A method for protecting an operating system based on software and hardware read-only combination

Abstract

The present invention discloses an operating system protection method based on the combination of soft and hard read-only. The method realizes soft read-only control from the system level and realizes bottom-level data read-only control at the hardware level. It is compatible with GPT and MBR partitioning forms, improves system access performance, and also ensures the stability and reliability of the operating system, and also ensures the security of the operating system. At the same time, this method can greatly reduce the number of read and write times of SSD solid-state storage disks, improve the read and write performance and life of SSDs, and the invention has good application prospects in key areas such as data security.

Description

Technical Field

[0001] The invention relates to the field of operating system protection, in particular to an operating system protection method based on a combination of soft and hard read-only. Background Art

[0002] In some security application fields, in order to prevent the operating system from being implanted with backdoor programs, the system is often set to read-only, and the system is restored to its initial state after restart. This method only implements read-only at the operating system level, and the security factor is not high. If the system read-only setting is tampered with, there is also a risk of backdoor programs being implanted. Summary of the invention

[0003] In view of the defects of the prior art, the present invention proposes an operating system protection method based on a combination of software and hardware read-only, which protects the operating system through a combination of software and hardware read-only, thereby ensuring system data security.

[0004] In order to solve the technical problem, the technical solution adopted by the present invention is: an operating system protection method based on a combination of soft and hard read-only, comprising the following steps: S01), enabling the soft read-only function of the operating system through EWF;

[0005] S02) Enable the hard read-only function for the solid state drive;

[0006] S03) Use the management tool to bind the drive letter and partition number to achieve the binding of soft read-only permission and hard read-only permission. The binding process is as follows:

[0007] S31), query the physical serial number of the operating system disk, and select the disk with the serial number;

[0008] S32), list shards, analyze the type of disk partitions, and the partition type used for the operating system is the primary partition;

[0009] S33), executing a command to display partition information, parsing the drive letter from the file, and thus obtaining the drive letter of the operating system;

[0010] S34), obtaining the byte offset of the storage space corresponding to the drive letter, and sending the value of the byte offset to the SSD main control chip. The SSD main control chip firmware program returns the actual partition number corresponding to the drive letter assigned by the operating system to the SSD partition after comparison from the partition table, and binds the partition number to the disk drive letter;

[0011] S04), read-only permission control, the read-only status of the SSD hard disk is divided into three types: read-only, non-read-only and temporarily closed read-only. Temporarily closing read-only means temporarily allowing writing, and the hard disk will be restored to the read-only state after power failure or restart; the read-only attribute must be set by the administrator, and the permission is set by the password. The administrator enters the password corresponding to the permission role to successfully set the partition read-only attribute; after the operating system is deployed, start to deploy the EWF component. When the EWF component is deployed, temporarily close the read-only state to ensure that the installation and configuration of the EWF component are written to the partition; temporarily closing the read-only state requires verifying the user password to take effect; after deploying EWF, if you want to write to the operating system partition, the first step is to close the EWF read-only permission, and the second step is to enter the correct user password to temporarily close the read-only. Save the write operation to the system partition before restarting the operating system. After the system restarts, EWF is restored to the read-only attribute and the SSD is restored to the read-only state. At this time, the data has been safely updated to the system partition.

[0012] Furthermore, the process of applying the read-only permission control in step S04) to the installation and deployment stage is as follows:

[0013] Use administrator privileges to turn off the read-only attribute of the system partition. At this time, the hard disk partition can read and write data. Install and deploy the operating system to the corresponding partition and turn on the read-only attribute. At this time, the hard disk is prohibited from writing data. After deploying EWF and its configuration, temporarily turn off read-only and restart the system. At this time, EWF and its configuration are deployed to the system partition. After powering on again, EWF controls the system disk to be read-only, and the corresponding system partition is also read-only, realizing double read-only protection. If the write permission of EWF is illegally enabled and forced to write, the hard disk partition is under the protection of hard disk read-only, and data is actually refused to be written to the hard disk.

[0014] Furthermore, the process of applying the read-only permission control in step S04) to the real-time protection stage is as follows:

[0015] The background service program queries the status of the protected volume in real time. EWF provides a set of application interfaces that allow third-party applications to programmatically read and configure the EWF information of each protected volume, so that the service program can query the EWF information of the system partition in real time. If the EWF read-only state changes, when it is detected that the read-only state is closed, an alarm dialog box pops up and requires the user to enter the password for temporarily closing the read-only state of the SSD. If the password is incorrect, the temporary write permission of the hard disk partition cannot be obtained, ensuring that data is not illegally written to the system partition.

[0016] The process of applying the read-only permission control described in step S04 to the shutdown or restart stage is as follows:

[0017] When the service software detects that the system is restarting or shutting down, a dialog box will pop up automatically to prompt the user whether to save the data. When the user clicks Save Data, the service software automatically parses the system drive letter and performs the following operations:

[0018] A. Execute the EWF command: ewfmgr c: -commitanddisable –live to disable the application layer soft read-only protection of the C drive and take effect immediately;

[0019] B. Analyze the actual partition number of the system disk according to the system drive letter;

[0020] C. A password input box pops up. After the user enters the correct password, the password and partition number are sent to the SSD main control chip. After the SSD main control chip parses it, it temporarily turns off read-only mode and allows the data to be written to the partition.

[0021] Furthermore, the process of enabling the hard read-only function of the solid state drive in step S02 is as follows:

[0022] The operating system sends a partition read-only instruction to the SSD master chip through the control software. After receiving the instruction, the SSD master chip parses and sets the partition. The SSD master chip triggers the operating system to re-enumerate the settings. The operating system obtains the new device partition table and partition attributes, and the SSD master chip re-enumerates the partitions and partition attributes.

[0023] Furthermore, the write control process of the solid-state drive after hard read-only is turned on is: when a virus or violent writing of data occurs, the main control chip determines whether it is a read-only partition. If so, the instruction is successful, but the data is not actually written. If it is determined that read-only is temporarily turned off, the data is written, and finally the instruction result and data are returned.

[0024] Furthermore, after receiving the instruction, the main control chip parses the instruction and sets the partition in a GPT or MRB manner.

[0025] Beneficial effects of the present invention: The present invention realizes a read-only control method combining software and hardware. It realizes software read-only control at the system level and bottom-level data read-only control at the hardware level. It is compatible with both GPT and MBR partitioning formats, improves system access performance, and also ensures the stability and reliability of the operating system, and also ensures the security of the operating system. At the same time, this method can greatly reduce the number of read and write times of the SSD solid-state storage disk, improve the read and write performance and life of the SSD, and the invention has good application prospects in key areas such as data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is an architecture diagram based on EWF technology and SSD read-only control;

[0027] Figure 2This is a diagram of using the diskpart tool to determine the partition. DETAILED DESCRIPTION

[0028] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0029] Example 1

[0030] This embodiment discloses an operating system protection method based on a combination of soft and hard read-only. At the operating system layer, the read-only switch (soft read-only) is controlled by EWF, and at the hardware layer, the hardware read-only control (hard read-only) of the solid-state drive is realized by firmware control to ensure system data security. This method can prevent the operating system from being illegally tampered with or even cracked by malicious programs, and has broad application prospects in the fields of national defense, military industry, information security, etc.

[0031] The method comprises the following steps:

[0032] S01) Use EWF to implement soft read-only of the operating system, and use the disk letter enable / disable command to control read-only on and off.

[0033] In this embodiment, soft read-only of the operating system is implemented through EWF. EWF (Enhanced Write Filter) provides a technical means (write protection) to protect volumes (VOLUME) to prevent writing. This technology allows the operating system to boot from a read-only storage medium. All write operations on volumes that receive EWF write protection will be redirected to overlay. There are two ways to overlay: disk or RAM memory. If data synchronization is required, the data is written to the volume (write protection is turned off). The data stored in the overlay can be submitted to the protected volume. In the disk overlay method, the data is stored in the overlay partition. For RAM memory overlay, a certain amount of memory space is provided for EWF. Due to the limited space provided by the RAM memory overlay, the disk overlay method is adopted in this solution. This embodiment is based on the dual read-only logical architecture reference of EWF. Figure 1 shown.

[0034] The user layer is controlled by the management software (APP). The instructions provided by the EWF component can be used to control the opening or closing of the EWF layer read-only (soft read-only at the operating system layer). Through the private commands (Private CMD) supported by the SSD master control, the read-only permission of a physical partition of the SSD can be directly controlled to be opened or closed on the premise of obtaining authorization (entering the administrator password).

[0035] S02) realizes the read-only function of the solid state drive.

[0036] In this embodiment, there are two concepts of SSD hardware read-only: read-only attribute and read-only status. The read-only attribute means that the partition is in permanent read-only mode, and the read-only status means that read-only is temporarily turned off (i.e., writing is temporarily allowed). After the system is restarted or powered off, it automatically returns to read-only mode. The operating system layer sends a partition read-only private instruction to the main control chip through the control software; the main control chip parses the instruction after receiving the instruction and sets the partition through GPT or MRB; the main control chip triggers the operating system to re-enumerate the device; the operating system obtains the new device partition table and partition attributes; the main control chip re-enumerates the partition and partition attributes. After setting the read-only partition, the write control process is as follows: when a virus or violent writing data, the main control chip determines whether it is a read-only partition. If so, the instruction is successful, but the data is not actually written; if it is determined that read-only is temporarily turned off, the data is written, and finally the instruction result and data are returned.

[0037] S03) Use the management tool to bind the drive letter and partition number, thereby binding the EWF read-only permission and the hard disk read-only permission.

[0038] The object of EWF operation is the disk drive letter, such as: C drive, while the management tools and service software can actually only operate the hard disk partition number, such as: partition 1. How to accurately correspond the drive letter and partition number so that the management tools and service software can accurately control the read-only of the operating system layer and the hardware read-only of the SSD is the technical key point of this method.

[0039] The process of binding the disk drive letter and the partition serial number in this embodiment is as follows:

[0040] S31) Use the diskpart tool to query the physical serial number of the SSD disk through private instructions, such as disk 0, and select the disk, that is, select disk 0;

[0041] S32), list shards, analyze the type of disk partitions, and the partition type used for the operating system is the primary partition;

[0042] S33), execute the command to display partition information, and parse the drive letter from the file. In this example, the drive letter of the operating system is C (C drive);

[0043] S34), get the byte offset, Figure 2 The byte offset in is 1048576. The byte offset is sent to the main control chip through a private instruction. The main control chip returns the actual partition number after comparison from the partition table, such as partition 1.

[0044] Through the above operation, the C drive and SSD partition 1 are bound. When the user uses the management tool to operate, he only needs to enter the system drive letter, which is automatically converted to the partition number according to the above steps. EWF operates the drive letter, and the management tool controls the SSD partition through the partition number. The service software monitors the status of the EWF partition in real time. If read-only is detected, a prompt box will pop up to ask the user to enter a password. If the password is entered incorrectly multiple times, the hardware read-only is prohibited from being temporarily closed (temporary write permission is prohibited). If the password is correct, the hardware read-only is temporarily closed. At this time, the data is safely written to the system partition by restarting the system.

[0045] S04) Protect the operating system through read-only permission control.

[0046] The read-only state of SSD is divided into three states: read-only, non-read-only, and temporarily closed read-only state. Temporarily closing read-only means temporarily allowing writing. The read-only state will be restored after the hard disk loses power or the system is restarted. The read-only attribute must be set through the administrator's role. When the SSD leaves the factory, the administrator sets the SSD system partition to read-only attribute (after the operating system is installed on the partition, it is set to a read-only partition). Permissions are set through passwords. The administrator must enter the password corresponding to the permission role to successfully set the partition read-only attribute. After the operating system is deployed, the EWF component is deployed. When the EWF component is deployed, the read-only state is temporarily closed to ensure that the installation and configuration of the EWF component are written to the partition. Temporarily closing the read-only state requires verifying the user password to take effect, so the terminal operator must know the password before enabling the temporary closure of the read-only operation (temporary writing). After deploying EWF, if you want to write to the operating system partition, the first step is to turn off the EWF read-only permission. The second step is to enter the correct user password to temporarily turn off read-only. Save the write operation to the system partition before restarting the operating system. After the system restarts, EWF is restored to read-only attributes and the SSD is restored to read-only status. At this time, the data has been safely updated to the system partition.

[0047] In this embodiment, read-only permission control is applied in deployment, real-time protection, and restart or shutdown states. The process of applying it in each stage is as follows:

[0048] Use administrator privileges to turn off the read-only attribute of the system partition (for example, partition 1). At this time, the hard disk partition can read and write data. Install and deploy the operating system to partition 1 and turn on the read-only attribute. At this time, writing data to the hard disk is prohibited. After deploying EWF and its configuration, temporarily turn off read-only and restart the system. At this time, EWF and its configuration are deployed to the system partition. After powering on again, EWF controls the system disk to be read-only, and the corresponding system partition is also read-only, realizing double read-only protection. If the write permission of EWF is illegally enabled and forced writing is performed, the hard disk partition will be protected by hardware read-only, and data will be denied to be actually written to the hard disk.

[0049] The status of the protected volume is queried in real time through the background service program. (EWF) Enhanced Write Filter provides a set of application interfaces that allow third-party applications to programmatically read and configure the EWF information of each protected volume. This allows the service program to query the EWF information of the system partition in real time. If the EWF read-only status changes, when the read-only status is detected to be closed, an alarm dialog box pops up and requires the user to enter the password for temporarily closing the read-only status of the SSD. If the password is wrong, the temporary write permission of the hard disk partition cannot be obtained, ensuring that data is not illegally written to the system partition.

[0050] By designing the service software, when the system restart or shutdown is detected, the service software automatically pops up a dialog box to prompt the user whether to save the data. When the user clicks to save the data, the service software automatically parses the system drive letter (taking the C drive as an example) and performs the following operations:

[0051] Step 1: Execute the EWF command: ewfmgr c: -commitanddisable –live, which turns off the application layer soft read-only of the C drive and takes effect immediately;

[0052] Step 2: Analyze the actual partition number of the system disk (for example, partition 1) based on the C drive. Figure 2 As shown;

[0053] Step 3: A password input box pops up. After the user enters the correct password, the password and partition number are sent to the SSD main control chip through a private instruction. After the main control chip parses it, it temporarily turns off read-only mode and allows the data to be written to the partition.

[0054] The above description is only the basic principle and preferred embodiments of the present invention. Improvements and substitutions made by those skilled in the art based on the present invention belong to the protection scope of the present invention.

Claims

1. An operating system protection method based on a combination of soft and hard read-only, characterized in that: The following steps are involved: S01) Enable the soft read-only function for the operating system through EWF; S02) Enable the hard read-only function for the solid state drive; S03) Use the management tool to bind the drive letter and partition number to achieve the binding of soft read-only permission and hard read-only permission. The binding process is as follows: S31), query the physical serial number of the operating system disk, and select the disk with the serial number; S32), list shards, analyze the type of disk partitions, and the partition type used for the operating system is the primary partition; S33), executing a command to display partition information, parsing the drive letter from the file, and thus obtaining the drive letter of the operating system; S34), obtaining the byte offset of the storage space corresponding to the drive letter, and sending the value of the byte offset to the SSD main control chip. The SSD main control chip firmware program returns the actual partition serial number corresponding to the drive letter assigned by the operating system to the SSD partition after comparison from the partition table, and binds the partition serial number to the disk drive letter; S04) Read-only permission control. The read-only status of SSD hard disk is divided into three types: read-only, non-read-only and temporarily closed read-only. Temporarily closing read-only means temporarily allowing writing. The hard disk will be restored to read-only status after power failure or restart. The read-only attribute must be set by the administrator. The permission is set by the password. The administrator enters the password corresponding to the permission role to successfully set the partition read-only attribute. After the operating system is deployed, the EWF component is deployed. When the EWF component is deployed, the read-only status is temporarily closed to ensure that the installation and configuration of the EWF component are written to the partition. Temporarily disabling the read-only state requires verifying the user password to take effect; after deploying EWF, if you want to write to the operating system partition, the first step is to disable the EWF read-only permission, and the second step is to enter the correct user password to temporarily disable the read-only permission. Before restarting the operating system, save the write operation to the system partition. After the system restarts, EWF is restored to the read-only attribute, and the SSD is restored to the read-only state. At this time, the data has been safely updated to the system partition.

2. The operating system protection method based on the combination of software and hardware read-only according to claim 1 is characterized in that: The process of applying the read-only permission control in step S04 to the installation and deployment stage is as follows: Use administrator privileges to turn off the read-only attribute of the system partition. At this time, the hard disk partition can read and write data. Install and deploy the operating system to the corresponding partition and turn on the read-only attribute. At this time, the hard disk is prohibited from writing data. After deploying EWF and its configuration, temporarily turn off read-only and restart the system. At this time, EWF and its configuration are deployed to the system partition. After powering on again, EWF controls the system disk to be read-only, and the corresponding system partition is also read-only, realizing double read-only protection. If the write permission of EWF is illegally enabled and forced to write, the hard disk partition is under the protection of hard disk read-only, and data is actually refused to be written to the hard disk.

3. The operating system protection method based on software and hardware read-only combination according to claim 1 is characterized in that: The process of applying the read-only permission control in step S04 to the real-time protection stage is as follows: The background service program queries the status of the protected volume in real time. EWF provides a set of application interfaces that allow third-party applications to programmatically read and configure the EWF information of each protected volume, so that the service program can query the EWF information of the system partition in real time. If the EWF read-only state changes, when it is detected that the read-only state is closed, an alarm dialog box pops up and requires the user to enter the password for temporarily closing the read-only state of the SSD. If the password is incorrect, the temporary write permission of the hard disk partition cannot be obtained, ensuring that data is not illegally written to the system partition.

4. The operating system protection method based on software and hardware read-only combination according to claim 1 is characterized in that: The process of applying the read-only permission control described in step S04 to the shutdown or restart stage is as follows: When the service software detects that the system is restarting or shutting down, a dialog box will pop up automatically to prompt the user whether to save the data. When the user clicks Save Data, the service software automatically parses the system drive letter and performs the following operations: A. Execute the EWF command: ewfmgr c: -commitanddisable –live; this command turns off the application layer soft read-only of the C drive and takes effect immediately; B. Analyze the actual partition number of the system disk according to the system drive letter; C. A password input box pops up. After the user enters the correct password, the password and partition number are sent to the SSD main control chip. After the SSD main control chip parses it, it temporarily turns off read-only mode and allows the data to be written to the partition.

5. The operating system protection method based on software and hardware read-only combination according to claim 1 is characterized in that: Step S02) The process of enabling the hard read-only function of the solid state drive is as follows: The operating system sends a partition read-only instruction to the SSD master chip through the control software. After receiving the instruction, the SSD master chip parses and sets the partition. The SSD master chip triggers the operating system to re-enumerate the settings. The operating system obtains the new device partition table and partition attributes, and the SSD master chip re-enumerates the partitions and partition attributes.

6. The operating system protection method based on software and hardware read-only combination according to claim 5 is characterized in that: The write control process of the solid-state drive after hard read-only is turned on is as follows: when a virus or violent data is written, the main control chip determines whether it is a read-only partition. If so, the command is successful, but the data is not actually written. If it is determined that read-only is temporarily turned off, the data is written and the command result and data are finally returned.

7. The operating system protection method based on software and hardware read-only combination according to claim 5 is characterized in that: After receiving the instruction, the main control chip parses the instruction and sets the partition through GPT or MRB.

Images