A solid state hard drive and a method and device for detecting and killing viruses therein

Abstract

The embodiment of the present application discloses a solid-state hard drive and a virus detection and killing method and device therein, the method comprising: reading all pre-stored malicious virus feature library data from the solid-state hard drive as a detection standard object; obtaining all user data in the solid-state hard drive as a detected object; comparing each detected object with all detection standard objects, and when any detected object matches any of the detection standard objects, using the currently determined matched detected object as a bait file; overwriting the logical addresses LCA corresponding to all bait files with invalid data, and updating the mapping information of the overwritten bait files as the mapping information of invalid data into the overall mapping table of the solid-state hard drive. Through this embodiment, the dependence on the host system virus detection and killing is avoided, and the security of the user data in the host hard drive is ensured under the premise that the host system fails to detect and kill viruses in a timely manner.

Description

Technical Field

[0001] The embodiments of the present application relate to solid-state drives and information security technology, and more particularly to a solid-state drive and a method and device for detecting and killing viruses within the solid-state drive. Background Art

[0002] Traditional virus detection and identification is based solely on a library of known malicious behavior signatures. This library uses its own relevant rule features and behavioral judgments to confirm whether the current application is normal, whether there are risks, or known attack behaviors. It generally relies on its own relevant matching rules and strategies, and uses the Internet to implement intelligence updates and threat sniffing, thereby detecting viruses and issuing alerts on the user side.

[0003] This defensive virus detection and killing method, which analyzes and extracts features of malicious samples to achieve the purpose of controlling malicious programs, will undoubtedly occupy user-side resources. In addition, virus files that are missed or not detected and killed in time will remain on the host's hard disk, posing a threat to the security of user data on the host's hard disk. Summary of the Invention

[0004] The embodiments of the present application provide a method and device for virus detection and killing in a solid-state hard drive and its internal structure, which can avoid dependence on virus detection and killing on a host system, and ensure the security of user data in the host hard drive under the premise that the host system fails to detect and kill viruses in a timely manner.

[0005] The present invention provides a method for detecting and killing viruses in a solid-state drive. The method may include:

[0006] Read all pre-stored malicious virus signature database data from the solid-state drive as detection standard objects;

[0007] Acquire all user data in the solid-state drive as the detected object;

[0008] Comparing each of the detected objects with all of the detection standard objects, and when any of the detected objects matches any of the detection standard objects, using the currently determined matched detected object as a bait file;

[0009] The logical addresses LCA corresponding to all the bait files are overwritten with invalid data, and the mapping information of the overwritten bait files is updated into the overall mapping table of the solid state drive as the mapping information of the invalid data.

[0010] In an exemplary embodiment of the present application, the reading of all pre-stored malicious virus signature database data files from the solid-state drive as detection standard objects may include:

[0011] The malicious virus signature database data files pre-stored in the flash memory of the solid state drive are read out one by one, and each piece of malicious virus signature database data with a preset size is obtained, and each piece of malicious virus signature database data is used as a detection standard object.

[0012] In an exemplary embodiment of the present application, obtaining all user data in the solid-state drive as a detected object may include:

[0013] Traversing all data storage spaces of the solid-state drive to obtain all user data;

[0014] The entire user data is divided into a plurality of user data units according to the preset size in the order of the logical block addresses LBA, and each user data unit is regarded as a detection object.

[0015] In an exemplary embodiment of the present application, comparing each of the detected objects with all of the detection standard objects may include:

[0016] Calculate the first hash value of each detection standard object;

[0017] Calculating a second hash value for each user data unit;

[0018] Each second hash value is compared with all of the first hash values.

[0019] In an exemplary embodiment of the present application, confirming that any one of the detected objects matches any one of the detection standard objects may include:

[0020] detecting, based on a comparison result of each second Hash value with all the first Hash values, whether any second Hash value is equal to any first Hash value;

[0021] When any of the second hash values is equal to any of the first hash values, it is determined that the detected object corresponding to the second hash value matches the detection standard object corresponding to the first hash value, and the currently determined matched detected object is used as the bait file.

[0022] In an exemplary embodiment of the present application, the method may further include: after obtaining the bait file, establishing a bait file mapping table of all the bait files, wherein the LCAs of the bait files are sequentially arranged in the bait file mapping table;

[0023] The step of establishing a bait file mapping table for all the bait files may include:

[0024] Obtain mapping information tablemassage of the malicious virus file characteristic data block corresponding to each bait file; the table massage includes the physical address PCA and LCA corresponding to the malicious virus file characteristic data block, and the LCA and PCA of each malicious virus file characteristic data block are in one-to-one correspondence;

[0025] Arrange the LCAs in the table massage corresponding to all the bait files in sequence to obtain the bait file mapping table.

[0026] In an exemplary embodiment of the present application, overwriting the logical addresses LCA corresponding to all the decoy files with invalid data, and updating the mapping information of the overwritten decoy files as mapping information of the invalid data into the overall mapping table of the solid-state drive may include:

[0027] All LCAs in the decoy file mapping table are overwritten with invalid data, and the overwritten decoy file mapping table is updated as an invalid data mapping table into the overall mapping table of the solid state drive.

[0028] In an exemplary embodiment of the present application, the method may further include:

[0029] When the solid state hard disk is powered on, the virus detection and killing method is executed inside the solid state hard disk.

[0030] In an exemplary embodiment of the present application, the method may further include:

[0031] Update the stored malicious virus signature database data regularly according to the preset update cycle.

[0032] An embodiment of the present application also provides a virus detection and killing device inside a solid-state hard drive, which may include a processor and a computer-readable storage medium. The computer-readable storage medium stores instructions. When the instructions are executed by the processor, the virus detection and killing method inside the solid-state hard drive is implemented.

[0033] The embodiment of the present application also provides a solid-state hard drive, which may include the virus detection and killing device inside the solid-state hard drive.

[0034] Compared to related technologies, the embodiments of the present application may include: reading all pre-stored malicious virus signature database data from a solid-state drive as a detection standard object; obtaining all user data in the solid-state drive as a detected object; comparing each detected object with all the detection standard objects, and when any detected object matches any of the detection standard objects, using the currently determined matched detected object as a bait file; overwriting the logical addresses LCA corresponding to all the bait files with invalid data, and updating the mapping information of the overwritten bait files as the mapping information of the invalid data into the overall mapping table of the solid-state drive. Through this embodiment, the dependence on the host system's virus detection and elimination is avoided, ensuring the security of user data in the host hard drive if the host system fails to detect and eliminate viruses in a timely manner.

[0035] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present application. Other advantages of the present application can be realized and obtained by the solutions described in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings are used to provide an understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.

[0037] Figure 1 This is a flow chart of a method for detecting and killing viruses in a solid-state drive according to an embodiment of the present application;

[0038] Figure 2 This is a block diagram of the virus detection and killing device inside the solid-state hard disk of an embodiment of the present application;

[0039] Figure 3 This is a block diagram of the solid-state drive composition of an embodiment of the present application. DETAILED DESCRIPTION

[0040] This application describes multiple embodiments, but this description is exemplary rather than restrictive, and it will be apparent to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described herein. Although many possible feature combinations are shown in the drawings and discussed in the detailed description, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with any other feature or element in any other embodiment, or may replace any other feature or element in any other embodiment.

[0041] This application includes and contemplates combinations of features and elements known to those of ordinary skill in the art. The embodiments, features, and elements disclosed in this application may also be combined with any conventional features or elements to form a unique inventive solution defined by the claims. Any features or elements of any embodiment may also be combined with features or elements from other inventive solutions to form another unique inventive solution defined by the claims. Therefore, it should be understood that any feature shown and / or discussed in this application may be implemented individually or in any appropriate combination. Therefore, except for the limitations made according to the appended claims and their equivalents, the embodiments are not subject to other limitations. In addition, various modifications and changes may be made within the scope of protection of the appended claims.

[0042] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not rely on the specific order of the steps described herein, the method or process should not be limited to the steps in the specific order described. As will be understood by those skilled in the art, other orders of steps are also possible. Therefore, the specific order of the steps set forth in the specification should not be interpreted as a limitation to the claims. In addition, the claims for the method and / or process should not be limited to performing their steps in the order written, and those skilled in the art can readily understand that these orders can be changed and still remain within the spirit and scope of the embodiments of the present application.

[0043] The embodiment of the present application provides a method for detecting and killing viruses in a solid state drive. Figure 1 As shown, the method may include steps S101-S104:

[0044] S101, reading all pre-stored malicious virus signature database data from the solid state drive as a detection standard object;

[0045] S102, obtaining all user data in the solid-state drive as a detected object;

[0046] S103, comparing each detected object with all the detection standard objects, and when any detected object matches any detection standard object, using the currently determined matched detected object as a bait file;

[0047] S104: overwrite the logical addresses LCA corresponding to all the bait files with invalid data, and update the mapping information of the overwritten bait files as mapping information of invalid data into the overall mapping table of the solid state drive.

[0048] In the exemplary embodiments of the present application, it is known that traditional virus detection and elimination technologies are helpless against virus files that are missed or not detected in a timely manner, thereby posing a threat to the security of user data on solid-state drives (SSDs). The embodiments of the present application primarily address the problem that traditional virus detection and elimination technologies are highly dependent on the host system and cannot ensure the security of user data on the host hard drive if the host system fails to detect and eliminate viruses in a timely manner. This solution provides a strategy for detecting and eliminating viruses within the SSD, relying on malicious virus signature database data pre-stored in the SSD's flash memory medium to verify and eliminate all user data on the SSD.

[0049] In an exemplary embodiment of the present application, the malicious virus feature library and user data can be read through the firmware program in the SSD main control chip, and the solution of the embodiment of the present application can be completed.

[0050] In an exemplary embodiment of the present application, the method may further include:

[0051] When the solid state hard disk is powered on, the virus detection and killing method is executed inside the solid state hard disk.

[0052] In an exemplary embodiment of the present application, the application scenario of the solution of the embodiment of the present application can be that after the host is invaded by a virus, the host is forced to power off and shut down, and the SSD invaded by the virus file is powered on separately, so that the antivirus solution of the embodiment of the present application is executed inside the SSD, thereby achieving the purpose of destroying the content of the virus file and making it unrecoverable.

[0053] In an exemplary embodiment of the present application, the reading of all pre-stored malicious virus signature database data files from the solid-state drive as detection standard objects may include:

[0054] The malicious virus signature database data files pre-stored in the flash memory of the solid state drive are read out one by one, and each piece of malicious virus signature database data with a preset size is obtained, and each piece of malicious virus signature database data is used as a detection standard object.

[0055] In an exemplary embodiment of the present application, the preset size may include but is not limited to 4k, and each 4k malicious virus feature library data may be used as a detection standard object, or a detection source.

[0056] In an exemplary embodiment of the present application, the method may further include:

[0057] Update the stored malicious virus signature database data regularly according to the preset update cycle.

[0058] In an exemplary embodiment of the present application, the malicious virus signature database data pre-stored in the SSD flash memory medium can be updated regularly with the help of the host computer software, and then the latest malicious virus signature database data can be loaded into the designated location of the SSD in conjunction with the firmware program.

[0059] In an exemplary embodiment of the present application, obtaining all user data in the solid-state drive as a detected object may include:

[0060] Traversing all data storage spaces of the solid-state drive to obtain all user data;

[0061] The entire user data is divided into a plurality of user data units according to the preset size in LBA (Logical Block Address) order, and each user data unit is regarded as a detection object.

[0062] In an exemplary embodiment of the present application, the user data may refer to storage data stored in a set storage space of a solid state drive, where the storage space is used to store data stored by a user.

[0063] In an exemplary embodiment of the present application, user data in the solid-state drive may be organized into user data units of 4 KB in LBA order.

[0064] In an exemplary embodiment of the present application, comparing each of the detected objects with all of the detection standard objects may include:

[0065] Calculate the first hash value of each detection standard object;

[0066] Calculating a second hash value for each user data unit;

[0067] Each second hash value is compared with all of the first hash values.

[0068] In an exemplary embodiment of the present application, the hash value of each 4k malicious virus feature library data (i.e., each detection standard object) can be calculated as the first hash value; the user data in the solid-state drive is exported one by one in LBA order with 4k as a user data unit and the hash value of each user data unit is calculated separately as the second hash value.

[0069] In an exemplary embodiment of the present application, for example, the malicious virus signature library data blocks at the specified physical address inside the SSD can be read out one by one, and the corresponding first hash value can be calculated for each 4k malicious virus signature library data. The first hash value can be expressed as Det{(f0, h0), (f1, h1), (f2, h2)…(fn, hn)}, thereby obtaining a malicious signature library hash set H(h0, h1, h2…hn); wherein Det is a directory set of detection standard objects, fn is the nth 4k unit (n is a positive integer) in all malicious virus signature library data, that is, the nth detection standard object, hn is the hash value corresponding to fn (that is, the first hash value), and H is a set of hash values corresponding to all malicious virus signature library data.

[0070] In an exemplary embodiment of the present application, the user data is traversed in LBA order and the hash value (i.e., the second hash value) of each 4k user data unit is derived and recorded as Tar{(t0, ht0)(t1, ht1)…(tn, htn)}; wherein Tar is the hash value set of all user data units, tn is the nth user data unit arranged in LBA order, and htn is the hash value corresponding to tn (i.e., the second hash value).

[0071] In an exemplary embodiment of the present application, confirming that any one of the detected objects matches any one of the detection standard objects may include:

[0072] detecting, based on a comparison result of each second Hash value with all the first Hash values, whether any second Hash value is equal to any first Hash value;

[0073] When any of the second hash values is equal to any of the first hash values, it is determined that the detected object corresponding to the second hash value matches the detection standard object corresponding to the first hash value, and the currently determined matched detected object is used as the bait file.

[0074] In an exemplary embodiment of the present application, the firmware program can record all abnormal detection result information by checking the hash (first hash value) of the malicious virus feature library data and the user data hash (second hash value), that is, the user data unit whose first hash value is equal to the second hash value, as a bait file; coordinate all the abnormal detection result information, and arrange the malicious virus file feature data block table massage in sequence according to the LCA order.

[0075] In an exemplary embodiment of the present application, for example, a batch verification operation process of the first hash value and the second hash value may include steps 1-2:

[0076] 1. Perform the same hash comparison calculation:

[0077] Calc{(t0, ht0, H), (t1, ht1, H)…(tn, htn, H)};

[0078] Among them, Calc is the target set involved in the calculation;

[0079] 2. The recorded results are as follows:

[0080] When ht0∈H, then R{(t0, r)}, where r=1;

[0081] Otherwise, R{(t0, r)}, where r=0;

[0082] As calculated above, we get R{(t0, r), (t1, r)…(tn, r)};

[0083] The value of r is 0 or 1: r=0 indicates that the current user data unit t is not a bait file, and r=1 indicates that the current user data unit t is a bait file; R is a set of proofreading results of the first hash value corresponding to each user data unit.

[0084] In an exemplary embodiment of the present application, the method may further include: after obtaining the bait file, establishing a bait file mapping table of all the bait files, wherein the LCAs of the bait files are sequentially arranged in the bait file mapping table;

[0085] The step of establishing a bait file mapping table for all the bait files may include:

[0086] Obtain mapping information tablemassage of the malicious virus file characteristic data block corresponding to each bait file; the table massage includes the physical address PCA and LCA corresponding to the malicious virus file characteristic data block, and the LCA and PCA of each malicious virus file characteristic data block are in one-to-one correspondence;

[0087] Arrange the LCAs in the table massage corresponding to all the bait files in sequence to obtain the bait file mapping table.

[0088] In an exemplary embodiment of the present application, each user data unit corresponding to the detected object confirmed as the bait file is a malicious virus file feature data block, and a bait file mapping table for all bait files can be composed according to the mapping information (table massage) of the user data block in the solid-state drive to facilitate subsequent overwrite operations.

[0089] In an exemplary embodiment of the present application, for example, the table massage corresponding to all subsets with r=1 in the aforementioned R can be constructed into a bait file mapping table Q{(lca0, pca0), (lca1, pca1)…(lcan, pcan)}; wherein, lcan is the logical address corresponding to the user data unit indicated by the nth subset with r=1 in the proofreading result set R obtained in the above steps, and pcan is the physical address corresponding to lcan; Q is the set of mapping table units of all detected bait files.

[0090] In an exemplary embodiment of the present application, overwriting the logical addresses LCA corresponding to all the decoy files with invalid data, and updating the mapping information of the overwritten decoy files as mapping information of the invalid data into the overall mapping table of the solid-state drive may include:

[0091] All LCAs in the decoy file mapping table are overwritten with invalid data, and the overwritten decoy file mapping table is updated as an invalid data mapping table into the overall mapping table of the solid state drive.

[0092] In an exemplary embodiment of the present application, the malicious virus file characteristic data block table massage includes the physical address (PCA) and logical address (LCA) corresponding to each 4KB target data unit. All malicious virus file characteristic data blocks can be overwritten with dummy data; and all the malicious virus file characteristic data blocks table massage after the overwrite are updated in the SSD mapping table.

[0093] In an exemplary embodiment of the present application, for example, all lca corresponding to Q obtained from the above content are overwritten with dummy data to obtain an updated bait file mapping table Qx{(lca0, pcax)…(lcan, pcax)}; wherein pcax is the physical address pointing to the dummy data, which can usually be set to an invalid physical address, and Qx is the updated bait file mapping table, and the mapping table Qx can be updated to the overall mapping table of the SSD.

[0094] In the exemplary embodiment of the present application, the reason for adding the overwrite step is to prevent the firmware's restoration strategy from restoring the bait file. As long as the bait file is overwritten in each virus detection operation and the corresponding table is updated to point to an invalid physical address, it can be ensured that the virus file cannot be restored.

[0095] In the exemplary embodiments of the present application, at least the following advantages are included:

[0096] 1. Utilize the malicious virus feature database stored in advance inside the SSD to implement the idea of proofreading and killing viruses inside the SSD, making the virus killing behavior independent of the host virus killing software.

[0097] 2. Make the virus files inside the SSD unable to be restored and read normally, thereby killing the virus and protecting user data security.

[0098] The embodiment of the present application also provides a virus detection and killing device 1 inside a solid state hard disk, such as Figure 2 As shown, it may include a processor 11 and a computer-readable storage medium 12, wherein the computer-readable storage medium 12 stores instructions. When the instructions are executed by the processor 11, the virus detection and killing method inside the solid-state hard disk is implemented.

[0099] In the exemplary embodiments of the present application, any of the aforementioned method embodiments are applicable to the device embodiments and will not be described in detail here.

[0100] The present application also provides a solid state drive 2, such as Figure 3 As shown, the virus detecting and killing device 1 may be included in the solid state hard disk.

[0101] In the exemplary embodiments of the present application, any of the aforementioned method embodiments are applicable to the solid state drive embodiment and will not be described in detail here.

[0102] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As is well known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable, and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media generally embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A method for detecting and killing viruses in a solid-state hard drive, characterized in that: The method comprises: Read all pre-stored malicious virus signature database data from the solid-state drive as detection standard objects; Acquire all user data in the solid-state drive as the detected object; Comparing each of the detected objects with all of the detection standard objects, and when any of the detected objects matches any of the detection standard objects, using the currently determined matched detected object as a bait file; Overwriting the logical addresses LCA corresponding to all the bait files with invalid data, and updating the mapping information of the overwritten bait files as the mapping information of the invalid data into the overall mapping table of the solid-state drive; The method further includes: when the solid state drive is powered on, executing the virus detection and killing method inside the solid state drive, and the solid state drive does not need to interact with the host at the time of virus detection and killing.

2. The method for detecting and killing viruses in a solid-state hard disk according to claim 1, wherein: The method of reading all pre-stored malicious virus signature database data files from the solid state drive as detection standard objects includes: The malicious virus signature database data files pre-stored in the flash memory of the solid state drive are read out one by one, and each piece of malicious virus signature database data with a preset size is obtained, and each piece of malicious virus signature database data is used as a detection standard object.

3. The method for detecting and killing viruses in a solid-state hard disk according to claim 2, wherein: The acquiring of all user data in the solid state drive as a detected object includes: Traversing all data storage spaces of the solid-state drive to obtain all user data; The entire user data is divided into a plurality of user data units according to the preset size in the order of the logical block addresses LBA, and each user data unit is regarded as a detection object.

4. The method for detecting and killing viruses in a solid-state hard disk according to claim 3, wherein: The comparing each of the detected objects with all of the detection standard objects includes: Calculate the first hash value of each detection standard object; Calculating a second hash value for each user data unit; Each second hash value is compared with all of the first hash values.

5. The method for detecting and killing viruses in a solid-state hard disk according to claim 4, wherein: Confirming that any one of the detected objects matches any one of the detection standard objects includes: detecting, based on a comparison result of each second Hash value with all the first Hash values, whether any second Hash value is equal to any first Hash value; When any of the second hash values is equal to any of the first hash values, it is determined that the detected object corresponding to the second hash value matches the detection standard object corresponding to the first hash value, and the currently determined matched detected object is used as the bait file.

6. The method for detecting and killing viruses in a solid-state hard disk according to any one of claims 1 to 5, wherein: The method further includes: after obtaining the bait file, establishing a bait file mapping table for all the bait files, wherein the LCAs of the bait files are sequentially arranged in the bait file mapping table; The step of establishing a bait file mapping table for all the bait files includes: Obtaining mapping information table massage of the malicious virus file characteristic data block corresponding to each bait file; the table massage includes the physical address PCA and LCA corresponding to the malicious virus file characteristic data block, and the LCA and PCA of each malicious virus file characteristic data block are in one-to-one correspondence; Arrange the LCAs in the table massage corresponding to all the bait files in sequence to obtain the bait file mapping table.

7. The method for detecting and killing viruses in a solid-state hard disk according to claim 6, wherein: The step of overwriting the logical addresses LCA corresponding to all the bait files with invalid data, and updating the mapping information of the overwritten bait files as the mapping information of the invalid data into the overall mapping table of the solid state drive includes: All LCAs in the decoy file mapping table are overwritten with invalid data, and the overwritten decoy file mapping table is updated as an invalid data mapping table into the overall mapping table of the solid state drive.

8. The method for detecting and killing viruses in a solid-state hard disk according to any one of claims 1 to 5, wherein: The method further comprises: Update the stored malicious virus signature database data regularly according to the preset update cycle.

9. A virus detection and killing device inside a solid state hard disk, characterized in that: The method comprises a processor and a computer-readable storage medium, wherein the computer-readable storage medium stores instructions. When the instructions are executed by the processor, the virus detection and killing method inside the solid-state hard disk as described in any one of claims 1 to 8 is implemented.

10. A solid state hard disk, characterized in that: The invention comprises the virus detecting and killing device inside the solid state hard disk as claimed in claim 9.

Images