Hard disk firmware attack preventing system and method

Abstract

The invention discloses a hard disk firmware attack preventing system. The system comprises a blacklist and white list database used for storing a blacklist and a white list of hard disk instruction invariant features, a white list matching module used for receiving hard disk control instructions sent out by a computer and comparing whether the hard disk control instructions are matched with the white list or not, an instruction blocking and transmitting module used for blocking the unmatched hard disk control instructions and transmitting the matched instructions to a hard disk, and a suspicious instruction processing module used for outputting instruction identity information of the instructions which are not matched with the white list or the blacklist so that the instruction identity information can be analyzed manually. The invention further provides a hard disk firmware attack preventing method. On the premise that the computer normally visits hard disk user data, the purposes of blocking hostile attacks and recognizing unknown behaviors are achieved.

Description

technical field [0001] The invention belongs to the field of information security, in particular to a system and method for preventing hard disk firmware attacks. Background technique [0002] With the development of hacking technology, firmware attack has become a new security threat faced by information equipment. The hard disk firmware contains the codes and parameters required by the hard disk microprocessor to control the operation of each electromagnetic component. Its storage area is isolated from the user data area and cannot be recognized by the API or software using standard operating system instructions. Can be operated. If exploited by hackers, it can achieve the purpose of deeply hiding data, damaging hard drives, etc., which is extremely harmful. [0003] The interaction between the computer and the hard disk is mainly through the command register group. Among them, there are 7 registers related to control, and each register is 8 bits. In theory, there are 2 ...

AI Technical Summary

Problems solved by technology

[0005] The technical problem solved by the present invention is: to overcome the deficiencies of existing methods, to provide a system and method for preventing hard disk firmware attacks, which can block all hard disk attack commands, and can capture suspicious command information for manual analysis

Images