TW497029B - Method and system for protecting data in a rewritable storage medium - Google Patents

Abstract

A method and system for protecting data on a rewritable storage medium, such as a hard disk. A predefined table identifies protected storage sectors in the hard disk. A software driver receives a write command for a specific storage sector of the hard disk and checks whether the specific storage sector corresponds to the protected storage sector defined by the table. If there is a correspondence, this write command is processed by a monitor program module. The monitor program module checks whether the write command is legal according to the status of the coupled operational system. When the monitor program module verifies the legality of the write command, the software driver performs the normal write operation, and writes data to the specific storage sector.

Description

Description of the invention (1) ----

(¾ Read the notes before you write the TJC book. This month has a system and method for protecting data in rewritable storage media such as ble g dia such as hard disks. Or other destructive programs. ^ Big. A trowel personal computer uses a hard disk as a mass storage medium. For example, the hard drive A can be used to store the source code of the operating system project and user data slot project. Article No. (Known Technology) 示意图 indicates a block diagram of the operation of accessing data in the hard disk of a computer system. As shown in Fig. 1, the user i executes the application private 2 or the operation system command interpreter (QS shell) to complete the required work. For example, in Disk Operating System (DQS), the command interpreter is

, 1T ⑺ MMAND.CqM; while in Microsoft's view f 3 ι, the command interpreter is 轾 式 理 理 〇 PRGRAMEXE. When the user tries to perform a task that requires access to the hard disk, the application program 2 will call the application program interface (Αρι) 3 to send the access command for accessing the hard disk 7 to the operating system core, 4. The application program interface 3 uses a single program platform to provide various applications, so as to execute predetermined routines in the operating system. After analyzing the received access command, the operating system core 4 will send a write or read command to the driver 5 of a specific device to control the hardware controller 6 to actually execute the write of the hard disk drive 7. Read and read actions. Obviously the operating system can identify the source of any hard disk access request under normal circumstances. As mentioned above, hard disks usually hold a lot of important data, such as the operating system slot file and the file descriptor block (FDB). When most computers are turned on, the operating system files that have hard disks will be loaded into the computer first ......... One ...—— '3 people Shuangxuan Chuanxi Valve Home 桴 （((\ NS) AAim (210X297 / ^ #) ~ ---- 497029 A7 s. ____ B7 V. Description of the invention (2) The main memory of the brain is used to establish the operating platform. If the files related to the operating system cannot be found or read out completely, the computer system It will not be able to start and work. In addition, each file on the hard disk also has a file description block to store the slot related > said. The right broadcast case description block is damaged or changed, the corresponding slot case may also be lost Or it cannot be read normally. Therefore, protecting the data in the hard disk becomes a very critical issue in system operation. The present invention relates to a system and method for protecting data in a rewritable storage medium (such as a hard disk) to avoid computer viruses Illegal modification of programs or other destructive programs to strengthen the stability of the computer system. Data stored on rewritable storage media is physically controlled by hardware control. Pre-defined lookup tables are in One or more write-protected storage areas are defined in the rewritable storage medium, which are also preferably stored in the rewritable storage medium. This means that any access to the write-protected storage area will be detected and Control. The software driver is linked to the operating system to receive a write command from a specific storage area in the rewritable medium and check whether the specific storage area of the write command is located in a write-protected storage area. When the write command When there is a corresponding relationship between the table and the lookup table, the write command is first processed by the monitoring program module of the linking human body driver. The combination of the monitoring program module checks the legality of the write command according to the status of the operating system. The program module confirms the legitimacy of the write command, so that the software driver can perform normal write operations and fill the data into a specific storage area in the write-protected storage area. In order for the above and other purposes of the present invention, Features, advantages and advantages can be more obvious and easy to understand. The following is a detailed description of a preferred embodiment, and in accordance with the accompanying drawings, make one by one ......... ____i m- ^ A Jk JU .'l · 1¾ 1¾% ·. ^ Ιή. (CNS) Λ (210x297 ^^ 邡 (Please read the precautions on the back before writing this page) 、 1Τ A7 A7

Fifth, the description of the hairpin (3 The description is as follows: Figure 1 (known technology) is in the conventional + processing schematic shoulder; _ the younger who accesses data in the hard disk 2 Figure is the system of the embodiment of the present invention The hard disk data is protected from illegal modification. The block diagram is used to protect the computer. The third diagram is the relationship diagram in the embodiment of the present invention; In the embodiment of the invention, the detailed action flow of the software driver program is 5th. This chart shows that the m group is a detailed% chart; and FIG. 6 is the writing of data to a rewritable storage medium in the embodiment of the invention The flow chart of the steps to enter the protected storage area. This embodiment is to disclose a method and system for protecting data, especially important data (such as broadcast description block) in the record (such as hard disk), so as to avoid illegal Modification. Under normal conditions, the operating system will issue-access commands (read or write) to the device driver that stores data according to the requirements of the main application. Therefore, the operating system can recognize the normality related to the hard disk The source of the access command. The command is not issued by an application program of the operating system, so this access command does not belong to a legitimate application program of the operating system. The present invention utilizes this feature to distinguish the access command received by any device driver. (Especially the write command) is legal. ^ ΚJin η) ^ 1¾ (

I Refill% This page is ordered (210X 297 mm) 497029 Intermediate Guideline II 卬 A7 B7 V. Invention Description (4) In addition, the lookup table is used to define a write-protected storage area (or storage) in the hard disk Magnetic field). The look-up table (access table) defines the location of the storage area to be protected, such as file description block information. Before changing or modifying the location of the hard disk belonging to the access list, the device driver sends this write command to the monitor module to check its legitimacy. After the validity of the write command is confirmed, the device driver will write the data to the protected area. Fig. 2 is a system block diagram of an embodiment of the present invention, which is used to protect hard disk data of a computer system from illegal modification. In Fig. 2, the structure of the computer system is different from that shown in Fig. 1. Among them, the file-controlled device driver 20 is used instead of the specific device driver 5 shown in FIG. The device driver 20 for controlling file access adds a function to the conventional driver, that is, it will check the access area designated by all write commands, which will be explained in detail later. The file control access transmitter 61 in the controller 6 will only respond to a valid access request issued by the device driver 20. According to this embodiment, the access table 40 is set in the hard disk drive 7 and is used to identify or place a storage magnetic area to be protected. The monitoring program module 30 is keyed to the device driver 20 and the operating system 10 for file control, and is used to check the legitimacy of any write command that wants to change the content of the protected sector. The device driver 20 (similar in function to the conventional device driver) receives a read or write command on a specific storage area in the hard disk 7 and drives the controller 6 and the file control access transmitter 61 therein. To perform the corresponding access action. The file control access transmitter 61 can ensure that only the access command issued by the broadcast control device driver 20 can be executed. Generally, the received read or write command is executed by the operating system 10 based on 6 paper sizes on it, said W ten KK! Jiabei ((, NS) Λ4 specification (210X297 mm) -------- ------- IT -------* (¾Read the notes on the back before copying this page) ^ / 029 '...------- 一 ·-. _______ V. Invention Explanation (5) " '— ~ ^ application request is sent. However, when the computer is poisoned, the read or write command received may also be sent by an unknown program (such as a computer virus). File control device driver 20 Another function is to check the storage of write commands. Read the notes on the back first, and then write the MJ IJ [) whether the magnetic area is defined in the access table 40, which defines important information (such as operating system files and file description blocks). ) Storage magnetic area. If the storage magnetic field to be written belongs to the protected storage magnetic field defined by the access table 40, the writing command must be processed by the monitoring program module 30. The monitoring program module 30 is coupled to the operating system 10 and is used to monitor the status of the operating system. That is, the monitoring program module 30 checks whether the writing command of the operating system 10 is sent by the file control device driver 20. Because any normal writing of legitimate applications can be confirmed in this way, the writing command of the computer virus can be caught. The file control access transmitter 61 corresponds to the file control device driving device 20 one-to-one, so as to prevent the access list 40 from being legally retrieved. Therefore, the file control device driver 20 can accept or reject the write command according to the inspection result of the monitoring program module 30. Therefore, the computer system described above can prevent important data on the hard disk from being changed or modified by computer viruses. Next, the three components such as the access table 40, the file control device driver 20, and the definition and monitoring program module 30 will be described in detail. f As mentioned above, the access table 4 () is used to define the storage area of important information, such as the I-system case and file description block. In this example, we only take the protection of the case mentioned above as an example. However, for those who are familiar with this technology, any storage area related to the file can be protected by the method defined in access table 40 ^.卬 7 _ — —--— — *. — 丨 One X li ii 'ir W W t {CNS) (210X 297 mm) _ ~~~' · — ---- 497029 Λ7 B7

屮 屮 ι \ η

V. Description of the invention (FIG. 3 is a map of the magnetic disk in the access table 40 and the hard disk 7 in the embodiment of the present invention. The access table 40 can be stored on the hard disk 7, which helps = Take the access processing of table 40. Generally, the hard disk is stored in a byte riding position, which has eight bits. According to this embodiment, each byte of the access table 40 is a hard disk with a fixed label. Drive 7 has four storage sectors. Therefore, two bits can be used to indicate the status of a storage sector. The following table shows an example of the status arrangement. V 'Status Bit Meaning 00 Open 01 Locked 10 Write-once 11 Table 1 of the file description area is shown in Table 1. If the two bits corresponding to the storage area are 0, the storage area corresponding to the table is not affected (open). The unit is 11th Temple, which means that the corresponding storage magnetic area is protected and should be confirmed before access (slot case description block). The "locked" status indicates that the corresponding storage magnetic area is forbidden to access, and ", Write once" status means that the corresponding storage magnetic area can only be entered once. Horse in Figure 3 The four byte length access table 40 exemplified in the example is the storage magnetic area 7a part of the hard disk 7. The four bytes of the access table 40 are sequentially expressed as Bn Bn + 1, Bn + 2, Bn + 3 is used to store the use state of the sixteen storage magnetic areas Sm ~ s. For example, the byte Bn means storage magnetic m 15 m ° m + i Λ ---------- ...------------ One foot and this; 11 屮 ⑸ 阄 家 打 Φ (CNS) AAim (210X 297 ^ 8 497029 A7--------- ----- --- B 7 V. Description of the invention (7)

Usage status of Sm + 2, Sm + 3. In this example, these magnetic fields are normal data. Bit group Bn + 1 indicates the use status of storage magnetic areas Sm ", \ +5, Sm + 6, where the first two magnetic areas Sm + 1, Sm + s contain normal data, and the last two magnetic areas Sm +6, Sm + 7 have the slot description block to be protected. The byte bw indicates the use status of the storage magnetic areas sm + 8, sm + 9, Sm + 10, Sm + ". The first three magnetic fields Areas Sm + 8, Sm + 9, and sm + 1G have file description blocks to be protected, and magnetic areas sm + 11 and Sm + 7 are normal data. Bytes Bn + 3 indicate storage magnetics ^ ^ m + 12 The usage status of Sm + 13, Sm + M, Sm + 15. These magnetic areas also contain normal data. When the file control device driver 20 receives the write command, it is ready to change the magnetic area with protected data (for example, the content of magnetic area U) At this time, the write command is first sent to the monitoring program module 30 to check its legality. If the write command is legal, the file control device driver 20 will drive the controller 6 to perform the necessary write action. In addition, When the write command received by the file control device driver 20 is to change the content of the magnetic zone (such as the magnetic zone Sm + n) that stores normal data, the write command can be directly The file control device driver program 20 processes, thereby activating the controller 6 to perform necessary writing actions. Any illegal access request will be blocked by the file control access transmitter 61. Figure 4 is an embodiment of the present invention. The detailed operation flowchart of the file control device driver 20. Note that the audit control device driver 2G in this embodiment can also perform various functions of the known device driver. As shown in FIG. 4, The control device driver 2 () first money collection operating system (S1) or an unknown program command. Basically, the financial control device driver 20 cannot distinguish the program that sends the current command at this time. Then, the slot case control (read first Read the notes on the back and continue to write the essence of the order. 1 Shooting remuneration $ 彳 # ((, NS) ---------- 497029 A7 V. Description of the invention (8) Device driver 20 recognizes the action of the command It is a read command or a write command (S2). When this command is a read command (not related to the present invention), the file control device driver 20 can directly drive the controller 6 to perform a normal read operation (S3). When this command When writing a command, the file control device driver 20 performs the following two steps, that is, checking whether the storage magnetic zone to be accessed is protected, and checking the legality of the write command. As shown in FIG. The file control device driver 20 first reads the access table 40 of the hard disk 7 through the file control access transmitter 61 to check whether it is an authorized access request (S4). According to the access table 40, the file control device driver 20 then check whether the magnetic area to be accessed by the write request is defined as the subject of access protection in the access table 40 (S5). If this relationship does not hold, this write command does not require further inspection, and the file The control device driver 20 can directly drive the controller 6 to perform a normal write operation (S6). If this relationship holds, the legitimacy of the write order must be confirmed. The validity of the write command is confirmed by the monitor program module 30. Therefore, the file control device driver program 20 can write a command to the monitoring program module 30 and wait for a response (S7). After confirming the validity of the write command, the monitoring program module 30 sends the result back to the file control device driver 20. If the write command is legal (S8), the file control device driver 20 drives the controller 6 to perform a normal write operation (S6). If the write command is illegal (S8), the file control device control program 20 sends an error message to the job system and refuses to execute the write operation (S9). FIG. 5 is a detailed operation of the monitoring program module 30 in the embodiment of the present invention. Winter paper ί. Standard iC state ten R valve home 4 BC ((, NS) / \ 4 specifications (210X297 mm) (read first Note on the back, please fill in this page again) Φ Order-6 ·. 497029 A7 V. Description of Invention (9) " Work flow chart. As mentioned above, the monitoring program module 30 is sent to the eaves control device driver The legitimacy of the write command of 20, and the inspection result is returned to the slot. The case control hard drive H 2 0. In Figure 5, the monitoring program module 3 0 first receives the information sent to the file control device driver 2 (). Afl (Sll) of the write command In this example, the monitoring program module is connected to the operating system with the "fishing" device to obtain the status of the operating system. For example, operating in Microsoft Windows In the system, the monitoring program module 3G can be implemented by a virtual device driver (VxD). Therefore, the monitoring process group π can check the operating system to know whether the writer's command is sent by a legitimate application or routine (si2). Generally, any All hard disk access requests for running applications can be made by the operating system That is, by hooking the operating system, the monitoring program module 30 can determine the legitimacy or correctness of the write command. Finally, the monitoring program module 30 will send the correctness of the write command back to the file. The control device driver 20 (si3). Therefore, the file control device driver 20 can judge whether the write command is legal (S8 in FIG. 4) and execute this command appropriately (% or s9 in FIG. 4). The functions of the file control device driver 20 and the monitoring program module 30 will be described later. Fig. 6 is a protected storage area defined by a write access table 40 for writing data to a rewritable storage medium in the embodiment of the present invention. The flow chart of the steps: First, the computer system (or storage system) will create and define an access table 40 in the hard disk drive 7 to indicate the storage area of important files or data (such as file description blocks) (S21) The access table 40 can be changed dynamically with the hard disk drive 7. Then, the writing command of the operating system or virus program can be sent to the file control device driver 20 (S22). At this time, the file control device driver 2 Does not identify write Source commands, _________ ____ scale of this paper Chek Long Chuan Shu Che change the sentence at home ϋ - (-

i—I-iil · · ------, τ ------ φ (ii first read the notes on the back and then write the copybook 1JC 11 497029 A7 B7 V. Description of the invention (10) Then, the file control device The driver 20 can use the file control access transmitter 61 to check the relationship between the magnetic access zone and the protected storage interval defined in the access table 40 (S23). Note that only the file control access transmitter 61 can be adjusted. Access table 40. If the write command wants to access the protected storage area defined by the access table 40, the driver program 20 will send the write command to the monitor program module 30 (S24). The monitor program module 30 will State, check whether the write command is sent by a legitimate application (S25). Finally, if the write command is valid, the file control device driver 20 can drive the controller 6 to perform a normal write operation on the protected storage area (S26). However, if the write command is illegal, the file control device driver 20 will not perform any write action and send an error message to the operating system. According to the above description, the protection device and method of the present invention Can successfully filter out unknown processes (Such as a computer virus) for illegal writing and avoid changing important information in the carbon disk. In addition, the file control device driver 20 and file control access transmitter 61 can perform access to the access table 40. This The characteristics can ensure the integrity of the access table. The support section of the guideline He: r-, eliminates the combination of f (read the precautions on the back before writing this page) Although the present invention has been better implemented The example is disclosed as above, but it is not intended to limit the present invention. Any person skilled in the art can make changes and retouches without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be regarded as the attached patent. The definition in the scope shall prevail. 12 The scale of this paper is described in "The Ten Nets Chuang NS (C, NS) Λ4 Specification (210X 297 mm)

Claims (1)

6. Scope of Patent Application 1. A computer used to protect a rewriteable storage medium using a unified computer, the system includes a system controller controlled by the rewriteable storage medium and is arranged to execute It is an access list, which is used to define writer-protected storage software-driven fishing in the rewritable storage medium, and is linked to the work to receive writer commands corresponding to specific storage areas in the rewritable media, And check whether the $ specific storage area related to the write command 7 corresponds to the writer-protected storage area; and a monitoring device, coupled to the software driver module and the operating system, confirming the special The storage area corresponds to the writer's protected storage area. The bismuth checks whether the write command is legal. When the monitoring device confirms the legitimacy of the write command, the controller is driven by the software driver module to write data. The specific storage area. 2. The system according to item 1 of the scope of patent application, wherein the access list is stored in the rewritable storage medium. 3. The system according to item 丨 scope of patent application Wherein, the rewritable storage medium is a hard disk. 4. The system as described in item 3 of the patent scope of Shenyan, wherein the write-protected storage area includes one or more magnetic areas of the hard disk. 5 The system according to item 3 of the scope of patent application, wherein the writable protection storage area is a file description block of the hard disk. 6 · A method of writing data to a rewritable storage medium, The rewritable storage medium is controlled by a controller and is set to perform an operation system ^ / 029 ^ / 029 Printed by the Central Consumers ’Cooperative of the Ministry of Economic Affairs. Among them, the computer that can be written into one of the scope of patent application 6. The steps of the method include: defining an access table to define a write-protected storage area in the rewritable storage medium; using software. The drive module receives a write command corresponding to a specific storage area in the rewritable medium, wherein the software drive module can be used to drive the control action to perform a write operation in the rewritable storage medium; check The specific storage area Whether at least a portion corresponds to the write-protected storage area defined by the access table; and when the software drive module confirms that at least a portion of the specific storage area corresponds to the j write-protected storage area, the software drive module The received write command is sent to a monitoring module coupled to the operating system; according to the status of the operating system, the monitoring module is used to check whether it is legal; '' The software drives the controller to drive the controller , So that when the monitoring module does meet the legality of the write command, it will write to the specific storage area. 7. The method according to item 6 of the scope of patent application, wherein the access list is stored on the rewritable storage medium. ^ 8. The method described in item 6 of the scope of patent application. The storage medium is a hard disk. 9. The method described in item 8 of the scope of the patent application. The protected storage area includes one or more magnetic areas of the hard disk. 10. The method described in item 8 of the scope of patent application. The protected storage area is a file description block of the hard disk. 14 paper rulers (CNS) ϋ_ (210 > < 297 public director (please read _ read the precautions on the back before filling in this page)