A virtual disk-based file transfer system and method

Abstract

The application relates to a virtual disk-based file transfer system and method, which method comprises: creating a security area based on a virtual disk; setting a permission control component in a computer space outside the security area, so as to control files transmitted to the inside and outside of the security area through the permission control component; receiving files transmitted from a mobile storage device through the security area; locking the security area through the permission control component until a privileged process added judges that the files meet security standards. The application has the effects of controlling files transmitted to a computer by a mobile storage device during work, and reducing file scanning time and scanning cost.

Description

Technical Field

[0001] This application relates to the field of computer systems, and in particular to a file transfer system and method based on a virtual disk. Background Technology

[0002] As the number of files increases, computer hard drive space is often insufficient to meet storage needs, making portable storage devices a popular choice. Common portable storage devices include memory cards, USB flash drives, and hard drives. However, using portable storage devices can potentially pose security risks to computers. For example, viruses carried on portable storage devices can spread between different computers, potentially causing losses to user information and assets.

[0003] Therefore, in related technologies, the following are usually adopted: (1) Controlling the files copied to the mobile storage device, and terminating the file copying action when an abnormal file is detected in the mobile storage device; (2) Controlling the files copied to the computer when performing file landing detection, such as full disk scan, fixed point scan, etc.; (3) Directly scanning and killing the mobile storage device when performing external source detection.

[0004] However, in actual use, it is impossible to determine whether there are abnormal files on the mobile storage device before it is connected to the computer. When there are abnormal files on the mobile storage device, establishing a connection with the computer may cause abnormal processes to run. Summary of the Invention

[0005] To address the aforementioned issues, this application provides a file transfer system and method based on a virtual disk.

[0006] The file transfer system and method based on virtual disk provided in this application adopts the following technical solution:

[0007] A file transfer method based on a virtual disk includes:

[0008] Create a secure zone based on a virtual disk;

[0009] An access control component is set up in the secure zone to facilitate the management and control of files transferred to and from the secure zone.

[0010] The file transmitted from the removable storage device is received through the secure zone;

[0011] The security zone is locked by the access control component until the added privileged process determines that the file meets security standards.

[0012] By adopting the above technical solution, when file transfer is required, the mobile storage device is plugged into the Windows-based computer. The access control component manages the files inside and outside the secure zone on the computer. When a file is transferred into the secure zone, the access control component locks the secure zone. The privileged process determines that the file transferred to the secure zone meets the security standards before unlocking it, so that the file can be moved or run on the computer, reducing the impact of abnormal files on the mobile storage device on the computer.

[0013] Optionally, creating a security zone based on a virtual disk includes:

[0014] Virtual disk partitions are created through a driver control process based on virtual disks;

[0015] The client creates the security zone on the virtual disk partition, and the security zone can receive and execute commands passed from the application layer.

[0016] By adopting the above technical solution, virtual disk technology creates virtual disk partitions through computer-driven control processes, enabling the creation of secure zones on the virtual disk partitions by the client. These secure zones can receive and execute commands passed from the application layer, thereby temporarily storing files from removable storage devices.

[0017] Optionally, the permission control component for setting up computer space outside the secure zone includes:

[0018] A permission control component is established based on the Windows Hook mechanism;

[0019] The access control component is set in the computer space outside the secure zone by installing the client program.

[0020] By adopting the above technical solution, the access control component can manage files both inside and outside the secure zone on the computer based on the Windows Hook mechanism.

[0021] Optionally, receiving the file transmitted from the removable storage device through the secure zone includes:

[0022] When the file copying action is initiated from the controlled removable storage device, the action is intercepted by the permission control component;

[0023] Determine whether the destination address of the file to be transmitted is within the secure zone;

[0024] If so, then the transfer of the file to the secure zone is permitted;

[0025] If not, then the transmission of the file is prohibited.

[0026] By adopting the above technical solution, when a file is transferred to a computer, the access control component can manage the file and intercept files that are transferred to the computer but are not in the safe zone, that is, only allow files to be transferred to the safe zone first.

[0027] Optionally, locking the secure zone through the access control component includes:

[0028] After the file is transferred to the secure area and the transfer is completed...

[0029] Based on the aforementioned permission control component, the driver control process is notified via the Windows message mechanism;

[0030] The driver control process calls the interface provided by the driver to notify the secure zone, so that the secure zone executes the locking instruction according to the notification to lock the file and allow the privileged process to access it.

[0031] By adopting the above technical solution, when the file transfer location is a secure zone, the secure zone can be notified to lock it. Once locked, the secure zone can only be accessed by privileged processes, thereby preventing abnormal processes from running within the file.

[0032] In summary, this application includes at least one of the following beneficial technical effects:

[0033] 1. During work, it can effectively restrict file and process behavior, and can be used in conjunction with backup, auditing and malware detection functions to perform various control operations on files to increase computer security;

[0034] 2. When files are copied and transferred, they should only be stored in the secure area. If they are stored in other areas of the computer, the copy should be transferred in binary format to reduce the dispersion of the target files.

[0035] 3. For files that have been stored in the secure zone, a scan is performed. At this point, all file processes are locked, allowing for timely scanning of the files through privileged processes.

[0036] 4. Minimize full disk scans of the computer and removable storage devices. Instead, lock and scan files transferred to the computer through the secure zone, thereby reducing scanning time and costs. Attached Figure Description

[0037] Figure 1 This is a flowchart of one embodiment of a file transfer method based on a virtual disk according to this application;

[0038] Figure 2 This is a flowchart of step S110 in one embodiment of a file transfer method based on a virtual disk according to this application;

[0039] Figure 3 This is a flowchart of step S120 in one embodiment of a file transfer method based on a virtual disk according to this application;

[0040] Figure 4 This is a flowchart of step S130 in one embodiment of a file transfer method based on a virtual disk according to this application;

[0041] Figure 5 This is a flowchart of step S140, up to the point where the added privileged process determines that the file meets security standards, in one embodiment of a file transfer method based on a virtual disk according to this application.

[0042] Figure 6 This is a flowchart of step S140, 'locking the secure area through the access control component', in one embodiment of a file transfer method based on a virtual disk according to this application.

[0043] Figure 7 This is a flowchart of the process after step S140 in one embodiment of a file transfer method based on a virtual disk according to this application.

[0044] Figure 8 This application presents a structural block diagram of a file transfer system based on a virtual disk.

[0045] Attached label: 1. Safe zone creation module; 2. File management module; 3. File receiving module; 4. Locking module. Detailed Implementation

[0046] The present application will be further described in detail below with reference to the accompanying drawings.

[0047] During computer use, to facilitate the transfer of files between different computers, removable storage devices are often used to store and transfer computer files. When transferring to a new computer, files are manually copied from the storage device to the new computer. However, manually copying files from the removable storage device to the computer presents the following problems:

[0048] (1) Dispersed targets: In theory, when a mobile storage device is connected to a computer, the files inside can be copied to any location on the computer. However, performing a full scan on a small number of target files is a waste of system resources. In addition, the time consumed by the scan will provide enough opportunity for abnormal files such as viruses and Trojans to be released and spread. Therefore, it is not practical to perform targeted scanning on dispersed targets.

[0049] (2) The scanning time is too late: For targets that have already been landed, the scanning and detection is carried out. First, the file may be operated or transferred by other processes during the scanning process. Second, once the file is forcibly occupied or access permissions are added by other processes, if the file content cannot be read, the scanning results will no longer be reliable.

[0050] (3) High scanning cost: It is theoretically feasible to control copying behavior, but in practice it is affected by factors such as file size and file format (compressed package), which consumes a lot of computer resources. Because the copying action is performed by the resource manager, scanning the file while copying will prolong the copying action. At this time, you can only operate the computer again after the scan is completed. Forced operation during the waiting period may cause the resource manager to terminate due to abnormalities such as non-response.

[0051] (4) Long waiting time: External source detection works well from the source, but it is not very user-friendly. For small storage devices or a small number of files, the scanning time is negligible. However, if the target is a portable hard drive or there are a large number of files, the scanning time will be no less than a full scan of the computer.

[0052] To address the aforementioned problems, this application discloses a file transfer system and method based on a virtual disk:

[0053] Reference Figure 1 A file transfer method based on a virtual disk includes the following steps:

[0054] S110. Create a security zone based on a virtual disk.

[0055] When a removable storage device copies and transfers files to a computer, the secure zone serves as a transit point for the files on the computer, minimizing file dispersion. Theoretically, when a removable storage device is connected to a computer, its internal files can be copied to any location on the computer. However, performing a full scan on a small number of target files wastes system resources, and the scanning time provides sufficient opportunity for viruses, Trojans, and other abnormal files to be released and spread. Therefore, the secure zone serves as a transit point, suppressing and identifying abnormal files within the secure zone, thus minimizing the waste of system resources.

[0056] S120. Set up an access control component in the computer space outside the secure zone to manage files transferred to and from the secure zone.

[0057] When files are transferred from a removable storage device to a computer, the access control component manages the files, controlling both files transferred to and from the computer's secure zone and files transferred outside the secure zone, thus minimizing the possibility of files being transferred within the computer.

[0058] S130, Receive files transferred from a removable storage device through the secure zone.

[0059] The system receives files from removable storage devices through a secure zone, and if a file is not within the secure zone when it is transferred to the computer, the transfer is prohibited.

[0060] S140. Lock the security zone through the access control component until the added privileged process determines that the file meets the security standards.

[0061] In this embodiment, the privileged process can be a program process with functions such as antivirus and backup, and processes such as malicious code detection, remote backup and file operation auditing can also be set as needed.

[0062] The implementation principle of a file transfer method based on a virtual disk in this application embodiment is as follows: When file transfer is required, a mobile storage device is inserted into a Windows-based computer. The access control component manages files inside and outside the secure zone on the computer. When a file is transferred to the secure zone, the access control component locks the secure zone. The privileged process determines that the file transferred to the secure zone meets the security standards before unlocking it, so that the file can be moved or run on the computer, thereby reducing the impact of abnormal files on the mobile storage device on the computer.

[0063] Reference Figure 2 Creating a secure zone based on a virtual disk involves the following steps:

[0064] S210. Create virtual disk partitions based on the virtual disk through the driver control process.

[0065] The virtual disk is created based on the Windows system. Creating a virtual disk in the Windows system generates a VHD file. You can add a VHD file in the Windows system to form a virtual disk partition. The virtual disk provides the same user experience as a regular disk.

[0066] S220. Create a secure zone on the virtual disk partition through the client. The secure zone can receive and execute commands passed from the application layer.

[0067] The client application includes an installation service and a security zone management program. The installation service installs the client on the computer, and after installation, it performs operations such as security zone driver registration and permission control module installation. The client's file control is primarily handled by the security zone driver and permission control components; other programs, such as the privileged processes mentioned above, only need to manage and distribute policies. The application layer provides an interface for the operating system or network applications to establish data connections between the user and the internet. Therefore, the security zone can receive and execute commands from the application layer. In this embodiment, the security zone can receive and execute commands transmitted from the permission control module and perform operations such as creating, destroying, locking, and unlocking virtual disks.

[0068] The secure zone also contains a privileged security setting process. When this process is running, no other process within the secure zone can access it. Therefore, in this application, the privileged security setting process is a process that can run within the secure zone and perform operations on files within the secure zone, including but not limited to creating, copying, deleting, detecting and removing malicious code, remotely backing up, and auditing file operations.

[0069] The implementation principle of creating a security zone based on a virtual disk in this application embodiment is as follows: a virtual disk partition is created in the computer based on a Windows virtual disk, and the virtual disk can receive and execute commands transmitted by the application layer. A security zone is created in the virtual partition, so that the security zone can receive and execute commands transmitted by the application layer.

[0070] Reference Figure 3 Setting up access control components in computer space outside the secure zone involves the following steps:

[0071] S310, an access control component is established based on the Windows Hook mechanism.

[0072] In the Windows Hook mechanism, a Hook is a platform for the Windows message handling mechanism. Applications can set up subroutines on it to monitor certain messages for a specified window, and the monitored window can be created by other processes. When a message arrives, it is processed before the target window's processing function. Therefore, the Hook mechanism allows applications to intercept and process Windows messages or specific events.

[0073] In this application, a hook is essentially a program segment that modifies the original logic of a program. There are many types of Windows hooks, all of which essentially change the original logic of a program, only in different ways. For example, there are two types of Windows application-level hooks used in this application: window-based message hooks and system function-based API hooks. Depending on the injection method and the type of the host process, the former injects into the message chain through system interfaces to handle window messages of almost all GUI processes; the latter injects into a specified process through a remote thread, and the host process type includes GUI processes and non-GUI processes. The latter has a wider scope, and theoretically, it can hook any function.

[0074] This application employs a combination of two methods to achieve global injection and hooking of processes within the system, maximizing control. The process is hooked into the system via system calls. Whenever a specific message is sent, the hook function intercepts it before it reaches the destination window, thus gaining control first. The hook function can then process (modify) the message, continue passing it without processing, or forcibly terminate message transmission.

[0075] In this embodiment, the WindowsHook mechanism is used to hook system functions to intercept file operation actions. Therefore, the corresponding permission control component is an application-layer hook program. This component uses WindowsHook (Windows message hook) and remote thread injection to make the target process load the permission control component, so as to control file operations inside and outside the security zone. The target process should have the ability to perform file operations, such as creating, copying and deleting files.

[0076] S320: Install the access control component in a computer space outside the secure zone via the client installer.

[0077] The client-side configuration includes an installation service that enables the installation and configuration of the access control component within the secure zone. The access control component controls the entire operating system, not just the secure zone. Its primary function is to define the boundaries of the secure zone. Files copied from removable storage media are isolated within the secure zone until their security is confirmed, ensuring they are processed before being written to the system's logical partitions. After the copy transfer is complete, the secure zone driver is notified to lock the files within the secure zone to prevent any process from accessing them.

[0078] The implementation principle of setting up a permission control component in the secure zone in this application embodiment is as follows: A permission control component is established based on the Windows Hook mechanism. The permission control component is installed in the secure zone through a client installation service, enabling the permission control component to hook system functions to intercept file operation actions. Therefore, the corresponding permission control component is an application-layer hook program. This component uses Windows Hook, i.e., Windows message hook, and remote thread injection to make the target process load the permission control component, so as to achieve the purpose of controlling file operations inside and outside the secure zone. Locking is performed through the secure zone driver to prevent any process from accessing files in the secure zone.

[0079] Reference Figure 4 Receiving files transferred from a removable storage device through a secure zone includes the following steps:

[0080] S410. When a file transfer action is initiated from a controlled removable storage device, the action is intercepted by the access control component.

[0081] The access control component is based on the Windows Hook mechanism. When a mobile storage device is connected to a computer, it is controlled by the access control component. When a file copy transfer is initiated from the controlled mobile storage device, the access control component intercepts the file before it is written to the computer, thus blocking any abnormal processes included in the file.

[0082] S420. Determine whether the destination address of the file to be transferred is in the safe zone.

[0083] Since the secure zone is part of the computer, the file to be transferred may not be located in the secure zone when it is stored on the computer. Furthermore, if the file contains abnormal files such as viruses, it may even move to critical system processes. Therefore, it is necessary to determine whether the destination address of the file to be transferred is in the secure zone.

[0084] S430. If yes, then file transfer to the secure area is permitted.

[0085] Since files are managed through access control components, and no program processes other than privileged processes can run on their own when a file is in the secure zone, there is a security boundary between the secure zone and other spaces on the computer, thus locking all files in the secure zone.

[0086] S440. If not, file transfer is prohibited.

[0087] When the destination address of the file to be transferred is not in the safe zone, abnormal processes such as viruses may copy and transfer the file to other areas of the computer, potentially starting and spreading on their own, causing the computer to malfunction. In this case, file transfer must be prohibited. File transfer includes actions such as copying, pasting, and cutting files.

[0088] The implementation principle of receiving files transmitted from a mobile storage device through the secure zone in this application embodiment is as follows: When receiving files transmitted from a mobile storage device through the secure zone, the permission control component intercepts the file and determines whether the destination address of the file is within the secure zone. If it is not within the secure zone, the file transmission will be prohibited; if it is within the secure zone, the transmission will be allowed.

[0089] Reference Figure 5 Until the added privileged process determines that the file meets security standards, the following steps are included:

[0090] S510, Set privileged processes to add interfaces.

[0091] S520: Based on security requirements, add corresponding privileged processes in the security zone through the privileged process addition interface.

[0092] The security requirements vary depending on the files on commonly used mobile storage devices. Based on these security requirements, interfaces are added to the corresponding privileged processes to set different privileged processes, enabling operations such as malware detection, remote backup, and file operation auditing.

[0093] The implementation principle of this application embodiment is as follows: by adding a process interface, it is possible to add corresponding privileged processes as needed.

[0094] Reference Figure 6 Locking the secure area through the access control component includes the following steps:

[0095] Once the file has been transferred to the secure area and the transfer process is complete:

[0096] S610, based on the access control component, notifies the driver control process through the Windows message mechanism.

[0097] Windows is a message-driven system. Windows messages provide a means of communication between applications and between applications and the Windows system. The functionality an application wants to achieve is triggered by messages and completed by responding to and processing those messages. This enables notifications to the driving process via the Windows message mechanism.

[0098] S620: The driver control process calls the interface provided by the driver to notify the security zone, so that the security zone executes a locking instruction to lock the file according to the notification and allows privileged processes to access it.

[0099] Specifically, the driver control process calls the interface provided by the driver to issue a locking command to the security zone, thereby notifying the security zone that the file has been transferred to the security zone. At this time, the security zone locks the file and only allows privileged processes to access it, enabling deep control over file behavior from the driver layer.

[0100] Reference Figure 7 The security zone is locked via access control components until the added privileged process determines that the file meets security standards. This also includes:

[0101] S710 unlocks the secure zone through the access control component.

[0102] S720: Transfer files located in the secure zone to the non-secure zone.

[0103] Specifically, when a file in the secure zone is determined to be in a normal state by a privileged process, the file can be transferred to the non-secure zone for storage due to the limited size of the secure zone. However, when a file in the secure zone is determined to be in an abnormal state by a privileged process, the corresponding privileged process will perform operations such as malicious code detection, auditing, and backup, thereby eliminating the corresponding abnormal process and increasing computer security.

[0104] The implementation principle of this application embodiment is as follows: when the added privileged process determines that the file meets the security standard, since the size of the secure area is relatively limited, the file that meets the privileged process is unlocked and transferred to the non-secure area, that is, other areas of the computer.

[0105] This application also discloses a file transfer system based on a virtual disk, comprising:

[0106] Safe Zone Creation Module 1 is used to create safe zones based on virtual disks;

[0107] File management module 2 is used to set up access control components in the computer space outside the secure zone, so as to manage the files transferred to and from the secure zone through the access control components;

[0108] File receiving module 3 is used to receive files transmitted from mobile storage devices through the secure zone;

[0109] Locking module 4 is used to lock the secure area through the access control component until the added privileged process determines that the file meets the security standards.

[0110] The implementation principle of a file transfer system and method based on a virtual disk in this application embodiment is as follows: a secure zone creation module creates a secure zone based on a virtual disk; a file management module sets up an access control component in the computer space outside the secure zone to manage files transferred inside and outside the secure zone; a file receiving module receives files transferred from a mobile storage device through the secure zone; and a locking module locks the secure zone through the access control component until the added privileged process determines that the file meets security standards.

[0111] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A virtual disk-based file transfer method, characterized by, The method comprises: creating a secure area based on a virtual disk; setting a permission control component in a computer space outside the secure area, so as to control files transmitted to and from the secure area through the permission control component; receiving the files transmitted from a mobile storage device through the secure area; locking the secure area through the permission control component until a privileged process added judges that the files meet security standards; wherein, before the privileged process added judges that the files meet security standards, the method further comprises: setting a privileged process adding interface; adding the privileged process in the secure area through the privileged process adding interface based on security requirements; wherein, the locking the secure area through the permission control component comprises: after the files are transmitted to the secure area and the transmission is completed, notifying a driver control process through a Windows message mechanism based on the permission control component; calling an interface provided by a driver through the driver control process to issue a locking instruction to the secure area, so that the secure area executes the locking instruction to be locked and allows the privileged process to access; wherein, when the privileged process is executed, no process in the secure area can access except the privileged process.

2. The method of claim 1, wherein, The creating a secure area based on a virtual disk comprises: creating a virtual disk partition through a driver control process based on a virtual disk; creating the secure area through a client in the virtual disk partition, and the secure area can receive and execute commands transmitted from an application layer.

3. The method of claim 1, wherein the virtual disk-based file transfer method is characterized by, The setting a permission control component in a computer space outside the secure area comprises: establishing a permission control component based on a WindowsHook mechanism; setting the permission control component in the computer space outside the secure area through a client installer.

4. The method of claim 1, wherein the virtual disk-based file transfer method is characterized by, The receiving the files transmitted from the mobile storage device through the secure area comprises: after an action of transmitting the files is initiated from the mobile storage device under control, intercepting the action through the permission control component; judging whether a destination address of the files to be transmitted is in the secure area; if yes, allowing the files to be transmitted to the secure area; if no, prohibiting the files to be transmitted.

5. The method of claim 1, wherein, The locking the secure area through the permission control component until the privileged process added judges that the files meet security standards further comprises: unlocking the secure area through the permission control component; transmitting the files in the secure area to a non-secure area.

6. A virtual disk-based file transfer system, comprising: The method according to any one of claims 1-5 comprises: a secure area creating module (1) for creating a secure area based on a virtual disk; a file control module (2) for setting a permission control component in a computer space outside the secure area, so as to control files transmitted to and from the secure area through the permission control component; a file receiving module (3) for receiving the files transmitted from a mobile storage device through the secure area; a locking module (4) for locking the secure area through the permission control component until a privileged process added judges that the files meet security standards; The privilege process added until the file meets the security standard comprises: Setting a privilege process adding interface; Based on the security requirement, adding the privilege process in the security area through the privilege process adding interface; The locking of the security area by the permission control component comprises: When the file is transmitted to the security area and the transmission is completed, the drive control process is notified through the Windows message mechanism based on the permission control component; The drive control process calls the interface provided by the drive program to issue a locking instruction to the security area, so that the security area executes the locking instruction to lock and allow the privilege process to access; When the privilege process is executed, no process in the security area can access except the privilege process.

Images