KR920010973B1 - Circuit and method of protecting hard and floppy disc - Google Patents

Abstract

The circuit protects a hard disk or a floppy disk from computer viruses by using the characteristic of the hard or floppy disk. The circuit is composed of an address decoding section (420) connected to the address bus of a computer system to generate the selected signal, a safeguarding program memory section (430), and a buffer section (440) connected to the output stage and data bus of the address decoding section (420) to be used by the safeguarding program.

Description

Circuitry and protection methods to protect hard and floppy disks from computer viruses

1 is a block diagram schematically showing the configuration of a computer system to which the present invention is applied;

2 is a structural diagram of a hard and floppy disk,

3 is a block diagram showing a schematic configuration of a hard and floppy disk protection circuit according to the present invention;

4 is a detailed circuit diagram of the operation monitoring circuit of FIG.

5 is a hard and floppy disk operation of the computer system to which the present invention is applied,

6 is a flowchart of a protection program and a hard and floppy disk control program according to the present invention;

7 is a flowchart of an NMI program according to the present invention;

* Explanation of symbols for main parts of the drawings

100: CPU 200: System ROM BIOS

300: system memory 400: hard / floppy disk protection circuit

a: data area b: information area

c: directory area d: file allocation table area

e: disk information area 410: expansion bus

420: address decoder unit 430: ROM BIOS unit incorporating protection program

440: buffer memory portion to be used by the protection program

450: motion detection circuit

451: flip-flop 452: AND gate

10: application 20: protection program

30: Hard and Floppy Disk Protection Program

40: Hard and Floppy Disk Controllers

50: drive hard and floppy disks

60: Hard and Floppy Disk Motion Detector

The present invention relates to a circuit for protecting a hard disk or a floppy disk from a computer virus, and a protection method using the circuit.

With the advent of the computer age, programs have emerged and become polarized by some sloppy programmers (aka "computer viruses") that prevent computers from functioning properly.

A computer virus is a program written by someone who, when stored on a disk, turns on the computer and moves it to the main memory of the computer, destroying the data on the disk used by the computer, making the whole or part of the disk unusable, Adversely affects.

The conventional computer bias reduction method for improving this is as follows.

Previously, a program that checks for viruses before using a program or a diskette has been used to determine whether a virus is infected, or a virus detection program resides in a system to check for virus infection.

However, since these methods can only be used after the operating system (hereinafter simply referred to as “OS”) is running, there is no measure to prevent or recover from an infection with the OS. The detection program did not detect this, so there was no countermeasure against new viruses, and the process to check for viruses was inconvenient.

In addition, even if you have a virus scanning program built into your hard disk system and it is scanned during OS booting, there is no countermeasure when booting from a floppy disk, and once the system is infected with a virus, it will not prevent the infection of the hard and floppy disks used. There was a problem.

In order to solve the problems described above, the present invention draws out the hard and floppy disk protection circuits and the circuits which essentially cope with the stored data (information) by using the characteristics of the hard and floppy disks. The purpose of the present invention is to provide a hard and floppy disk protection method.

In order to achieve the above object, the present invention provides a circuit for protecting hard and floppy disks from a virus program in a computer system, comprising: an address decoder means connected to an address bus and outputting a selection signal, the address decoder means and a data bus; Means connected to and connected to said address decoder means and a data bus, and to said buffer memory means used by said protection program, to said address decoder means and to a data bus and that said protection program is not operated. It consists of motion detection means that monitors the direct use of hard and floppy disk controllers.

Also, in the hard and floppy disk protection method using the above circuit, the first step of selecting only the initialization function and the write function directly affecting the disk among the required functions after the operation detection circuit is disabled is selected. Information stored on the disk, including a second step of judging, a third step of judging the state of the disc and a required write area, and a fourth step of judging and continuing the program according to the state of the third step Is essentially dealt with so that it is not destroyed by a virus program.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram schematically showing the configuration of a computer system to which the present invention is applied.

In the drawings, 100 is a central processing unit (CPU), 200 is a system ROM (ROM: Read Only Memory) BIOS (Basic Input Output System), 300 is a system memory, 400 is a hard and floppy according to the present invention. Each disk protection circuit is shown.

The protection circuit 400 of the present invention is connected to the system as shown in the drawing, and the initialization portion is executed in the same form as the execution of the expansion ROM BIOS at the time of system booting, so that information necessary for protecting the disk can be obtained. Set up and control programs that control the flow of protection programs so that they can run before the disk program.

2 shows the structure of hard and floppy disks.

In the drawing, a denotes a data area, b denotes an information area, and the information area b again represents a directory field (c), a file allocation table (d), and a disc information area ( e). The disk information area (e) is an area for storing physical information of the disk, and the file allocation table area (d) shows how the files are stored in the data area (a). In particular, it uses special codes for the concatenated state and bad data areas.

The directory field (c) is composed of a file name, a date a file is created, a file size, information related to the file in the file allocation table, a file attribute (Attcribute), and the like.

The three regions c, d, and e may be distinguished from each other by proper or inappropriate data.

However, the data area a cannot distinguish whether or not it is valid data. However, all of the above areas can be write-protected and forbidden to initialize, and a suspicious program can be used to check for signs of viruses.

3 is a blur diagram showing a schematic configuration of a circuit for protecting hard and floppy disks from viruses according to the present invention, where 410 is an expansion bus, 420 is an address decoder, and 430 is a ROM BIOS which contains a protection program. Denotes a buffer memory portion to be used by the protection program, and denotes an operation detection circuit portion, respectively.

As shown in FIG. 1, the protection circuit of the present invention is connected to the computer system and operates. The protection circuit includes an address decoder 420 connected to an address bus and selecting respective parts of a subsequent stage, and the address decoder 420. A ROM BIOS unit 430 connected to an output terminal and a data bus of the buffer program, and including a protection program; and a buffer memory unit connected to an output terminal and a data bus of the address decoder unit 420 and required for operation of the protection program. 440 and the output terminal of the address decoder 420 and the data bus, and a hard and floppy disk controller (not shown) is directly used without the protection program or the disk control program being operated. It consists of a motion detection circuit (450).

As illustrated in FIG. 4, the motion detection circuit unit 450 is connected to the address decoder unit 420 and the data bus to select whether to detect an operation completion signal, and the flip-flop 451. ) AND gate connected to the output terminal and the expansion bus 410 to selectively input an interrupt acknowledgment, and to output a non-maskable interrupt (NMI) signal, an interrupt signal of another kind, or a signal using a similar function. It consists of 452.

Thus, when the disk control program or the protection program is running, the monitoring function is paused for normal operation, and after the normal operation is performed, the monitoring function is activated again.

On the other hand, when the monitoring function is activated, NMI, or other kind of interrupt signal, or a signal using a similar function is called when the controller directly operates, so that the NMI, or other function of the protection program is called. Allows the user to warn or halt the system in some kind of interrupt signal, or signal processing portion that utilizes similar functionality.

5 is an operation diagram of a hard and floppy disk of a computer system to which the present invention is applied, wherein 10 is a block in which an application program is executed, 20 is a block in which a protection program is executed according to the present invention, and 30 is a hard and floppy disk control. A block in which a program is executed, 40 denotes a block for operating a hard and floppy disk controller, 50 denotes a block for driving a hard and floppy disk, and 60 denotes a block in which the hardware of the present invention performs an operation monitoring function. The part represents the part added in the present invention.

An application program or a virus program uses hard and floppy disk control programs through the protection program of the present invention. Therefore, the virus detection program detects the signal generated as the operation completion signal during the control operation, and detects the case where the hard or floppy disk is directly used without the protection program.

The protection program of the present invention checks the disk initialization function and write only affecting these disks in the hard and floppy disk control programs to check whether it is an honest type of operation or appropriate data is being written, otherwise the user is warned. In order to prevent computer virus infection or system destruction by sending or stopping the system, a more detailed description will be given with reference to FIG.

6 is a flowchart of a protection program and a hard and floppy disk control program according to the present invention.

The protection program of the present invention first selects and checks only the initialization function or write function that affects the disk after the operation detection circuit is disabled (21), and determines whether to use the protection program (23). When using the protection program, check whether the entire disk is write-protected (24). If it is not write-protected, determine which area is the write required (25). If the area is write-protected, check whether to proceed further. (27). If the write area is determined as the file list and file application table area in the write area determination section 25 above, it is determined whether the data to be written is appropriate data (26). If the write data is appropriate, the hard and floppy disk control program is executed. The process goes to step 27. If the write area is the data area in the write area determination 25, the process proceeds directly to the hard and floppy disk control program, and if the disk area is the disk information area, the process proceeds to the determination step 27.

In step 27, if it is possible to proceed, proceed to the hard and floppy disk control program to enable the operation detection circuit after performing the service routine 31, and if it is impossible to proceed, Stopping 28 completes all performance.

FIG. 7 detects the operation of the hardware in the situation where the protection program is not operated as described above, determines whether to proceed (72), proceeds (73), or stops the system. ), Or a flow diagram of a program using other types of interrupt signals or similar functions.

The present invention constructed and operated as described above has the following effects.

First, the circuit of the present invention can be added to an existing system to easily protect the disk, and also check the presence of virus infection.

Second, since the protection program operates from the initial initialization of the hardware (hard and floppy disk), it improves safety.

Third, if a virus is modified or a new virus is created, no new protection program is needed.

Fourth, it works regardless of the floppy or hard disk booting.

Fifth, by adding the circuit of the present invention to a computer system, it is possible to prevent system destruction due to an error in use.

Sixth, it works regardless of operating system (OS).

Seventh, continuously monitor the intrusion of viruses to improve the reliability of information storage.

Claims (7)

A circuit mounted on a computer system to protect hard and floppy disks from a virus program, the circuit comprising: address decoder means (420) connected to an address bus of the computer system and outputting a selection signal; Means (430) connected to an output of said address decoder means (420) and to a data bus of said computer system for storing a protection program; And a buffer means 440 connected to an output terminal and a data bus of the address decoder means 420, so that the stored information is not destroyed by a virus program. Circuitry that protects hard and floppy disks from computer viruses. 5. The motion detection means (450) of claim 1, which is connected to an output terminal and a data bus of the address decoder means (420) and monitors the direct use of the hard and floppy disk controllers without the protection program being operated. Circuitry that protects the hard and floppy disks from a computer virus, characterized in that it is further configured to prevent the stored information from being destroyed by a virus program. 3. The apparatus of claim 2, wherein the motion detection means (450) comprises: a flip-flop (451) connected to an output terminal and a data bus of the address decoder means (420); And an AND gate 452 connected to an output terminal of the flip-flop 451 and an expansion bus to alert the user or to stop the system when the hard and floppy disk controllers operate under the protection program inoperation state. Circuitry that protects hard and floppy disks from computer viruses. An address decoder means 420 connected to an address bus and outputting a selection signal, an output end of the address decoder means and a means 430 connected to a data bus and storing a protection program, an output end and data of the address decoder means Buffer means 440 connected to the bus and used by the protection program, and motion detection means 450 connected to the output terminal and data bus of the address decoder means and for monitoring the operation of the hard and floppy disk controllers. In the hard and floppy disk protection method of a computer system having a built-in hard and floppy disk protection circuit, after the motion detection means is disabled (21) during the initialization function and the write function directly affecting the disk 22 selecting the first step; Determining whether to use a protection program (23); A third step (25) of determining the state of the disk 24 and the required write area; And a fourth step of determining (27) whether or not the program is to be continued according to the state of the third step, so that the information stored on the disk is not destroyed by the virus program. How to protect your hard and floppy disks from viruses. 5. The method of claim 4, wherein the third step comprises: a first step (24) of determining whether the entire disk to be used is write-protected; A second step (25) of determining in which area a write is required if the entire disc is not prohibited from writing in the first step (24); If the write request of the second process is a file list and a file application table area, it is determined whether the data is appropriate data (26). If the data area is a data area, a hard and floppy control program is executed immediately. A method for protecting hard disks and floppy disks from computer viruses, characterized in that the process is carried out by a third process proceeding to the determination of whether or not to proceed. The method of claim 4, wherein the fourth step determines whether to proceed (27) and if possible proceeds with the hard and floppy control program (31, 32), otherwise the system is stopped (28) to protect the disk A method of protecting hard and floppy disks from computer viruses, characterized by the preservation of data. 5. The method of claim 4, wherein after performing the first step, when the hard and floppy disk controllers are operated without performing the second, third, and fourth steps, the system proceeds to determine whether to continue / stop the system and to process them. And a fifth step of protecting the hard disk and the floppy disk from a virus.

Images