RU85249U1 - HARDWARE ANTI-VIRUS - Google Patents

Abstract

1. A hardware antivirus that prevents the spread of malware components (software) located between a personal computer and an information storage device, containing at least two interfaces, one of which is connected to the computer’s system bus, and the other is connected to the storage medium, which is a transparent filter, providing data transfer between interfaces, the filtering of the data is carried out by the central processor of the antivirus, which uses random access memory stroystvo, the antivirus main job is to filter incoming data, and if they are not detected malicious software component, the data is recorded on the recording medium, if the data is found in malicious software component, the data is not recorded. ! 2. The hardware antivirus according to claim 1, built into the hard disk controller. ! 3. The hardware antivirus according to claim 1, which, if a malware component is detected, simulates writing to a data disk without writing data to a storage medium. ! 4. The hardware antivirus according to claim 1, which, in the event of detection of a component of malicious software to the computer system, a write error message is transmitted. ! 5. The hardware antivirus according to claim 1, having a set of encrypted commands by which the computer software antivirus is able to manage the hardware antivirus, bypassing the hierarchy of user rights, directly accessing the storage medium. ! 6. Hardware antivirus according to claims 1 and 5, which additionally performs the removal of rootkits from the storage medium under the control of software antivirus, while the software antivirus manages

Description

Technical field

This utility model relates to malware detection and treatment systems and, more specifically, to the use of hardware antivirus to treat infected computer systems.

State of the art

The invention relates to methods of protection against malicious software, and in particular the identification of components of malicious software. It is based on the creation of a hardware antivirus system for the treatment of infected computer systems.

Currently, there are many different antiviruses, but they are all part of the operating system. Antivirus software (hereinafter referred to as software) usually uses two different methods to perform its tasks: scanning files to find known viruses and detecting suspicious behavior of any of the programs similar to the behavior of an infected program. Since the main stream of malicious components is written to hard drives, the need to scan hard drives is very popular.

Existing antiviruses use the resources of shared RAM and processor on a par with other applications, including malware. Antiviruses installed in the OS have both administrator and user rights, but some components of malware also have the same rights. Therefore, having equal rights with the malware, the antivirus cannot remove one or another of its components. The main example of such malware is rootkits. A rootkit is a set of utilities or a special kernel module that an cracker installs on a hacked computer system immediately after he receives administrator rights. A set of utilities, as a rule, includes a variety of functions for "sweeping the traces" of an invasion of the system. The rootkit allows an attacker to gain a foothold in the hacked system and hide the traces of his stay by hiding files, processes and the presence of the rootkit in the system. Thus, it can hide not only from the user, but also from antiviruses. There is also the possibility that by gaining more privileged rights, the rootkit can somehow damage the antivirus or spoil its performance. There are various methods to combat rootkits, but, however, there is no way that is guaranteed to be able to remove the rootkit from the system.

Before using a conventional antivirus, you must first install it in the OS. There is also a problem loading system resources while the antivirus is running, since it uses shared resources. Gradually, there is a need to create an antivirus that could remove malware, avoiding access and rights issues, as well as not loading the computer system as a whole.

Thus, the technical result of the claimed utility model is the use of hardware antivirus to increase the level of treatment of infected computer systems.

SUMMARY OF THE INVENTION

This technical result is achieved due to the fact that, according to one embodiment, a hardware antivirus that prevents the spread of malware components (software) located between a personal computer and an information storage device containing at least two interfaces, one of which is connected to the computer’s system bus, and another is connected to the storage medium, which is at the same time a transparent filter that provides data transfer between interfaces, filtering the mentioned data s is carried out by the central processor of the antivirus, which uses a random access memory, the main work of the antivirus is to filter incoming data, and if no malware component is detected in them, then the data is written to the storage medium, if the malware component is found in the data, data is not recorded.

In a private embodiment, hardware antivirus is integrated into the hard disk controller.

In a private embodiment, a hardware antivirus, in case of detection of a malware component, simulates writing to a data disk without writing data to a storage medium.

In a particular embodiment, a hardware antivirus, in the event that a malware component is detected, transmits a write error message to the computer system.

In a particular embodiment, the hardware antivirus has a set of encrypted commands with which the computer software antivirus is able to manage the hardware antivirus, bypassing the hierarchy of user rights, directly accessing the storage medium.

In a particular embodiment, the hardware antivirus additionally performs the removal of rootkits from the storage medium under the control of the software antivirus, while the software antivirus is guided by updated antivirus databases.

In a particular embodiment, the update of the anti-virus databases of the hardware anti-virus is performed by using the utility for updating the anti-virus databases of the hardware anti-virus, by which a connection is established with the hardware anti-virus, sending it a secret code or an encrypted key that identifies the utility, in response to such code, the hardware anti-virus sends a successful response authentication, after which the utility transfers updates to the anti-virus databases, which are stored in the memory of the hardware anti-virus.

In a particular embodiment, the anti-virus databases are additionally verified inside the hardware anti-virus, and if the verification is successful, then the anti-virus databases are added to the working database and code area.

In a private embodiment, the relevance of anti-virus databases is additionally checked.

Brief description of the attached drawings

The accompanying drawings are intended to further understand the claimed utility model, form part of this description, illustrate implementation options for the utility model, and together with the description serve to explain the principles of the utility model.

In the drawings:

Figure 1 shows a structural block diagram of a hardware antivirus system in the General case in accordance with an exemplary embodiment.

Figure 2 shows the algorithm of the hardware antivirus system in accordance with an exemplary embodiment.

FIG. 3 shows a structural block diagram of a hardware and software antivirus collaboration system in accordance with an exemplary embodiment.

FIG. 4 shows a structural block diagram of a hardware antivirus system update in accordance with an exemplary embodiment.

Figure 5 shows a block diagram of an update algorithm for a hardware antivirus system in accordance with an exemplary embodiment.

Figure 6 also shows a block diagram of an update verification algorithm for a hardware antivirus system in accordance with an exemplary embodiment.

Detailed Description of Preferred Embodiments

Next, a detailed description of the accompanying drawings of the hardware antivirus system and the method for updating it will be considered.

The proposed system is located between a personal computer and any disk device. It can be made in the form of a separate device or integrated into the disk controller, and can also be in the form of a transparent filter in the gap of the interface cable. Thus, the computer will not suspect that the data that it is trying to write to disk is checked. Accordingly, the components of the malware will also not record the tracking of their actions.

Figure 1 shows a structural block diagram of a hardware antivirus system in the General case in accordance with an example implementation. The system of hardware antivirus 130 is located between the personal computer and the disk 120 and is connected to the system bus 110 of the personal computer. The hardware antivirus system has its own central processor 140 and random access memory 150. Thus, the system will not require the shared resources of a personal computer; it will work independently without loading the system, as almost all modern anti-virus solutions now do. In one embodiment, the system can be integrated into the disk controller 120.

Figure 2 shows a block diagram of the algorithm of the hardware antivirus system in accordance with an example implementation. After creating the record that needs to be written to the disk, in step 210, the personal computer transfers it to the hard disk controller in step 220 (in the private version). In a particular embodiment, a hardware antivirus system is built into the hard disk controller, which, when the computer interacts with the disk, starts scanning the transmitted data for malicious components in step 225. If the transmitted data does not contain viruses in step 230, then the data is written to the disk in step 240 Otherwise, there are several approaches to the response to the detection of malicious components. The system can simulate writing to disk, but in fact it does not. The malicious component will think that the operation will succeed, but in fact no changes will be made. Another option for responding to viruses is to send a write error message to the computer system. Thus, the computer system will know for sure that there was a failure during recording in step 235.

There are several different options for implementing the hardware antivirus system with low-level data that goes through the controller. One of them is the study of the contents of sectors during their transmission. But this method alone contains some disadvantages associated with the limited capabilities of the system. It turns out that the system scans data only during its reading / writing. But there are many hidden files that are masked in the system or inactive. These files will not be recognized by the hardware antivirus system, as they will not perform read / write actions. Accordingly, they will not be recognized as malicious. To solve this problem, there is another way of processing data - to scan the disk regardless of the personal computer. When accessing malicious objects, the system must neutralize them. There is a problem that a file system analyzer is needed to scan a file system. In this case, when scanning a disk while examining a file, it can be understood that the first sector of the scanned file describes the executable file and after that it should be taken under control.

There is also another way of processing data - this is working with a conventional antivirus. The job is that the antivirus 310, shown in Figure 3, has a set of encrypted commands with which it can give certain instructions to the hardware antivirus system 320. This will give antivirus 310 access to disk 330 bypassing the user rights hierarchy. In this situation, antivirus 310 can find a rootkit or other malware component on disk 330, which it cannot bypass or delete due to the fact that in many operating systems there is a restriction of rights for applications. Even having administrator rights, antivirus 310 cannot delete a rootkit that has the same rights. But in conjunction with the hardware antivirus 320 system, which works outside the operating system of a personal computer, and accordingly, the rights policy of the operating system does not apply to it, the maximum efficiency of a conventional antivirus 310 is achieved due to the removal of rootkits and other components of malware.

One of the main aspects of the anti-virus operation is the availability of anti-virus database updates. Anti-virus databases should always be up to date to combat the latest malware components. The update situation can be addressed in several ways. In one particular embodiment, when a hardware antivirus system is running along with a regular antivirus, updates will be downloaded by a regular antivirus, but they will not be required by a hardware antivirus system. But in this case, the hardware antivirus system plays a secondary role and is designed to remove rootkits found by a conventional antivirus. In another particular embodiment depicted in FIG. 4, a special utility 410 is used to download updates, which is installed on a user computer system. In this case, the hardware antivirus system is logically divided into two parts: the main part 420, which consists of working anti-virus databases and code, and the update part 430. The hardware antivirus system and the personal computer are connected using the utility 410, which starts to install when new updates are downloaded connection to the hardware antivirus system, sending it some secret code (or an encrypted key) that identifies it as a trusted application. In turn, the hardware antivirus system sends a response about successful authentication to utility 410, and then utility 410 starts sending updates to update area 430. At the same time, the working databases and code in area 420 are not affected. After loading the databases, utility 410 reports that the updates have been downloaded and are ready for further use. The next step is to verify the databases inside the hardware antivirus system itself, which may include in a particular version methods for comparing electronic digital signatures, checksums, signatures, etc. The system does this internally, so no malware components can interfere with the verification process, as well as understand the verification algorithm. In case of successful verification, updates are downloaded from area 430 to the area of working databases and code 420. This two-stage method protects the hardware antivirus system from downloading malicious code or outdated databases. Even if malware tries to download malicious code instead of databases, then verification within the hardware antivirus system will not accept them as working. Thus, the system will not be damaged in any way. Old databases will also not be loaded, because the verification also checks the relevance of the databases.

Figure 5 shows a block diagram of the update algorithm for a hardware antivirus system in accordance with an example implementation from a utility installed on a personal computer. Utility 410 starts downloading updates at a certain frequency in step 510. After downloading the updates, in step 520 the utility creates a secret code (key) that identifies it as a trusted application and sends it to the hardware antivirus system. At step 525, the utility receives a response about the authentication result. In case of successful authentication, the utility starts transmitting the downloaded updates to the hardware antivirus system in step 535. After completing the data transfer, in step 540 the utility transmits a message about the successful data transfer to the hardware antivirus system. Next, the second part of the processing and loading of anti-virus databases begins, which is described in Fig.6.

6 also shows a block diagram of an update algorithm for a hardware antivirus system in accordance with an example implementation. The hardware antivirus system receives the secret code (key) from the personal computer application in step 610. After receiving the code and identifying the application as a trusted utility, the hardware antivirus system sends a response to it about successful authentication in step 620. Then, the utility transfers the new anti-virus databases to the hardware system updates area antivirus 430. At the end of the database transfer, the utility informs the system about the readiness of the databases for further download at step 625. After that, the system verifies the received anti-virus databases at step 630. If the verification was successful at step 635, that is, the transmitted data is anti-virus databases and they are current, then they are overwritten from the update area 430 to the area of working databases 420 at step 640. If the verification of the databases failed, then they they are removed from the update area 430 in step 650. On this, the download of anti-virus databases is considered complete.

Having the preferred embodiments described herein, it will be apparent to those skilled in the art that certain advantages of the described systems are achieved. It will also be understood that various modifications, adaptations, and alternative implementations of these systems can be made in the scope and essence of a true utility model. A utility model is defined by the following formula.

Claims (9)

1. A hardware antivirus that prevents the spread of malware components (software) located between a personal computer and an information storage device, containing at least two interfaces, one of which is connected to the computer’s system bus, and the other is connected to the storage medium, which is a transparent filter, providing data transfer between interfaces, the filtering of the data is carried out by the central processor of the antivirus, which uses random access memory stroystvo, the antivirus main job is to filter incoming data, and if they are not detected malicious software component, the data is recorded on the recording medium, if the data is found in malicious software component, the data is not recorded. 2. The hardware antivirus according to claim 1, built into the hard disk controller. 3. The hardware antivirus according to claim 1, which, if a malware component is detected, simulates writing to a data disk without writing data to a storage medium. 4. The hardware antivirus according to claim 1, which, in the event of detection of a component of malicious software to the computer system, a write error message is transmitted. 5. The hardware antivirus according to claim 1, having a set of encrypted commands by which the computer software antivirus is able to manage the hardware antivirus, bypassing the hierarchy of user rights, directly accessing the storage medium. 6. Hardware antivirus according to claims 1 and 5, which additionally performs the removal of rootkits from the storage medium under the control of software antivirus, while the software antivirus is guided by updated antivirus databases. 7. The hardware antivirus according to claim 1, in which the anti-virus database is updated by using the anti-virus database update utility of the hardware anti-virus, by which a connection is established with the hardware anti-virus, sending him a secret code or an encrypted key that identifies the utility in response to such a hardware code the antivirus sends a response about successful authentication, after which the utility sends updates to the antivirus databases that are stored in the memory of the hardware antivirus. 8. The hardware antivirus according to claim 7, in which the anti-virus databases inside the hardware anti-virus are additionally verified, and if the verification is successful, then the anti-virus databases are added to the working database and code area. 9. The hardware antivirus according to claim 7, in which the relevance of the antivirus databases is additionally checked.