A Method of System Protection Based on Snapshot

Abstract

The invention discloses a system protection method based on snapshot. The system protection method comprises the following steps of: assigning a reserved space for redirection in a disk; assigning a first space for recording corresponding relationship in the disk or a memory; generating a private interface for reading disk original data, namely snapshot; and intercepting and capturing read and write operations on the disk by users, intercepting and capturing load of a kernel module, respectively processing the intercepted and captured read and write operations on the disk according to whether the operations are launched through the private interface or not, and respectively processing the intercepted and captured kernel module and the content of the snapshot after comparison. In the invention, the private interface and the kernel monitoring module are additionally arranged based on a system restore method in the prior art, kernel attack can be simply and effectively resisted, and an original restore system can be ensured to normally work at the same time, thereby achieving the purpose of system protection.

Description

technical field [0001] The invention relates to the technical field of computers, in particular to a system protection method. Background technique [0002] In public places such as school computer rooms or Internet cafes, a computer is generally provided to multiple users in different time periods. This solution has obvious advantages, but it also has shortcomings in actual operation. One of the more obvious problems is that when If the last user maliciously or unintentionally (misuse / virus, etc.) modifies the system files or configuration, it may directly affect the normal use of subsequent users. To solve this problem, a typical solution is to install a hard disk recovery card, so that the software system will return to the original state after only one restart, which can also be understood as restoring to the original system snapshot. [0003] The implementation principle of the general reduction method (such as figure 1 ), mainly to intercept the write operation to th...

AI Technical Summary

Problems solved by technology

But considering the actual situation, such as general online games have their own kernel programs to prevent account theft, and the user's USB disk or camera, etc., will also load the driver when using it, combined with many existing drivers in the system, so There are a large number of kernel modules, and some kernel modules have a certain degree of concealment. It is a heavy workload to distinguish whether they are trustworthy one by one.

At the same time, due to the difference in the actual operating environment, the user's assistance is required to judge the trustworthiness of the kernel module, which is not easy to use, and there is a greater possibility of misoperation, because the user does not necessarily have professional knowledge in this area to judge

Images