Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/14—Error detection or correction of the data by redundancy in operation
  • G06F11/1402—Saving, restoring, recovering or retrying
  • G06F11/1415—Saving, restoring, recovering or retrying at system level
  • G06F11/1441—Resetting or repowering
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/14—Error detection or correction of the data by redundancy in operation
  • G06F11/1402—Saving, restoring, recovering or retrying
  • G06F11/1415—Saving, restoring, recovering or retrying at system level
  • G06F11/1435—Saving, restoring, recovering or retrying at system level using file system or storage system metadata
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
  • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
  • G06F21/80—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in storage media based on magnetic or optical technology, e.g. disks with sectors
  • G06F21/805—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in storage media based on magnetic or optical technology, e.g. disks with sectors using a security table for the storage sub-system

Definitions

• the present invention relates to an apparatus and method for protecting system data stored in a computer hard disk, and more particularly, to a system data protection apparatus and method for protecting and recovering system data stored in a computer hard disk from corruption that may occur due to malicious or accidental operation during use of a computer.
• a job of backing up the images in the hard disk to another recording medium and recovering the computer system using the backed-up hard disk images requires an extra recording medium and a lot of working time, and it is also very complex.
• a large buffer area i.e., the system change area
• the size of the buffer area must be the same as that of the system protection area to protect the system data stored in the system protection area without recovery operation. For example, to protect a 120-gigabyte system protection area, a capacity of 120 gigabytes for all system data reflected to the system protection area and additional memory space for other data are required.
• the empty area included in the system protection area is also protected, a load is given to an access to the system data after a hard disk protection program is installed.
• the present invention provides an apparatus and method for protecting system data on a computer hard disk, by which a system area information table is provided to set a protection target among data in a system area in units of clusters, a mapping table is provided to construct a correspondence relation between original system data stored in the system area and changed system data, the changed system data is managed preemptively in the system area to allow an entire disk area to be efficiently used, thereby quickly recovering system data needing protection when the system data is corrupted while a computer system is being used.
• the present invention also provides a computer readable recording medium for recording a program for executing the method on a computer. According to an aspect of the present invention, there is provided an apparatus for protecting system data on a computer hard disk, in which changed system data is managed preemptively in a system area.
• the apparatus includes an installation unit separately setting a system area and a meta buffer area on the computer hard disk and reserving areas for a meta information table, a system area information table, and a mapping table in the meta buffer area; an initialization/recovery unit initializing the system area information table, in which each of clusters in the system area is marked as one among "original”, “protected”, and “non-protected” based on one of a volume bitmap and a file allocation table (FAT), and initializing the mapping table storing mapping relation between a cluster position recognized by a file system and a cluster position where data is actually stored in the system area; a write operation processing unit, with respect to a write operation on a cluster of the system area designated by the file system, performing the write operation on another corresponding cluster designated by the mapping table when the cluster designated by the file system is marked as one of "original” and "protected” in the system area information table and is different from the corresponding cluster designated by the mapping table, performing the write operation on a cluster corresponding to an
• a method of protecting system data on a computer hard disk in which changed system data is managed preemptively in a system area.
• the method includes the operations of (a) separately setting a system area and a meta buffer area on the computer hard disk and reserving areas for a meta information table, a system area information table, and a mapping table in the meta buffer area; (b) initializing the system area information table, in which each of clusters in the system area is marked as one among "original”, “protected”, and “non-protected” based on one of a volume bitmap and a FAT, and initializing the mapping table storing mapping relation between a cluster position recognized by a file system and a cluster position where data is actually stored in the system area; (c) with respect to a write operation on a cluster of the system area designated by the file system, performing the write operation on another corresponding cluster designated by the mapping table when the cluster designated by the file system is marked as one of "original” and "protected” in
• FIG. 1 is a block diagram of an apparatus for protecting system data on a computer hard disk, in which changed system data is managed preemptively in a system area, according to an embodiment of the present invention.
• FIG. 2 is a conceptual diagram of a system area according to an embodiment of the present invention.
• FIG. 3 illustrates the structure of a system area information table and the structure of a mapping table used in the present invention.
• FIG. 4 illustrates initialized content of a system area information table and a mapping table used in the present invention.
• FIG. 5 is a flowchart of a method of protecting system data on a computer hard disk, by which changed system data is managed preemptively in a system area, according to an embodiment of the present invention.
• FIG. 1 is a block diagram of an apparatus for protecting system data on a computer hard disk, in which changed system data is managed preemptively in a system area, according to an embodiment of the present invention.
• FIG. 3 illustrates the structure of a system area information table and the structure of a mapping table used
• FIG. 6 is a detailed flowchart of the installing operation shown in FIG. 5.
• FIG. 7 is a detailed flowchart of the initializing and recovering operation shown in FIG. 5.
• FIG. 8 is a detailed flowchart of write operation processing shown in FIG. 5.
• FIG. 9 is a detailed flowchart of read operation processing shown in FIG. 5.
• FIG. 10 is a detailed flowchart of the current state backup operation shown in FIG. 5.
• FIG. 11 is a detailed flowchart of the removing operation shown in FIG. 5.
• an apparatus for protecting system data on a hard disk 5 includes an initialization/recovery unit 10, a write operation processing unit 20, a read operation processing unit 30, a current state backup unit 40, an installation unit 50, and a removing unit 60.
• Each element of the hard disk protection apparatus 1 is implemented as a combination of hardware and software of a computer system (not shown) including the hard disk 5.
• the computer system using the present invention is a typical computer system, and therefore, the configuration of the hardware is obvious to those skilled in the art. Thus, a detailed description thereof will be omitted.
• the installation unit 50 receives meta information (which will be described later) including a size of a meta buffer area 7 (wherein the size of the meta buffer area 7 can be determined according to a systematically predetermined scheme) from a user and installs in the hard disk 5 software and device drivers that constitute the write operation processing unit 20, the read operation processing unit 30, and the current state backup unit 40. Thereafter, the installation unit 50 separately reserves the meta buffer area 7 within the system area 6 and moves clusters that are in use in the reserved meta buffer area 7 to the system area 6 outside the meta buffer area 7. Next, as shown in FIG.
• the installation unit 50 reserves areas respectively for a meta information table 71 , a system area information table 72, and a mapping table 73 in the meta buffer area 7.
• the installation unit 50 calls the initialization/recovery unit 10 to perform initialization.
• the system area information table 72 shows a protection state
• Clusters marked as “original” are the clusters that have already been used in the system area 6 in an initializing operation. After the initializing operation, changed data for these clusters are not directly reflected to the corresponding clusters but is separately stored in an empty space (i.e., a cluster marked as "non-protected" in the system area information table 72) within the system area 6.
• the mapping table 73 stores mapping information (or a mapping index) indicating a position in the system area 6, in which changed data with respect to a system area index for the system area 6 is stored, as show in FIG. 3. Referring to FIG. 3, clusters respectively having system area indexes 1 and 2 are respectively mapped to clusters having system area indexes 3 and 5.
• mapping chains like 1-3 and 2-5-7 are formed among clusters.
• FIG. 4 illustrates the initialized state of the system area information table 72 and the mapping table 73.
• the meta information table 71 stores various types of information, i.e., meta information used by software implementing the hard disk protection apparatus 1 (hereinafter, referred to as a "hard disk protection program") in a table format.
• the meta information includes a File Allocation Table (FAT) (in case of a FAT32 file system) showing a storage position of each of clusters in the system area 6, which are used by a file system for an operating system to organize files, or a volume bitmap (in case of a New Technology File System (NTFS)).
• FAT File Allocation Table
• NTFS New Technology File System
• the meta information may include various environment variables needed to operate the hard disk protection program, for example, used capacity of the buffer area 7, a start point of the data buffer area 74, a cluster size, an automatic recovery period, and a password.
• the initialization/recovery unit 10 is operated to produce an environment for protecting system data after the hard disk protection apparatus 1 stores the system data in the system area 6 or to recover the original state of the system data when the system data stored in the hard disk 5 is corrupted.
• the initialization/recovery unit 10 sets the meta buffer area 7 in a partial area of the system area 6 and stores and manages the meta information table 71 , the system area information table 72, and the mapping table 73 in the meta buffer area 7.
• the initialization/recovery unit 10 detects space used in the system area 6 based on a volume bitmap or a FAT and marks a currently used space as "original” and an empty space as "non-protected” with respect to individual system area indexes in the system area information table 72.
• the initialization/recovery unit 10 initializes the mapping table 73 in the meta buffer area 7 and generates the meta information table 71 based on the meta information.
• the write operation processing unit 20 and the read operation processing unit 30 intercept and process the respective write and read operations of the operating system writing and reading data into and from files during operation of the computer system.
• the hard disk protection apparatus 1 manages an original change mode as meta information.
• the hard disk protection apparatus 1 when the hard disk protection apparatus 1 receives a request to change into the original change mode from a user after the initialization/recovery unit 10 performs an operation, the hard disk protection apparatus 1 changes into the original change mode so that the user can directly change data in the system area 6. Thereafter, upon receiving a request to cancel the original change mode from the user, the hard disk protection apparatus 1 returns to an original protection mode and the initialization/recovery unit 10 performs initialization.
• the write operation processing unit 20 receives from the file system a system area index corresponding to a cluster on which a write operation is to be performed in the system area 6 and operates differently according to a mode.
• the write operation processing unit 20 performs the write operation on a position, i.e., the cluster designated by the file system in the system area 6.
• the write operation processing unit 20 performs the write operation on a cluster of the system area 6 that is designated by the mapping table 73 if the protection state corresponding to the received system area index is marked as "original” or "protected” in the system area information table 72 and performs the write operation on the cluster designated by the file system in the system area 6 (i.e., the cluster corresponding to the received system area index) if the protection state corresponding to the received system area index is marked as "non-protected".
• the write operation processing unit 20 secures an empty space in the system area 6, performs the write operation on a cluster allocated to the secured empty space, marks the protection state of the cluster where new data is written as "protected” in the system area information table 72, and records a position of the cluster where the new data is written in a corresponding item block of the mapping table 73.
• the read operation processing unit 30 receives from the file system a system area index corresponding to a cluster on which a read operation is to be performed in the system area 6 and operates differently according to a mode. In other words, when the original change mode has been set, the read operation processing unit 30 performs the read operation on a position, i.e., the cluster designated by the file system in the system area 6.
• the read operation processing unit 30 performs the read operation on a cluster corresponding to mapping information mapped to the system area index in the mapping table 73.
• the mapping information is set to the initial state in the mapping table 73
• the read operation processing unit 30 performs the read operation on the position, i.e., the cluster corresponding to system area index in the system area 6.
• the current state backup unit 40 constructs new original system data by reflecting all content changed in the system data since the initialization. For this constructing operation, the current state backup unit 40 sequentially reads all items of the mapping table 73.
• the current state backup unit 40 When a position designated by the mapping table 73 is different from a position designated by the file system (i.e., when a mapping index is different from a corresponding system area index) in an item of the mapping table 73, the current state backup unit 40 forms a mapping chain. Then, the current state backup unit 40 stores data stored in a cluster designated by an end pointer (i.e., a mapping index at an end) of the mapping chain in an original cluster (designated by a system area index at the other end of the mapping chain). Thereafter, the initialization/recovery unit 10 performs initialization.
• an end pointer i.e., a mapping index at an end
• the current state backup unit 40 may also reflect the volume bitmap or the FAT stored in the meta information table 71 to the system area 6 before the initialization so that new original system data can include data newly added to the system area 6 as well as changed data.
• the removing unit 60 removes the meta buffer area 7 set by the installation unit 50 to integrate the meta buffer area 7 into the system area 6.
• the removing unit 60 may receive confirmation on current state backup from a user so that the user can perform the backup of a current state and remove the meta buffer area 7 at a desired moment.
• the removing unit 60 may be designed to automatically remove the software and device drivers that have been installed by the installation unit 50 in the hard disk 5.
• an installation module of a hard disk protection program separately sets the system area 6 and the meta buffer area 7 in a hard disk area of a computer system. Operation S50 will be described in detail with reference to FIG. 6. Referring to FIG. 6, the installation module receives a size of the meta buffer area 7 in operation S10 and installs in the hard disk 5 software and device drivers that constitute a write operation processing module, a read operation processing module, and a current state backup module in operation S20.
• the installation module separately reserves the meta buffer area 7 in the system area 6 and moves clusters that are in use in the reserved meta buffer area 7 to a portion of the system area 6 outside the meta buffer area 7 in operation S30.
• the installation module separately sets the meta buffer area 7 within the system area 6 in the hard disk 5 in operation S40 and reserves areas respectively for the meta information table 71 , the system area information table 72, and the mapping table 73 in the meta buffer area 7 in operation S45.
• the meta buffer area 7 set through the above operations is a hidden area from the user so that the user cannot use the meta buffer area 7 to store a file.
• the installation module calls an initialization module to perform initialization in operation S100.
• the initialization module of the hard disk protection program marks each cluster of the system area 6 with protection information in the system area information table 72 and initializes the mapping table 73 in the meta buffer area 7. Operation 100 will be described in detail with reference to FIG. 7. Referring to FIG. 7, the initialization module collects use information of the system area 6 from a volume bitmap or a FAT in operation S110. Next, in operation S120, the initialization module generates the system area information table 72 and marks a currently used space as "original" and an empty space as "non-protected" with respect to individual system area indexes in the system area information table 72.
• the initialization module initializes the mapping table 73 by allocating the same value as a system area index having the "original" as the protection state in the system area information table 72 to a corresponding mapping index in the mapping table 73 and allocating NULL to a mapping index in the mapping table 73 when a corresponding system area index does not have the protection state of "original".
• the initialization module collects meta information and generates the meta information table 71. Thereafter, a write operation processing module and a read operation processing module of the hard disk protection program intercept and process the respective write and read operations of an operating system writing and reading data into and from the hard disk 5 during operation of the computer system in operation S200 and S300, respectively.
• the write operation processing module receives from a file system a system area index corresponding to a cluster on which a write operation is to be performed in the system area 6 in operation S210 and determines whether an original change mode has been set in operation S215. If it is determined that the original change mode has been set, the write operation processing module performs the write operation on a position, i.e., the cluster designated by the file system in the system area 6 in operation S295.
• the write operation processing module reads protection information (i.e., a protection state) corresponding to the system area index from the system area information table 72 in operation S220.
• protection information i.e., a protection state
• the write operation processing module reads mapping information corresponding to the system area index from the mapping table 73 in operation S240.
• mapping information does not have a value of an initial state (i.e., the same value as the system area index or NULL) in operation S250, the write operation processing module performs the write operation on a cluster corresponding to the value of the mapping information in the system area 6 in operation S260.
• the write operation processing module secures an empty space in the system area 6 based on the system area information table 72 in operation S270 and performs the write operation on a cluster allocated to the empty space in operation S280. Thereafter, the write operation processing module changes the protection state of the cluster where new data has been written into "protected" in the system area information table 72 in operation S290 and records a position of the cluster, where the new data has been written, in a corresponding item block of the mapping table 73 in operation S292. Meanwhile, when the protection information read in operation
• the write operation processing module performs the write operation on the position, i.e., the cluster designated by the file system in the system area 6 in operation S295.
• the write operation processing module reflects changed content corresponding to a FAT or a volume bitmap to a FAT or a volume bitmap included in the meta information table 71 not to an original FAT or volume bitmap.
• the read operation processing module receives from the file system a system area index corresponding to a cluster on which a read operation is to be performed in the system area 6 in operation S310 and determines whether the original change mode has been set in operation S315.
• the read operation processing module performs the read operation on a position, i.e., the cluster designated by the file system in the system area 6 in operation S340. However, if it is determined that the original change mode has not been set, the read operation processing module reads mapping information corresponding to the system area index from the mapping table 73 in operation S320. When it is determined that the mapping information is set to NULL in operation S330, the read operation processing module performs the read operation on the position, i.e., the cluster designated by the file system (i.e., the cluster corresponding to the system area index) in the system area 6 in operation S340.
• the read operation processing module performs the read operation on a cluster in the system area 6 that corresponds to a mapping index designated by the mapping table 73 in operation S350.
• the hard disk protection program performs current state backup to maintain the current state of the system data as new original system data using a current state backup module in operation S400, which will be described in detail with reference to FIG. 10.
• the current state backup module sequentially reads all items of the mapping table 73 in operation S410.
• the current state backup module forms a mapping chain in operation S420.
• the current state backup module stores data stored in a cluster designated by an end pointer (i.e., a mapping index at an end) of the mapping chain in an original cluster in operation S430.
• data stored in a cluster corresponding to a mapping index in a mapping chain is written to a cluster corresponding to a subsequent system area index in the mapping chain. This write operation is repeated to the last of the mapping chain.
• initialization is performed by the initialization module in operation S100, thereby having new original system data.
• the hard disk protection program deletes all content, which has been changed in the system area 6 since the initialization, using a recovery module in operation S500.
• the recovery module performs the same operations shown in FIG. 7 as the initialization module.
• the hard disk protection program changes the system mode into the original change mode and performs the change of the original in operation S600.
• the user can directly change data in the system area 6, as described with reference to FIG. 8.
• the initialization is performed as shown in FIG. 7 to change the system mode into an original protection mode.
• a removing module integrates the system area 6 and the meta buffer area 7 and removes the hard disk protection program from the hard disk 5 in operation S700, which will be described in detail with reference to FIG. 11.
• the removing module receives confirmation on the current state backup from the user in operation S510 and calls the current state backup module to perform the current state backup in operation 400 when the user wants the current state backup. Thereafter, the removing module removes the meta buffer area 7 set by the installation module in operation S520 and integrates the system area 6 and the meta buffer area 7 into a single system area in operation S530. In addition, the removing module automatically removes the software and device drivers constituting the hard disk protection program from the hard disk 5 in operation S540.
• the present invention can be realized as a program (i.e., a hard disk protection program) which is recorded on a computer readable recording medium and can be read by a computer.
• the computer readable recording medium may be a magnetic storage medium (e.g., a ROM, a floppy disk, or a hard disk), an optical readable medium (e.g., CD-ROM or DVD), or carrier waves (for example, transmitted through Internet).
• a magnetic storage medium e.g., a ROM, a floppy disk, or a hard disk
• an optical readable medium e.g., CD-ROM or DVD
• carrier waves for example, transmitted through Internet
• system data set as an original is not changed at all since initialization, and therefore, corrupted system data can be quickly recovered just by performing initialization. Since not an entire system area but only a part needing protection in the system area is selectively managed using a system area information table and a mapping table, time taken to access the system data can be reduced, thereby minimizing the decrease of system processing speed.
• a separate data buffer area for storing the changed data is not needed but only a meta buffer area for storing a meta information table, a system area information table, and a mapping table is needed.
• the present invention provides a method of automatically reflecting system data that is currently in use to a recovery original using the mapping table and the system area information table so that a user can easily change the recovery original and the system data is prevented from being fatally damaged due to an attack of a virus program or the user's mistake during the change of the recovery original.
• changed data is stored in empty space in the system area.
• disk space can be utilized flexibly.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Computer Hardware Design (AREA)
• Quality & Reliability (AREA)
• Software Systems (AREA)
• Library & Information Science (AREA)
• Storage Device Security (AREA)
• Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=35463057

Family Applications (1)

Country Status (2)

Cited By (1)

Citations (5)

• 2004
  • 2004-06-04 KR KR1020040040870A patent/KR100527275B1/ko active IP Right Grant
• 2005
  • 2005-06-03 WO PCT/KR2005/001669 patent/WO2005119459A1/en active Application Filing

Patent Citations (5)

Also Published As

Similar Documents

Legal Events