR-FAT entry includes a pointer to the modified cluster (ie its address) in the WMR partition 102 and a pointer to a copy of the original cluster. Thus, at the start of each session, the following procedures are all required to restore the WMR partition 102.
For each WMR-FAT entry:
Copy the original cluster to a location in the WMR partition 102 (copy cluster “X” to cluster “A” as shown in FIG. 1).
-Delete the WMR-FAT entry.
(Note: A power loss or system crash during this sequence may require the procedure to be repeated, but does not affect the ability to restore the original WMR partition.)
[0067]
(B) The WMR-FAT (or a plurality of WMR-FATs) is initialized and becomes ready for use.
[0068]
(C) The partition boundary and the number of partitions are checked against a table stored in the virus isolation space 102. In the unsupervised mode, if the user changes the configuration of the partition without reconfiguring the virus quarantine space 102, the supervised mode can be rejected until it is corrected.
[0069]
(D) The user is prompted to select a partition for normal reading and writing from the list of general partitions. This is performed prior to operation of the operating system and storage medium 101. The selected partition is defined as the “active partition” and the remaining regular partitions are defined as “sleep” partitions. The active partition remains active until the session ends. A new session can be restarted when the user reenters the supervised mode by clearing the system RAM and resetting the computer system.
[0070]
(E) As an update to the above at the beginning of the session, the user may be prompted to provide a username or a username or password that can be compared with data in the dedicated area 102. At that time, the user may be restricted to a subset of normal partitions from which the active partition can be selected.
[0071]
(F) The user is given full access to all WMR and RO partitions (of course, the selected active partition).
[0072]
4). Access to WMR partition
As already described, the WRM-STR was defined for each WMR partition 103 and stored in the dedicated area 102.
[0073]
(A) During operation of the present invention, the clusters in the WMR partition 103 may need to be updated. When this occurs, a supervisor (not shown) generates an entry in the WRM-STR that defines the cluster to be updated and has a pointer to the original copy.
[0074]
(B) A copy of the original cluster may be stored somewhere in the storage medium. For example, this may be stored in a special partition or a dedicated area reserved for that purpose, such as an area in the virus isolation space 102. Instead, the original cluster can be found in temporary space within the dormant partition. Since the user (and thus the virus) cannot access the dormant partition during the session, the original cluster is safe and may be released before a new session is started. This is shown in FIG.
[0075]
(C) When a supervisor issues a write request to the WMR partition 103, the supervisor follows the flowchart shown in FIG.
[0076]
Referring now to FIG. 6, a block diagram of a hardware configuration suitable for implementing the first embodiment of the supervisor used in the embodiment of the present invention is shown. This supervisor is a read-only interface that includes a typical bus interface 7 to a motherboard such as a personal computer (PC) and a suitable BIOS (basic input / output system) to control the mode entry at the start of each session. And a memory (ROM).
[0077]
The supervisor is designed to exist between the disk interface of the PC and the disk drive. The PC is connected to the supervisor via ribbon cable 201 from its integrated device electronics (IDE) bus. The supervisor is then connected to the disk drive via a second ribbon cable 202 that also functions as an IDE bus. All communication between the PC and the hard disk is controlled by the supervisor.
[0078]
Supervisor hardware is used to hold the microprocessor 216, read-only memory (ROM) 213 holding the supervisor operating system and control program, and parameters and WRM-SRT (or multiple SRTs). And a random access memory (RAM 214) which is a scratch memory to be used.
[0079]
The dual port RAM 210 includes memory that can be accessed by both the PC and the supervisor processor. The supervisor may use this memory to reflect the IDE task register.
[0080]
Transceivers 206, 209 and multiplexer 205 allow the PC or supervisor processor to access the disk drive. The supervisor controls which of these has access. Latches 207, 208 allow a supervisor with an 8-bit bus to read and write 16-bit values from the disk drive.
[0081]
Logic block 212 includes a latch that is writable by the supervisor processor. The value of this latch is compared with the PC interface upper address bus and the BIOS 211 is only enabled when they match. This causes the BIOS to be built through the supervisor and appear anywhere in the lowest megabyte PC address space.
[0082]
Logic block 215 maps ROM 213, RAM 214 and dual port RAM 210 to the supervisor processor address space. This logic block 215 also controls access to the latches 207, 208 and logic block 212.
[0083]
Logic block 204 ensures that control signals passing between the PC and the disk drive are correctly buffered and inhibits these control signals when the supervisor processor is connected to the disk drive. is doing.
[0084]
Logic block 203 ensures that communication between the PC and the disk drive is subject to supervisor control. This monitors and controls read and write commands to the task file register on the disk drive. The supervisor processor is made aware of the critical operation being attempted and controls whether the operation is in progress, blocked, or the request has changed. This is done by decoding the PC address line along with the read and write control signals. Certain read and write attempts will cause supervisor processor interrupts. The supervisor then operates based on the change. Multiple disk drive interrupts can be routed first to the supervisor processor where they can be forwarded to the PC if necessary.
[0085]
Supervisor processor 2
Since 16 can only fetch executable code from the built-in ROM 213, examining FIG. 4 makes it clear that a virus can never interfere with the supervisor processor 216.
[0086]
A more detailed description of the embodiment of the supervisor shown in FIG. 6 is not provided here because it is within the normal understanding of a person skilled in the art.
[0087]
Referring now to FIG. 7, there is shown a block diagram of a suitable hardware configuration for implementing the second embodiment of the present invention. This supervisor is a read-only including a typical hard disk adapter card interface 310 to a motherboard such as a personal computer (PC) and a suitable BIOS (basic input / output system) to operate the hard disk. A memory (ROM) 312 is provided.
[0088]
The supervisor hardware includes a microprocessor 314 and a transceiver 316 so that the PC cannot directly select or arbitrate for multiple disk drives or issue commands through the SCSI interface 318. In addition, access of the PC regulation to the SCSI 318 is permitted. These operations can only be performed by the supervisor processor 314, which communicates bidirectionally with the PC using the status input / output ports 320 and 322.
[0089]
Communication between the supervisor processor 314 and the SCSI interface 318 occurs through the bidirectional port of the second transceiver 324. The supervisor further includes a built-in read only memory (ROM) 326 that contains a supervisor operating system and control program, and a random access memory (RAM) 328 that is a scratch memory used to hold parameters. I have. A reset logic 330 is further provided and used to clear the PC memory if an attempt is made to perform an operation prohibited by the supervisor.
[0090]
Referring to FIG. 8, a schematic block diagram of an embodiment of the supervisor is shown by integers with the same numbers as in FIG.
[0091]
In addition, the embodiment of FIG. 8 includes the following components: gate array logic (GAL) devices G1-G5; buffers B1, B2; and flip-flops 74, 1 (1), 74, 1 (2) and 74 and 2 (2).
[0092]
The function of this component is as follows. G1 maps the ROM BIOS to the IBM memory map, and also makes a tristate connection of the output of flip-flops 74, 2 (2) to the IBM data bus.
[0093]
G2 performs access to a subset of the SCSI controller's internal registers by the IBM by mapping them to the IBM I / O space. G2 further provides pseudo DMA decoding logic for transferring data to and from the SCSI controller and maps flags or flip-flops 74, 2 (2) and P1 to the IBM I / O space.
[0094]
G3 multiplexes between the supervisor bus and the IBM address bus to the SCSI controller address bus.
[0095]
G4 multiplexes between the supervisor bus and the IBM control line to the SCSI controller. G4 further enables transceiver T1 or T2 (never both) and includes logic for possible wait states during data transfer between the IBM and the SCSI controller.
[0096]
G5 maps all ports in the supervisor I / O space: latches P1, P2, SCSI reset line and flip-flops 74, 1 (2) and 74, 2 (2). G5 also maps the ROM to the supervisor memory map and tristates the outputs of flip-flops 74, 2 (2) to the supervisor data bus.
[0097]
Buffers B1, B2 ensure that current from the IBM backplane can be the only gate that flows into each of the address IOR and IOW lines.
[0098]
The flip-flops 74 and 1 (1) divide the clock frequency by ½ and make the pulse a rectangular wave. Whether the IBM has (restricted) access to the SCSI controller or the supervisor has access depends on the output of flip-flops 74, 1 (2).
[0099]
Flip-flops 74, 2 (1) form part of the timing formation for wait state generation during SCSI data transfer, while flip-flops 74, 2 (2) have data bytes sent from IBM Is a supervisor attention flag that represents.
[0100]
The components of the embodiment of FIG. 4 are as follows. GAL G1 to G5 are of SCS Thomson GAL16V8-15ns type, flip-flop 74, 1 (1), 74, 1 (2), 74, 2 (1) and 74, 2 (2) are 74ALS74 type Buffers B1 and B2 are 74ALS244, latches P1 and P2 are 74ALS73, transceivers T1 and T2 are 74F245, processor 14 is Zylog Z84C50 (10 MHz), and read-only memory 12 is 2764 ( 8K × 8), and the SCSI controller 18 is an NCR5380.
[0101]
Since the supervisor microprocessor 314 can only fetch executable code from the built-in ROM 326, examining FIG. 8 makes it clear that a virus can never interfere with the supervisor processor 314.
[0102]
The supervisor embodiment shown in FIG. 8 will not be described in further detail here because it is within the normal understanding of a person skilled in the art.
[0103]
The embodiments of the present invention have been described as examples only, and are not intended to limit the scope of the present invention in any way.
[0104]
It should be understood that the present invention seeks to eliminate problems that were previously notable in the prior art with little impact on storage and performance overhead. The present invention allows "supervised" users full read and write access to the boot partition, and the boot partition at the start of each session on the computer system is clean and virus free and unmodified I guarantee that. This addresses the problems outlined above and allows maintenance of complete virus protection disclosed in PCT / GB91 / 00261.
[0105]
The user can assume that he wants to maintain changes between sessions. In that case, the user can create a batch file that stores the modified files in the active partition before shutting down. At the start of a new session, these files can be replaced with the original ones in the WMR partition.
[Brief description of the drawings]
FIG. 1 is a schematic diagram showing division of a storage medium used in a first embodiment of the present invention.
FIG. 2 is a flow chart showing a sequence of events when a computer system attempts to write to a multiple recoverable write (WMR) partition used in the embodiment of FIG.
FIG. 3 is a flowchart illustrating a sequence of events when a computer system attempts to read from a many recoverable write (WMR) partition.
FIG. 4 is a schematic diagram showing division of a storage medium used in the present invention.
FIG. 5 is a flow chart showing a sequence of events when a computer system attempts to write to a multi-recoverable write (WMR) used in the embodiment of FIG.
FIG. 6 is a schematic block diagram of a hardware configuration of a first embodiment of a supervisor used in the present invention.
FIG. 7 is a schematic block diagram of a hardware configuration of a second embodiment of the supervisor used in the present invention.
FIG. 8 is a schematic circuit diagram of an actual embodiment of the supervisor of FIG. 7;
[Explanation of symbols]
101 storage medium
102 Virus isolation space
103 WMR partition
213 Read-only memory (ROM)
214 Random Access Memory (RAM)
216, 314 Microprocessor
318 SCSI interface
330 Reset logic

Claims (31)

A method for controlling access and modification of information stored on a non-volatile storage medium forming part of a computer system comprising:
At least a portion specified number Recoverable write (WMR) portion, Ru issued to overwrite the residual information stored in one or more of the WMR portion by updated information writing of said storage medium in response to the command, to allow access to the update information according to the requirements in the remainder of the session, any residual information is stored, on the storage medium other than the position pointer to the updated information is set or maintained It writes the updated information on the position,
In response to a next read command, used to access the update information about the location of the residual information so that the pointer overwrites the residual information;
The method of controlling access and changes stored in the storage medium forming part of a computer system, characterized in that. The method of claim 1, wherein a system reset clears the update information along with a list of pointers to this information so that future read commands can access the original information . The information stored on the storage medium is divided into a plurality of non-overlapping partitions including a boot partition and at least one general partition, wherein at least one of the partitions designates a WMR portion. 2. The method according to 2. The method of claim 3, wherein the boot partition on the storage medium specifies a WMR portion . The method according to claim 3 or 4, wherein the general partition specifies the WMR part . Management means independent of the central processing unit (CPU) of the computer system and made inaccessible to its users;
The management means is information that is read from or written to a sector is operating system information or user information, whether the sector is in the boot partition or a general partition, and Allows, regulates, or prohibits read / write operations on the storage medium according to whether the partition is active or inactive;
It said management means permits only format operation on active general partition, and prohibits the format operation on the boot partition or on a inert general partition,
And a warning to the user when a prohibited read, write or format operation is performed ,
6. A method according to claim 3, 4 or 5 . The method according to claim 6, wherein a space is secured on the storage medium that is a management means and is accessed only by the management means called a dedicated area. Each WMR part has a sector reallocation table (SRT) associated with it, holding the table in the random access memory (RAM) of the management means , and each entry in the SRT is in an updated WMR part . the address of a range of sectors, and addresses the update information is located, to define an address for positioning the update information, claims 1, the address position where the update information is located is in the exclusive area 7 The method in any one of . An apparatus for controlling access and modifications to information stored in a nonvolatile storage medium of the computer system, in the device can be specified as a number Recoverable write (WMR) at least one portion of said storage medium, The device is
A means capable of responding to a write command issued to overwrite any remaining information stored in the WMR portion by the update information, wherein any remaining information on the storage medium is stored. The update information is written to a non-location, and is a pointer to the update information, retained to make the update information accessible in response to a write command issued for the overwritten data Comprising said means for holding a pointer ;
Said device. The apparatus of claim 9, wherein a system reset clears the update information along with a list of pointers to the update information. The information stored on the storage medium is divided into a plurality of non-overlapping partitions including one boot partition and at least one general partition, and at least one of the partitions specifies a WMR portion. Or the apparatus of 10. The apparatus comprises management means independent of a central processing unit (CPU) of the computer system and made inaccessible to a user,
The management means, during use, whether the information read from or written to the sector is operating system information or user information, whether the sector is the boot partition or a general partition And, if the partition is a general partition, allows, regulates, or prohibits read and write operations on the storage medium according to whether the partition is active or inactive,
The management means further permits the formatting operation only on the active general partition and prohibits the formatting operation on the boot partition or the inactive general partition,
If the monitoring means is a prohibited read, write or format operation and has attempted to perform the operation that is blocked by the management means , it issues a warning to the user ;
The apparatus of claim 11. A method for controlling access and modification of information stored on a non-volatile storage medium that forms part of a computer system comprising:
Designating at least a portion of the storage medium as a multiple recoverable write (WMR) portion ;
In response to a write command issued to overwrite any residual information stored in one or more of the WMR portions with update information, the residual information is copied before executing the write command. Stored in another location on the storage medium,
A system reset copies the copied information back to the WMR portion and returns the WMR portion to its original state.
Said method. Independent of the central processing unit (CPU) of the computer system, the operation is permitted according to the type of information stored in the sector and the type and status of the portion of the storage medium in which the sector is located; Management means for controlling execution of read, write and format operations based on information stored in the storage medium so as to regulate or prevent,
If the management means attempts to perform a prohibited read, write or format operation, the management means will request a reset of the computer system, the reset will clear the memory and load the operating system. make,
The method of claim 13 . The storage medium comprises a special partition, each WMR portion allocated file allocation table (FAT) is, this table is held in the special partition, each entry in the FAT address of a cluster that has been modified in the WMR partition 15. The method of claim 11 or claim 14 , wherein the address of a copy of the information originally held in the cluster is defined. The method of claim 15 , wherein the information originally stored in the cluster is copied to the special partition. The method of claim 15 , wherein the information originally held in the cluster is copied to an inactive partition. An apparatus for controlling access and modification of information stored in a non-volatile storage medium of a computer system, comprising:
At least one portion of the storage medium is operable to be designated as multiple recoverable writes (WMR);
Means for responding to a write command issued to overwrite any residual information stored in the WMR portion with update information, before executing the write command, copying the residual information, Said means for storing said residual information at another location on a storage medium;
Means for responding to a system reset to copy the copied information back to the WMR portion to return the WMR portion to its original state;
The apparatus comprising: Independent of the central processing unit (CPU) of the computer system, allows, regulates or blocks operations according to the type of information stored in a sector and the type and status of the partition in which the sector is located as the read stored on the storage medium, further comprising a management unit for controlling the execution of the write or format operation, in use, the monitoring means reads banned, in order to perform a write or format operation 19. The apparatus of claim 18, causing a reset of the computer system if requested. Information stored on the storage medium is divided into a plurality of non-overlapping partitions including a boot partition and at least one general partition, the at least one partition is designated as a WMR portion, and a read operation is performed on the boot partition. 14. A method as claimed in claim 1 or claim 13 , wherein an attempt is made to write any information to the boot partition, or an attempt to write or format the boot partition causes a system reset. Multiple boot sector of the storage medium is considered to be part of the boot partition, it claims 20 and the position of the starting sector of the boot partition as defined by the storage medium operating system is irrelevant The method described. Reading of any operating system information sector or user-generated information sector in the active general partition is allowed, writing to such user-generated information sector is allowed, and writing to such operating system information sector 22. The method of claim 20 or 21 , wherein writing to the operating system information sector causes an attempt to change the size and boundary of the partition to cause a system reset. Only information is allowed to be read from the operating system sector of the inactive general partition, and attempts to perform other read, write or format operations on such partitions will be denied. The method according to claim 20 or 21 , wherein a system reset is generated. Reading, regulating or blocking the execution of the write and format operations is released, the set of storage medium up or perform maintenance and will, subsequent process of claim 23, wherein the re-restoration is possible of the storage medium. The storage medium is a hard disk, floppy disk, according to claim 1 or 13 method wherein one of the optical disks or tape. The storage medium is a file server in a computer system including a local area network , and when attempting to perform an operation prohibited by the user computer , the user computer 14. A method according to claim 1 or 13 , wherein it is determined whether the partition is being used and a reset of the user computer is required . 19. Apparatus according to claim 9 or 18, comprising hardware means adapted to be associated with the computer system. 19. Apparatus according to claim 9 or 18, wherein said apparatus comprises hardware means adapted to be associated with said computer system. 19. Apparatus according to claim 9 or 18, wherein said apparatus comprises a combination of hardware means and firmware, both adapted to be associated with said computer system. Also inaccessible respect against and how viruses user, and the storage medium or even in and of the plurality between a plurality further divided portions of the original to put the storage medium of the control all the claims 9, 10 Ru comprising a processor for managing data transfer, 18 or 19 apparatus according the divided portion. The user, prior to shutdown, to allow creation of batch files for storing the modified file in the active partition (or more batch files), the batch file (or the plurality of batch file) to use the new It includes replacing the information stored in the WMR portion at the start of the session, the method according to any one of claims 1 to 8, or claim 13 17.

Images