Device and method for protecting file system in auxiliary storage device

Abstract

The present invention relates to a file system protection technology applied to an auxiliary storage device (20), and relates to a device and method for preventing or warning access to or modification of a file system in advance, and protecting the file system by confirming the user's permission when necessary. A control device (60) is connected to a host interface (30), a data storage device (40), and a user input device (50) to control the operation mode of the auxiliary storage device or manage and protect protected file system objects according to user commands. When the operation mode of the auxiliary storage device is management mode, the user can specify the file system object to be protected and set its protection method, and the user-set information is stored in a protected object database (70). In normal mode, when the host's access target is a file system object uploaded to the protected object database, a protection operation is performed with reference to the protection method of the protected object database. In normal mode, the host cannot access the protected object database (70) set by the user in the setting mode, thereby preventing malicious code from changing or destroying the protected object database (70).

Description

Technical Field

[0001] The present invention relates to an auxiliary storage device used in an electronic computing device, a computer, etc., and more particularly, to an apparatus and method for protecting a file system stored in the auxiliary storage device. Background Art

[0002] In all computers, including personal computers, the operating system (OS) is stored in a secondary storage device such as non-volatile memory or mechanical storage. The Basic Input / Output System (BIOS) reads the OS from the secondary storage device and starts the computer during startup. Furthermore, user files and application programs should also be stored in the secondary storage device. Therefore, the use of secondary storage devices is essential for operating the computer. Therefore, the configuration of the OS and user files should be protected from modification by anyone other than authorized users.

[0003] However, existing computer systems lack a specific method for distinguishing legitimate users from legitimate users, even after implementing security measures such as IDs and passwords. For example, in the Windows operating system, a security policy is implemented that categorizes users to restrict access to folders and files, but top-level administrators are granted unlimited privileges. Therefore, if a malicious program infiltrates and assumes the role of a top-level administrator, or if a malicious third party temporarily gains access as an administrator and compromises the system or steals information stored on the computer, there is no response.

[0004] As a result, malicious code such as ransomware continues to encrypt user files and even delete partitions or folders containing system recovery information, with no solution available. Furthermore, unauthorized third parties frequently steal information by secretly copying files containing confidential company information.

[0005] In these issues, the present applicant has filed several inventions for repairing system damage in these issues (Korean application number 10-2017-0057998, granted patents 10-1920866 and 10-1920867). These prior inventions relate to an auxiliary storage device comprising an original auxiliary storage device and a backup auxiliary storage device. The original auxiliary storage device is always accessible to the host. However, the backup auxiliary storage device is restricted so that the user can only access it under specific conditions (e.g., recovery mode). Therefore, using these prior inventions, secure backup and recovery can be performed.

[0006] However, these existing inventions all have a weakness: since they can only back up and restore the file system, they can only be used after the fact. Of course, since complete recovery is possible after the fact, this is not a major problem. However, if malicious attempts can be prevented from the beginning, the time and cost required to recover from system damage can be eliminated or greatly reduced, which is of great significance.

[0007] On the one hand, in existing computers, malicious code monitoring programs primarily monitor code by comparing it to a malicious code database. However, if the code has been altered or is not in the malicious code database, it cannot be monitored and will inevitably be damaged. Furthermore, even when methods that monitor the operation of specific programs are used in existing computers, malicious code can render the program inoperable, causing further damage. Therefore, an effective method to prevent malicious code or unauthorized third parties from attempting to access the file system and alter its configuration or copy the information contained in files would be of great significance to file system protection. Summary of the Invention

[0008] Technical issues

[0009] Therefore, the present inventors have developed a file system protection device and method applicable not only to the auxiliary storage device previously applied for by the present inventors, which includes a primary auxiliary storage device and a backup auxiliary storage device, but also to existing auxiliary storage devices that use only primary auxiliary storage devices. Therefore, the present invention provides a device and method for protecting the file system by preventing or warning access to the file system or changes to the file system's configuration in advance, and by confirming user permission when necessary.

[0010] Means of solving the problem

[0011] To solve the above problems, the present invention analyzes host information accessing an auxiliary storage device, determines the file system objects constituting the file system, and if the file system object is a protected object, protects the file system by selectively denying access or allowing access after obtaining further permission from the user.

[0012] Typically, auxiliary storage devices use access information received from the host to perform operations such as reading or writing. In this case, the host primarily accesses the auxiliary storage device by specifying the address of the data area to be accessed using CHS (Cylinder Head Sector Addressing) or LBA (Logical Block Addressing) addressing, which is not a file name or folder name.

[0013] As a result, regardless of the method, addresses that directly or indirectly specify specific areas of the storage space (cluster number, head number, sector number, etc.) are used because the host's file system is managed by the host, not the auxiliary storage device. Of course, some auxiliary storage devices can use separate protocols to send and receive file-level information, but generally speaking, HDDs and SSDs widely used in desktop PCs or laptops access auxiliary storage devices by directly providing addresses.

[0014] However, since the access information transmitted at this time does not actually contain information such as the file name or file path, if you want to confirm whether a file system object such as a file, directory, or MBR (Master Boot Record) is accessed, the access information must be analyzed on the auxiliary storage device side. However, this operation is unnecessary in general auxiliary storage devices, and if performed, it will slow down the auxiliary storage device's processing speed and has no benefit.

[0015] In contrast, the auxiliary storage device according to the present invention performs this operation, resulting in slightly slower processing speeds. However, it prevents arbitrary changes to the file system, thereby protecting the file system from attacks by malicious code such as viruses or ransomware. Furthermore, since a malicious code database is not used, delays in database updates and response to new malicious code are avoided. Furthermore, when malicious code or unauthorized third parties attempt to access the file system, they can be intercepted or processed after confirming user permission, significantly improving file system security.

[0016] To solve the above-mentioned problems, an auxiliary storage device according to a first aspect of the present invention, embodying the above-mentioned concept, includes: a host interface for communicating with a host; a data storage device for storing data; a user input device for receiving input and related information from a user regarding an operating mode of the auxiliary storage device, i.e., a normal mode and a management mode; and a control device connected to the above-mentioned host interface, data storage device and user input device, for controlling the operating mode of the auxiliary storage device and managing and protecting protected file system objects according to user commands.

[0017] As one embodiment, the control device controls the operation of the auxiliary storage device between management mode and normal mode based on information received from the user input device. When the auxiliary storage device is in management mode, the user can specify the file system objects they wish to protect and set their protection methods. This user-defined information is stored in the protected object database. When the auxiliary storage device is in normal mode, when the host accesses a file system object uploaded to the protected object database, protection operations are performed according to the protection methods in the protected object database. In normal mode, the host cannot access the protected object database, which stores the user-defined information. This prevents malicious code from altering or damaging the protected object database.

[0018] The control device can be implemented using a CPU and related software and hardware that controls the auxiliary storage device, and the user input device can be implemented using an electric switch operated by the user. Alternatively, the user input device can be composed of a communication module and implemented in a manner that confirms single or multiple user inputs or data based on information received by wire or wirelessly. In this case, the input device of the external terminal can essentially replace the user input device.

[0019] In addition, as another embodiment, the control device may further include a protected object DB management module and a file system protection module.

[0020] When the auxiliary storage device is in management mode, the protected object DB management module receives user input to create or modify the protected object DB. This user input can be entered via a user input device or, in a restricted environment (e.g., after the auxiliary storage device's user input device has been set to management mode), via a host interface using an auxiliary storage device management program executed on the host. The user can designate file system objects to be protected as protected objects and specify a protection method.

[0021] Among them, the protection method of the protected object may include "warning", "confirm permission", "confirm permission and save recovery information" and "deny access", among which "save recovery information" can be applicable to the situation where the original auxiliary storage device and the backup auxiliary storage device are included in a manner similar to the prior invention of the inventor, and the storage area is inaccessible to the host.

[0022] Furthermore, the control device may include a file system protection module, comprising: an access information analysis unit for analyzing access information provided by the host; a file system object confirmation unit for confirming the file system object using the storage space at the access address included in the access information; and an object protection unit for selectively handling access to the access address according to a user-specified protection method when the confirmed file system object is a user-specified protected object. Furthermore, the file system protection module may also include an access log unit for creating and storing log information including access time, address, and command type.

[0023] According to a second aspect of the present invention, an auxiliary storage device for solving the above-mentioned problems further includes, in addition to the components of the auxiliary storage device of the first aspect, a display device for displaying the processing status of the control device (e.g., the type of file system object and the result of access processing). The control device of the auxiliary storage device according to the second aspect includes a display device driver module for driving the display device, and thus includes a file system protection module having some additional functions.

[0024] Among them, the file system protection module may include: an access information analysis unit for analyzing the access information provided by the host; a file system object confirmation unit for confirming the file system object that is using the storage space of the access address included in the above access information; an object protection unit for selectively processing access to the above access address according to the user-specified protection method when the confirmed file system object is a protected object specified by the user; and a protection status display unit for enabling the display device driver module to output the type of the above file system object and the access processing result to the above display device.

[0025] Furthermore, the auxiliary storage device for solving the above-mentioned problem according to a third aspect of the present invention, in addition to the components of the auxiliary storage device according to the second aspect, further includes a process for confirming a permission input by a user through a user input device. The process of confirming the permission input by the user is a step in which, when the protection method of the file system object is "Confirm Permission" or "Confirm Permission and Save Recovery Information," the user inputs whether to permit access to the corresponding address or file system object.

[0026] The file system protection module of the control device of the auxiliary storage device according to the third aspect may include: an access information analysis unit for analyzing access information provided by a host; a file system object confirmation unit for confirming the file system object that is using the storage space of the access address included in the above-mentioned access information; a protection status display unit for causing the display device driver module to output the type of the above-mentioned file system object and the content of the request for permission to the above-mentioned display device when the confirmed file system object is a protected object specified by the user and the above-mentioned protection method is "confirm permission" or "confirm permission and save recovery information"; and a second object protection unit for executing access when a confirmation permission input is input from the above-mentioned user input device.

[0027] The protection status display unit of the control device of the second aspect and the protection status display unit of the control device of the third aspect, as well as the user input device, can be implemented by connecting to an external terminal device such as a mobile phone. Specifically, if the user input device includes a wired / wireless communication module for connecting to the mobile phone, and an application is installed and driven in the mobile phone, tasks such as managing the protected object database and displaying and allowing access to file system objects can be integrated and implemented.

[0028] At the same time, according to another aspect of the present invention, a computer (PC, server computer, mobile terminal, etc.) of an auxiliary storage device using the above-mentioned device for protecting a file system in an auxiliary storage device or applying the method for protecting a file system in an auxiliary storage device is provided.

[0029] The configuration and effects of the present invention described above will become more apparent through the specific embodiments described below in conjunction with the accompanying drawings.

[0030] Effects of the Invention

[0031] While existing inventions focus on restoring damaged file systems, an auxiliary storage device utilizing the technology of the present invention can prevent or warn of undesirable file system changes beforehand, thereby protecting the file system from attacks by malicious code such as viruses or ransomware. Furthermore, even if a malicious third party temporarily gains access to the system or attempts to compromise it, appropriate responses can be implemented, significantly protecting the file system.

[0032] In addition, since it can protect the file system without many problems of existing antivirus programs (such as being unable to respond when new malicious code appears until the malicious code is registered in the database, or the host being slowed down because it needs to always run a program to check for malicious code), there is no inconvenience such as frequent updates of the malicious code database or reduced performance of the host, and it can prevent malicious code from damaging data in advance, which is of great significance. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 is a schematic diagram of an auxiliary storage device according to a first embodiment of the present invention;

[0034] Figure 2 is a block diagram of a control device for an auxiliary storage device according to a first embodiment;

[0035] Figure 3 is a structural diagram of a file system protection module of a control device according to the first embodiment;

[0036] Figure 4 is a diagram showing the configuration of an auxiliary storage device according to a second embodiment of the present invention;

[0037] Figure 5 is a block diagram of a control device for an auxiliary storage device according to a second embodiment;

[0038] Figure 6 is a structural diagram of a file system protection module of a control device according to a second embodiment;

[0039] Figure 7 is a diagram showing the configuration of an auxiliary storage device according to a third embodiment of the present invention;

[0040] Figure 8 is a block diagram of a control device for an auxiliary storage device according to a third embodiment;

[0041] Figure 9 FIG. 1 is a diagram showing the structure of a file system protection module of a control device according to a third embodiment. DETAILED DESCRIPTION

[0042] The advantages and features of the present invention and methods for achieving them will become apparent by referring to the embodiments described in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various forms. These embodiments are provided only to complete the disclosure of the present invention and to fully inform those skilled in the art of the present invention of the scope of the invention. The present invention is defined by the claims.

[0043] On the other hand, the terms used in this specification are used to describe the embodiments and are not intended to limit the present invention. In this specification, unless otherwise specifically stated in a phrase, the singular also includes the plural. The terms "comprise" or "comprising" used in this specification do not exclude the presence or addition of one or more other components, steps, operations and / or elements other than the components, steps, operations and / or elements mentioned.

[0044] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. When adding reference numerals to the components of the various drawings, identical components will be given the same reference numerals as much as possible, even if they are shown in different drawings. When describing the present invention, detailed descriptions of related well-known components or functions will be omitted if such detailed descriptions may obscure the main purpose of the present invention.

[0045] Figure 1 Figure 1 is a schematic diagram of an auxiliary storage device 20 according to a first embodiment of the present invention. This diagram essentially illustrates the configuration of a host computer 10 accessing the auxiliary storage device 20. The auxiliary storage device 20 comprises a host interface 30 for communicating with the host computer; a data storage device 40 for storing data; a user input device 50 for receiving user input; and a control device 60, connected to the host interface 30, data storage device 40, and user input device 50, for controlling the auxiliary storage device's operating mode or managing and protecting protected file system objects in accordance with user commands.

[0046] The control device 60 includes an operation mode control module ( Figure 2 61) to control the operating mode (normal mode and management mode) of the auxiliary storage device 20. The user can select normal mode and management mode through the user input device 50. When the operating mode of the auxiliary storage device 20 is management mode, the user can specify the file system object to be protected and set its protection method. The user-set information will be stored in the protected object DB 70. In normal mode, if the host accesses a file system object uploaded to the protected object DB, the protection operation is performed according to the protection method of the protected object DB. In normal mode, the host cannot access the protected object DB 70 set by the user in the setting mode, thereby preventing malicious code from changing or damaging the protected object DB 70.

[0047] Here, a file system object essentially means an element or combination of elements that constitutes a file system. Therefore, a file system object can be a sector, cluster, file path, file name, directory, partition, or drive itself, or can be composed of them. Therefore, the elements that constitute the file system itself, namely the MBR (Master Boot Record), PBR (Partition Boot Record), MFT (Master File Table) in NTFS (New Technology File System), and FAT in FAT (File Allocation Table), can also be file system objects. Therefore, a file system object can be a storage space such as a sector or cluster specified by CHS or LBA, or a specific file such as c: / users / documents / PEACE.doc, or a directory such as / temporary that represents a temporary directory of files and directories, or a partition or drive such as D:, or a cluster such as MBR.

[0048] The control device 60 can be implemented using the CPU and related software and hardware that controls the auxiliary storage device 20, and the user input device 50 can be implemented using a user-operated electrical switch. Alternatively, the user input device 50 can be implemented by including a communication module that confirms single or multiple user inputs or data based on information received via wired or wireless communication. In this case, an input device of an external terminal can essentially replace the user input device 50. For example, a touch screen or key input device of a mobile phone can be connected to the auxiliary storage device 20 via a communication method such as Bluetooth to replace the user input device 50. In this case, it is best to use a secure protocol to prevent external exposure.

[0049] exist Figure 2 In the embodiment, the control device 60 includes, in addition to the operation mode control module 61 , a protected object DB management module 62 and a file system protection module 63 .

[0050] When the auxiliary storage device 20 is in management mode, the protected object DB management module 62 receives user input to create or modify the protected object DB 70. The user can designate file system objects to be protected as protected objects and also specify a protection method. In this case, user input can also be entered through the user input device 50. Alternatively, under restricted circumstances (e.g., after setting the management mode via the auxiliary storage device's user input device), the information can be input into the protected object DB management module 62 of the auxiliary storage device via the host interface 30 using the auxiliary storage device management program running on the host computer 10. This method requires caution, as unrestricted use may expose it to attacks from malicious code. However, due to its ease of use, it is preferred to use it after setting the management mode on the auxiliary storage device.

[0051] The protection methods are divided into "warning", "confirm permission", "confirm permission and save recovery information", "deny access", etc., among which saving recovery information can be applied to the case where the original auxiliary storage device and the backup auxiliary storage device are included in a manner similar to the previous invention of the present inventor, and a storage area that is inaccessible to the host 10 is provided. As described above, the designation of the protection method of the protected object can also be achieved by providing the user with means such as an initialization program or a management program. On the other hand, the protection method is set according to whether the access of the host 10 is write access or read access. Therefore, for example, the user can create a protected object DB 70 as follows. It is preferred that the files or directories registered in the protected object DB 70 are automatically updated when the name is changed, but it is also possible to restrict the name from being changed.

[0052] The following is an example configuration of protected object DB 70. In the following DB configuration example, the object type can be represented by an address such as LBA0-LBA33, a file path and file name such as D: / PEACE.doc, or a directory such as D: / WORLD. In the above example, write access to the MBR (Master Boot Record) responsible for booting is prohibited in the case of NTFS partitions, and to LBA0-LBA33 responsible for booting in the case of GPT (GUID Partition Table) partitions.

[0053]

[0054] "Warning" is implemented by simply notifying that the corresponding file system object has been accessed through an LED, alarm, or display device. "Confirm permission" allows access only when user permission is received. It can be implemented by outputting a message for confirming permission through a display device and receiving confirmation permission through the user input device 50, or it can be implemented by automatically judging it as permission when a specific switch is ON or a variable input through other communication terminals is confirmed and its value corresponds to ON. "Access denied" is implemented by unconditionally denying access and notifying that access to the file system object has been denied through an LED, alarm, or display device after access is denied. "Save recovery information after confirming permission" is implemented by allowing access after obtaining user permission, but saving recovery information in response to damage to the file system object. In this case, recovery information can only be saved if there is also a storage area that is normally inaccessible to the host.

[0055] Secondly, since file system objects typically consist of multiple clusters or sectors, this can be used to store confirmed user responses and automatically handle access to the clusters that make up the file system object. In other words, by receiving a user response once and applying the same response to all clusters that make up the file within a certain period of time, unnecessary user confirmation operations can be eliminated.

[0056] On the other hand, when the access is read access, only the aforementioned protection methods of confirmation of permission or warning are applicable. In particular, in the case of read access, confirmation of permission is a method that can prevent unauthorized third parties from attempting to leak information by secretly copying files. In this case, the user's permission required for confirmation of permission can be simply input via a switch (e.g., via user input device 50), but alternatively, the process can be triggered by an approval signal input from the user's mobile phone to the control device (e.g., automatically connecting the mobile phone application to the control device and automatically inputting a separate password from the mobile phone). Specifically, the user input device 50 of the auxiliary storage device 20 is assigned communication terminal functionality, and the mobile phone is installed with an application that can communicate with the auxiliary storage device 20 and function as the user input device 50. When the mobile phone and auxiliary storage device 20 are connected, confirmation of permission can be processed without user intervention (automatic approval). In this case, the application installed on the mobile phone can receive a separate password from the user, or be activated using the mobile phone's unique device number, USIM ID, etc., to achieve linkage with the auxiliary storage device.

[0057] Furthermore, it is preferred that permission confirmation for write access be performed differently from permission confirmation via automatic approval for read access. That is, write access requires changes to the file system's configuration, so automatic approval for read access could potentially authorize malicious code attacks. Therefore, it is preferred that automatic approval for write access be used only in the "permission confirmation and recovery information storage" scenario.

[0058] Figure 3 for Figure 2 FIG2 shows a block diagram of the file system protection module 63 in the control device 60. The file system protection module 63 includes an access information analysis unit 631 for analyzing access information provided by the host 10; a file system object confirmation unit 632 for confirming the file system object using the storage space at the access address included in the access information; and an object protection unit 633 for selectively processing access to the access address according to the user-specified protection method when the confirmed file system object is a user-specified protected object.

[0059] In addition to the above configurations, the file system protection module 63 may further include an access log unit 634 for creating and storing log information consisting of access time, address, command type, etc. Users may also use it to manage log information through an application on a mobile phone.

[0060] Figure 4 FIG2 is a diagram showing the configuration of an auxiliary storage device according to a second embodiment of the present invention. Figure 1 The auxiliary storage device 20 of the first embodiment also includes a display device 80. The display device 80 can be composed of a combination of an LED, a display, an alarm device, and the like. According to another embodiment, it can be composed of a communication module and a terminal device in a manner similar to the user input device 50, with information transmitted to the outside via wired or wireless communication, allowing the display device to be replaced by an external terminal device. In this case, the user input device 50 and the display device 80 can be integrated into a single input / output device. In this case, the integrated input / output device can be implemented as the entirety or a portion of a terminal that is communicatively connected to the aforementioned control device (i.e., connected via a communication network or via a specially designed communication device or method).

[0061] Figure 5 for Figure 4 The structure of the control device 60 of the auxiliary storage device according to the second embodiment is shown in FIG. Figure 2 In addition to the components shown in FIG. 8 , the file system protection module 63 also includes a display device driver module 64 for driving the display device 80. Figure 3The shown device includes an access information analysis unit 651 for analyzing the access information provided by the host 10, a file system object confirmation unit 652 for confirming the file system object that is using the storage space of the access address included in the above access information, and an object protection unit 653 for selectively processing the access to the above access address according to the protection method specified by the user when the confirmed file system object is a protected object specified by the user. It also includes a protection status display unit 654 for enabling the above display device driver module 64 to output the type of the above file system object and the access processing result to the above display device 80.

[0062] In addition, as in the first embodiment, the file system protection module 63 may further include an access log unit 634 for creating and storing log information consisting of access time, address, command type, etc. Users may also use it to manage log information through an application on a mobile phone.

[0063] In this second embodiment, above-mentioned protection status display unit 654 can be implemented as being connected to transmit or exchange information with external terminal devices such as mobile phone.At this moment, can use communication network (that is, use communication network or use the communication device or method of specific design) to realize connection.In this case, substantial display device 80 is mobile phone screen, substantial user input device 50 is the input device of mobile phone, and runs the application program for processing it on mobile phone.In this case, above-mentioned control device 60 is connected with mobile phone by communication module, and also can carry out above-mentioned log information management by this application program.

[0064] Let's look at the example of protected object DB 70 described above. In the example above, the user specified the MBR as a protected object, and the write protection method was "deny access." Now, assume that host 10 is infected with a computer virus and attempts to damage the MBR to disable booting. The virus on host 10 issues a write command to sector 0 of the MBR. Auxiliary storage device 20 first verifies through the file system object verification process that sector 0 belongs to the file system object MBR. Next, by verifying protected object DB 70, it confirms that the write operation to the MBR is denied. Therefore, auxiliary storage device 20 denies the host 10's write command and notifies the user of this via display device 80. As mentioned above, display device 80 can be a mobile phone screen driven by a mobile phone application. In other words, when a warning is issued, the application automatically informs the user that the MBR was nearly altered or damaged by the write command. The user can then view the log information through the application. Therefore, since the user can detect abnormal operation of host 10 by integrating this information, the user can check for abnormalities in host 10 by running an antivirus program or using other methods.

[0065] Alternatively, "access denied" may be reported to the host through other methods. In Windows, when a write operation fails, the chkdsk program may be run to identify bad sectors. Because this significantly impacts host operations, the write operation may be reported to the host as successful, with the secondary storage device displaying access denied via protection status display unit 654. However, if the OS supports the functions of the present invention, this implementation method is unnecessary.

[0066] Figure 7 is a diagram showing the structure of the auxiliary storage device 20 according to the third embodiment of the present invention. The third embodiment also includes Figure 4 The user input device 50 of the auxiliary storage device 20 of the second embodiment shown receives a user permission input process 90. The user permission input process 90 is a process in which the user inputs whether to allow access to the corresponding address or file system object when the protection method of the file system object is "confirm permission" or "confirm permission and save recovery information".

[0067] Figure 8 FIG. 6 is a block diagram of the control device 60 of the auxiliary storage device 20 according to the third embodiment, including a file system protection module 63' having a modified configuration. Figure 9 As shown, the file system protection module 63' includes a third access information analysis unit 631, which is used to analyze the access information provided by the host 10; a file system object confirmation unit 632, which is used to confirm the file system object that is using the storage space of the access address included in the above access information; a second object protection unit 636, which is used to perform access when a confirmation permission input is input from the above user input device 50; and a second protection status display unit 637, which is used to enable the display device driver module 64 to output the type of the above file system object and the content requested to be allowed to the above display device 80 when the confirmed file system object is a protected object specified by the user and the above protection method is "confirm permission" or "confirm permission and save recovery information".

[0068] Furthermore, the file system protection module 63' may also include an access log unit 634 for creating and storing log information consisting of access time, address, command type, etc. Users can also use it to manage log information through mobile phone applications.

[0069] Figure 6 The protection status display unit 635 and the above Figure 9The second protection status display unit 637 can be connected to an external terminal device such as a mobile phone. In this case, the actual display device 80 is the mobile phone screen, the actual user input device 50 is the input device of the mobile phone, and an application for processing the information is running on the mobile phone. In this case, the control device 60 is connected to the mobile phone via a communication module, and the above-mentioned log information management can also be performed through this application.

[0070] Let's look at the case where the user specifies D: / PEACE.doc as a protected object as shown in the example above. Assume that D: / PEACE.doc occupies sectors 100-111. Since both the read protection method and the write protection method for the corresponding file are "confirm permission," when there is a write or read attempt, the third file system protection module 66 executes a process of issuing a warning to the user and obtaining permission. For example, assume that the host 10 is infected with ransomware. In this case, the ransomware will attempt to delete the file after encrypting it. Ransomware typically destroys files by overwriting them to disable Windows' deleted file recovery function. Now, assume that the virus on the host 10 issues a write operation command to sector 100 of D: / PEACE.doc. The auxiliary storage device 20 first confirms that sector 100 belongs to the file system object D: / PEACE.doc through the file system object confirmation process. Next, it will confirm that the write operation to D: / PEACE.doc was performed with the user's permission by confirming the protected object DB 70. Therefore, the auxiliary storage device 20 notifies the user through the display device 80 that the host 10 has issued a write operation command to the file D: / PEACE.doc, and waits for permission.

[0071] In this case, the display device 80 and user input device 50 can be replaced with a configuration using a communication module and a mobile phone. In this case, the mobile phone screen can serve as the display device 80, and the touch screen or buttons can serve as the user input device 50. An application running on the mobile phone can drive these devices to implement the functions of the third file system protection module 66. Specifically, when a warning is issued, the application automatically runs to notify the host computer 10 of the receipt of a write operation command to D: / PEACE.doc, displays a message on the screen asking the user to allow it, and waits for confirmation. If the user allows it, the write operation command is executed; if the user denies it, the host computer 10's write operation command to the file is rejected.

[0072] As another embodiment, the access information analysis unit 631 of the file system protection modules 63 and 63' described above can be implemented by analyzing the file system of the host 10 and identifying the file system object using the storage space corresponding to the access address included in the access information using a search table including information about sectors or clusters allocated to files or directories. In this case, it is preferable to create and use the search table in batches at startup or when the auxiliary storage device 20 is in management mode, rather than during normal operation, and to update the table whenever the file system is modified.

[0073] In addition, all or part of the functions of the above-mentioned file system protection modules 63 and 63' (for example, the function of confirming file system objects in the search table) can be separated and manufactured as hardware or a single chip. When the entire function is manufactured as a single chip, the file system protection modules 63 and 63' can be implemented in the form of running program code, which is program code that implements the file system protection method using independent memory, CPU interface circuits, high-speed computing circuits, etc. On the other hand, the function of confirming file system objects in the search table can be separated and implemented as a dedicated search chip using an FPGA (Field Programmable Gate Array) and a computing core. In this case, the dedicated search chip consists of a memory interface circuit that is independent of the CPU interface circuit, has shared memory or dedicated memory and can access the CPU's memory, and a computing core equipped with a search engine. It uses the search table to perform the operation of confirming file system objects using sector or cluster information.

[0074] On the other hand, the Windows OS typically automatically runs the chkdsk program upon receiving a response from the auxiliary storage device indicating that it cannot access the data. While this is a natural operation for the OS to confirm a failure in the auxiliary storage device, in a structure such as the auxiliary storage device 20 of the present invention, it is an unnecessary operation that consumes a significant amount of time. Therefore, it would be preferable to adjust the system to not perform this operation through an OS patch, etc. If adjustment through an OS patch is difficult, access can also be denied by the OS replying that the write operation was successful even though access is actually denied. In this case, problems may arise due to data inconsistencies, but because the file is protected and a warning has been received about improper access, the user can determine that their computer is performing an abnormal operation and can therefore take appropriate measures. On the other hand, in this case, the OS commands a write operation to the remaining sectors 101-111 as well, preferably by applying the user's reply to sector 100 to all clusters constituting the file over a period of time to eliminate unnecessary user confirmation operations.

[0075] The above-mentioned device for protecting a file system in an auxiliary storage device or the auxiliary storage device applying the method for protecting a file system in an auxiliary storage device can be implemented as an electronic computing device or computer (PC, server computer, mobile terminal, etc.) of various types and uses to perform the above-mentioned functions.

[0076] As described above, although the configuration of the present invention has been described in detail through the preferred embodiments of the present invention, it should be understood by those skilled in the art that the present invention may be implemented in a specific form other than that disclosed in this specification without changing the technical spirit or essential features. It should be understood that the above embodiments are exemplary in all aspects and not restrictive. The scope of protection of the present invention is defined by the appended claims rather than the detailed description above, and all modifications or deformations derived from the claims and their equivalents should be interpreted as being included within the technical scope of the present invention.

Claims

1. A device for protecting a file system in an auxiliary storage device, wherein the auxiliary storage device has a host interface for communicating with a host and a data storage device for storing data, characterized in that: The device for protecting the file system in the auxiliary storage device includes: a user input device for receiving information and related information from a user for selecting an operation mode of the auxiliary storage device, wherein the operation modes include: a normal mode in which, when a host accesses the auxiliary storage device, a protection operation is performed if the access target is a protected file system object; and a management mode in which a user can designate a file system object to be protected as a protected object and set a protection method for the object; A protected object DB, used to store the protected objects specified by the user in the management mode and the protection methods set by the user; The control device includes: an operation mode control module for controlling the operation mode; a protected object DB management module for storing the file system objects designated by the user as protected objects and the protection methods set by the user in the protected object DB when the operation mode is the management mode; and a file system protection module for performing protection operations on the protected object with reference to the protection method of the protected object DB when the access target of the host is a protected object uploaded to the protected object DB when the operation mode is the normal mode.

2. The device for protecting a file system in an auxiliary storage device according to claim 1, wherein: The file system protection module of the control device includes: An access information analysis unit, configured to analyze the access information provided by the host; a file system object confirming unit, configured to confirm a file system object that is using a storage space of an access address included in the access information; and The object protection unit is configured to selectively process access to the access address according to a protection method specified by the user when the confirmed file system object is a protected object specified by the user.

3. The device for protecting a file system in an auxiliary storage device according to claim 2, wherein: The file system protection module of the control device further includes: The access log unit is used to create and store log information including access time, address and command type.

4. The device for protecting a file system in an auxiliary storage device according to claim 1, wherein: Also includes: A display device is used to display the processing status of the control device.

5. The device for protecting a file system in an auxiliary storage device according to claim 4, wherein: The file system protection module of the control device includes: An access information analysis unit, configured to analyze the access information provided by the host; a file system object confirming unit, configured to confirm a file system object that is using the storage space of the access address included in the access information; an object protection unit, configured to selectively process access to the access address according to a protection method specified by the user when the confirmed file system object is a protected object specified by the user; and The protection status display unit is used to enable the display device driver module to output the type of the file system object and the access processing result to the display device.

6. The device for protecting a file system in an auxiliary storage device according to claim 1 or 4, characterized in that: The protection method of the protected object is at least one selected from the following: Warnings, used to notify about access to specific file system objects; Confirm permission, which allows access only with the user's permission; Deny access, used to unconditionally deny access; as well as Confirming permission and saving recovery information is used to allow access after obtaining user permission and save the recovery information of the file system object.

7. The device for protecting a file system in an auxiliary storage device according to claim 6, wherein: When the access to the specific file system object is read access, the protection method of the protected object includes at least one of the warning and confirmation of permission.

8. The device for protecting a file system in an auxiliary storage device according to claim 6, wherein: When the access to the specific file system object is write access, the user's permission required to confirm permission and save recovery information in the protection method of the protected object is triggered by an approval signal input from the user's mobile phone to the control device.

9. The device for protecting a file system in an auxiliary storage device according to claim 6, wherein: When the protection method of the protected object is confirmation permission or confirmation permission and saving recovery information, the user input device includes: The user permission input unit is used for the user to input whether to allow access to an address or a file system object.

10. The device for protecting a file system in an auxiliary storage device according to claim 9, wherein: The file system protection module of the control device includes: An access information analysis unit, configured to analyze the access information provided by the host; a file system object confirming unit, configured to confirm a file system object that is using the storage space of the access address included in the access information; a protection status display unit, configured to, when the confirmed file system object is a protected object specified by the user and the protection method is confirmation permission or confirmation permission and saving recovery information, cause the display device driver module to output the type of the file system object and the content of the permission request to the display device; and The object protection unit is configured to perform access when a confirmation permission input is input from the user input device.

11. A method for protecting a file system in an auxiliary storage device, characterized in that: The auxiliary storage device has a host interface for communicating with a host and a data storage device for storing data, and the method includes: The step of receiving information and related information for selecting an operation mode of the auxiliary storage device from a user, wherein the operation modes of the auxiliary storage device include: a normal mode in which, when a host accesses the auxiliary storage device, a protection operation is performed if the access target is a protected file system object; and a management mode in which a user can designate a file system object to be protected as a protected object and set a protection method for the object; a step of controlling said operating mode; When the operation mode is the management mode, a step of storing the file system object designated by the user as a protected object and the protection method set by the user in a protected object DB; and When the operation mode is the normal mode, when the access target of the host is a protected object uploaded to the protected object DB, the steps of performing a protection operation on the protected object are performed with reference to the protection method of the protected object DB.

12. The method for protecting a file system in an auxiliary storage device according to claim 11, wherein: The protection method of the protected object is at least one selected from the following: Warnings, used to notify about access to specific file system objects; Confirm permission, which allows access only with the user's permission; Deny access, used to unconditionally deny access; as well as Confirming permission and saving recovery information is used to allow access after obtaining user permissions and save the recovery information of the file system object.

13. The method for protecting a file system in an auxiliary storage device according to claim 12, wherein: When the access to the specific file system object is read access, the protection method of the protected object includes at least one of the warning and confirmation of permission.

14. The method for protecting a file system in an auxiliary storage device according to claim 12, wherein: When the access to the specific file system object is write access, the user's permission required to confirm permission and save recovery information in the protection method of the protected object is triggered by an approval signal input from the user's mobile phone.

Images