A ransomware defense method based on hard disk addressable sector numbers

Abstract

The present invention discloses a ransomware defense method based on hard disk addressable sector number, which includes: a ransomware defense program has a built-in database of all hard disk identification models and their total sector numbers that support ATA protocol specifications, and a physical hard disk is set as its dedicated hard disk, and the physical hard disk is divided into a monitoring partition and an HPA partition. When the physical hard disk works normally, the HPA partition sets the addressable sector number, and can only access the monitoring partition; when the user backs up or the ransomware defense program automatically synchronizes data, the addressable sector number is automatically set to the total sector number corresponding to the physical hard disk model, and the HPA partition can be accessed; when the computer is attacked by a ransomware virus, the ransomware defense program and the physical hard disk can be migrated to an isolated network computer or the local computer after the antivirus is completed, and the HPA partition can be accessed only after the detection is passed, so as to protect the user's backup data from the ransomware virus encryption attack. The present invention can effectively protect the user's backup data from the ransomware virus encryption attack.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a ransomware defense method based on hard disk addressable sector numbers. Background Art

[0002] Since most ransomware attacks use a combination of symmetric and asymmetric encryption algorithms, once the private key cannot be obtained, the encrypted data cannot be decrypted under existing technical conditions. After the continuous iteration and evolution of various ransomware families and their variants, data backup solutions and their equipment are basically ineffective against ransomware encryption attacks. Once a computer or network is infected with a ransomware virus, the data and its backups in the computer or storage pool within the network domain will be encrypted. Summary of the invention

[0003] In view of this, the present invention provides a ransomware virus defense method based on hard disk addressable sector numbers.

[0004] The present invention discloses a method for defending against ransomware based on hard disk addressable sector numbers, which comprises:

[0005] Step 1: The ransomware protection program has a built-in database of all hard disk identification models and their total sector numbers that support the ATA protocol specification, and sets the physical hard disk as its dedicated hard disk. The physical hard disk is divided into a monitoring partition and an HPA partition. When the physical hard disk is working normally, the HPA partition is set with an addressable sector number, and only the monitoring partition can be accessed;

[0006] Step 2: When the user backs up or the ransomware protection program automatically synchronizes data, the addressable sector number is automatically set to the total number of sectors corresponding to the physical hard disk model to access the HPA partition;

[0007] Step 3: When the computer is attacked by ransomware, the ransomware protection program and physical hard disk can be migrated to other isolated network computers or local computers after the antivirus is completed. Then, the ransomware data extraction function of the ransomware protection program can be used. The HPA partition can be accessed only after the detection passes to protect the user's backup data from ransomware encryption attacks.

[0008] Furthermore, the step 1 comprises:

[0009] Install the ransomware protection program and set the operation-related parameters for the ransomware protection program. The ransomware protection program has built-in support for all hard disk models and their corresponding total number of sectors in the ATA protocol specification, and automatically adapts to the hard disk model identified by the operating system; the operation-related parameters include physical disk, automatic synchronization source directory, data synchronization rules, and synchronization start time;

[0010] The ransomware defense program automatically divides the first N logical sectors of the physical hard disk into a monitoring partition, and writes bait files in different data formats into the monitoring partition; the logical sector address N+10 and all sectors thereafter are divided into an HPA partition, where the logical sector address N+10 is the HPA partition DBR address; and the key partition identification code, starting address code, and partition sector total number code of the HPA partition master boot record are stored in sectors N-2 and N+8, and finally the HPA instruction sets the addressing sector number to N; during normal use, only the monitoring area can be accessed.

[0011] Furthermore, the step 2 comprises:

[0012] Step 21: When the user accesses the HPA partition or the ransomware protection program automatically synchronizes data, the ransomware protection program will automatically detect all bait files in the monitoring partition;

[0013] Step 22: After the detection is passed, taking the MBR partition as an example, the ransomware protection program reads the key code in sector N-2 and writes it into the preset offset address of the master boot sector. It sends the HPA command through the ATA protocol to set the addressable sector number to the total number of sectors of the physical hard disk.

[0014] Step 23: The ransomware protection program sends a soft reset command to the physical hard disk through the ATA protocol, then automatically unloads the physical hard disk from the operating system, and finally automatically scans the hardware to reload the physical hard disk driver. At this time, the physical hard disk will be re-addressed and the physical hard disk will enter a state where the HPA partition can be accessed. At this time, the HPA partition can be accessed through the automatic synchronization function of the user or the ransomware protection program to perform data backup.

[0015] Furthermore, the step 21 comprises:

[0016] When a user accesses the HPA partition or the ransomware defense program automatically synchronizes data, the ransomware defense program will automatically detect whether the file names of all bait files in the monitored partition are consistent with the ransomware defense program template library, whether the file lengths are consistent with the ransomware defense program template library, whether the M-binary codes of all bait files are consistent with the ransomware defense program template library of all bait files, and whether the number of files is the total number of files of all bait files; M and N are positive integers.

[0017] Furthermore, after the user accesses or the automatic synchronization of the ransomware protection program ends, the ransomware protection program clears the code in the preset offset address of the master boot sector, and sends an HPA instruction through the ATA protocol to set the addressable sector number to N+10.

[0018] Furthermore, the ransomware defense program sends a soft reset command to the physical hard disk through the ATA protocol, then automatically unloads the physical hard disk from the operating system, and finally automatically scans the hardware to reload the physical hard disk driver. At this time, the physical hard disk will be re-addressed and restored to a state where only the monitoring partition can be accessed.

[0019] Furthermore, the step 3 comprises:

[0020] When a ransomware encryption attack occurs, you need to complete virus detection on the local machine to confirm that there is no virus process in the computer or migrate the physical hard disk to a safe isolated network computer before installing and running the ransomware protection program;

[0021] Use the ransomware data extraction function of the ransomware protection program to format the monitoring partition and write the bait file. The timer starts after the writing is completed.

[0022] After the timing is completed, the ransomware defense program will detect whether the file names of all bait files in the monitored partition are consistent with the ransomware defense program template library, whether the file lengths are consistent with the ransomware defense program template library, whether the M-binary codes of all files are consistent with the ransomware defense program template library, and whether the number of files is the total number of files of all bait files.

[0023] Furthermore, if the ransomware protection program cannot be detected, the system returns to reconfirm whether the virus has been completely detected and killed before installing and running the ransomware protection program.

[0024] Furthermore, after the detection is passed, the ransomware defense program reads the key code in sector N-2, writes it into the preset offset address of the master boot sector, and sends the HPA instruction through the ATA protocol to set the addressable sector number to the total number of sectors of the physical hard disk. If the boot time of the attacked computer exceeds the preset time, most ransomware viruses will clear the idle sectors after encrypting the physical hard disk data to prevent users from extracting data through data recovery methods. At this time, the ransomware defense program cannot read the key code in sector N-2. The ransomware defense program can be operated to send the HPA instruction through the ATA protocol to set the addressable sector number to the total number of sectors of the physical hard disk, and then read the key code in sector N+10, and write it into the preset offset address of the master boot sector.

[0025] Furthermore, after the key code in sector No. N+10 is read again and written into the preset offset address of the master boot sector, the method further includes:

[0026] The ransomware defense program sends a soft reset command to the physical hard disk through the ATA protocol, then automatically unloads the physical hard disk from the operating system, and finally automatically scans the hardware to reload the physical hard disk driver. At this time, the physical hard disk will be re-addressed and the physical hard disk will enter a state where the HPA partition can be accessed. Users can extract the backed-up data in the HPA partition so that users can resume normal work.

[0027] Due to the adoption of the above technical solution, the present invention has the following advantages: the present invention can effectively protect the user's backup data from ransomware encryption attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0029] Figure 1 This is a functional diagram of an HPA instruction according to an embodiment of the present invention;

[0030] Figure 2 The present invention is a schematic diagram of a ransomware defense method based on hard disk addressable sector numbers according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The present invention is further described in conjunction with the accompanying drawings and embodiments, and the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field should fall within the scope of protection of the embodiments of the present invention.

[0032] The ATA (Advanced Technology Attachment - the interface protocol between the hard disk drive and the host) protocol specification was developed under the guidance of the ATA International Organization, aiming to provide higher data transfer speeds and more powerful functions. The protocol contains the HPA (Host Protected Area) instruction, the main function of which is to set the maximum number of the hard disk's accessible LBA (Logical Block Address) logical sector address. For example, if the total number of sectors on a hard disk is 100,000, use the HPA instruction to set the maximum accessible logical sector address number to 100. Then after the hard disk is refreshed, the computer can only access a total of 100 sectors from 0 to 99, and the remaining sectors from 100 to 99999 cannot be accessed. Figure 1 shown.

[0033] See also Figure 2, the present invention provides an embodiment of a ransomware defense method based on hard disk addressable sector numbers, which includes a database of all hard disk identification models and their total number of sectors that support the ATA protocol specification built into the ransomware defense program. The ransomware defense program sets a physical hard disk as a dedicated hard disk for the ransomware defense program, and divides it into a monitoring partition and an HPA partition. When the hard disk is working normally, the HPA sets the addressable sector number to 2097160, and can only access the monitoring partition. When the user manually backs up or the ransomware defense program automatically synchronizes data, the addressable sector number is automatically set to the total number of sectors corresponding to the physical hard disk model, and the HPA partition can be accessed. When the computer is attacked by a ransomware virus, the ransomware virus defense program and the physical hard disk can be migrated to other isolated network computers or local computers after the antivirus is completed. The ransomware virus data extraction function of the ransomware defense program is used, and the HPA partition can be accessed only after the detection passes. The present invention can effectively protect the user's important backup data from ransomware virus encryption attacks. This embodiment specifically includes the following steps:

[0034] S1: The ransomware protection program has a built-in database of all hard disk identification models and their total sector numbers that support the ATA protocol specification, and sets the physical hard disk as its dedicated hard disk. The physical hard disk is divided into a monitoring partition and an HPA partition. When the physical hard disk is working normally, the HPA partition is set with an addressable sector number, and only the monitoring partition can be accessed;

[0035] In an optional embodiment, a ransomware defense program is installed and ransomware defense program operation-related parameters such as a physical disk, automatic synchronization source directory, data synchronization rules, and synchronization start time are set for use by the ransomware defense program. The ransomware defense program has built-in support for all hard disk models and their corresponding total number of sectors in the ATA protocol specification, and can automatically adapt according to the hard disk model recognized by the operating system, without wasting resources to obtain the hard disk sector status.

[0036] In an optional embodiment, after the basic settings are completed, the ransomware virus defense program automatically divides the first 2097150 logical sectors of the hard disk into a monitoring partition, and writes 4 bait files of 1MB size 1.DOC, 2.JPG, 10MB size 3.AVI, 100MB size 4.MDF into the monitoring partition; the 2097160LBA address and all sectors thereafter are divided into an HPA partition, where the 2097160LBA address is the HPA partition DBR (partition boot sector) address. The key partition identification code, starting address code, and partition sector total number code of the HPA partition master boot record are stored in sectors 2097148 and 2097158, and finally the HPA instruction sets the addressing sector number to 2097150.

[0037] S2: When the user backs up or the ransomware protection program automatically synchronizes data, the addressable sector number is automatically set to the total number of sectors corresponding to the physical hard disk model to access the HPA partition;

[0038] Specifically, during normal use, only the monitoring area can be accessed. Since the existing ransomware will definitely modify the file suffix after the attack; the encrypted file will partially or completely modify the file hexadecimal code according to the ransomware attack rule threshold. For example, the file header identification code of the DOC file format is 0XD0CF11. Once it is attacked by a ransomware, the structural code of the entire file header will inevitably change; the vast majority of ransomware attacks will generate ransom letters in the root directory of the partition, resulting in an increase in the number of files. Most ransomware will add identification and public key codes to the end of the file after encryption, resulting in an increase in the length of a single file. Therefore, when the user manually accesses the HPA partition or the ransomware defense program automatically synchronizes data, the ransomware defense program will automatically detect whether the file names of the 4 bait files in the monitoring partition are consistent with the ransomware defense program template library, whether the file length is consistent with the ransomware defense program template library, whether the hexadecimal codes of the 4 bait files are consistent with the ransomware defense program template library, and whether the number of files is 4.

[0039] After the detection passes, taking the MBR (Master Boot Record) partition as an example, the ransomware protection program reads the key code in sector 2097148 and writes it into the offset address 0X01D0-0X01DF of the master boot sector, and sends the HPA command through the ATA protocol to set the addressable sector number to the total number of sectors on the hard disk.

[0040] The ransomware protection program sends a soft reset command to the hard disk through the ATA protocol, then automatically unloads the hard disk from the operating system, and finally automatically scans the hardware to reload the hard disk driver. At this time, the hard disk will be re-addressed and the hard disk will enter a state where the HPA partition can be accessed. At this time, the user or the automatic synchronization function of the ransomware protection program will access the HPA partition to perform data backup.

[0041] After the user manually accesses or the ransomware protection program automatically synchronizes, the ransomware protection program clears the code in the offset address 0X01D0-0X01DF of the master boot sector and sends the HPA command through the ATA protocol to set the addressable sector number to 2097160

[0042] The ransomware protection program sends a soft reset command to the hard disk through the ATA protocol, then automatically unloads the hard disk from the operating system, and finally automatically scans the hardware to reload the hard disk driver. At this time, the hard disk will be re-addressed and restored to a state where only the monitoring partition can be accessed.

[0043] S3: When a computer is attacked by a ransomware virus, the ransomware virus protection program and the physical hard disk can be migrated to other isolated network computers or the local computer after the virus scan is completed. Then, the ransomware virus data extraction function of the ransomware virus protection program can be used. The HPA partition can be accessed only after the detection is passed to protect the user's backup data from ransomware virus encryption attacks.

[0044] Specifically, when a ransomware encryption attack occurs, you need to complete a virus scan on the local machine, confirm that there are no virus processes in the computer, or migrate the hard disk to a safe isolated network computer before you can install and run the ransomware defense program.

[0045] Using the ransomware data extraction function of the ransomware defense program, the ransomware defense program will format the monitoring partition, and then call the standard template library that comes with the ransomware defense program to write four bait files, namely 1.DOC, 2.JPG, 3.AVI, 10MB, and 4.MDF, with a size of 100MB. After writing is completed, a 2-minute countdown will start.

[0046] Since most ransomware viruses have the functions of horizontal network propagation, intranet transmission, and USB ferrying, if the computer virus is not completely detected or there are viruses spreading in the intranet domain, the files in the monitoring area will be encrypted and attacked again by the ransomware virus. Therefore, after the timing is completed, the ransomware virus defense program will detect whether the file names of the 4 bait files in the monitoring partition are consistent with the ransomware virus defense program template library, whether the file length is consistent with the ransomware virus defense program template library, whether the hexadecimal codes of the 4 bait files are consistent with the ransomware virus defense program template library, and whether the number of files is 4. If the ransomware virus defense program fails to pass the detection, please return to step S8 to confirm whether the virus has been completely detected.

[0047] After the detection is passed, the ransomware defense program reads the key code in sector 2097148 and writes it into the offset address of the master boot sector 0X01D0-0X01DF. The HPA instruction is sent through the ATA protocol to set the addressable sector number to the total number of hard disk sectors. If the attacked computer is turned on for too long, most ransomware viruses will clear the idle sectors after encrypting the hard disk data to prevent users from extracting data through data recovery methods. At this time, the ransomware defense program cannot read the key code in sector 2097148. The ransomware defense program can be manually operated to first send the HPA instruction through the ATA protocol to set the addressable sector number to the total number of hard disk sectors, and then read the key code in sector 2097158 and write it into the offset address of the master boot sector 0X01D0-0X01DF.

[0048] The ransomware protection program sends a soft reset command to the hard disk through the ATA protocol, then automatically unloads the hard disk from the operating system, and finally automatically scans the hardware to reload the hard disk driver. At this time, the hard disk will be re-addressed and the hard disk will enter a state where the HPA partition can be accessed. Users can extract the backed-up data in the HPA partition so that users can resume normal work.

[0049] Since the core technology of the present invention is to set the addressable sector number of the hard disk based on the HPA instruction included in the ATA protocol specification, all hard disks that support the ATA protocol specification can be used. Therefore, the operating system applicable to the present invention is not limited to the WINDOWS operating system. It is just an example of the WINDOWS operating system. Other operating systems such as Linux, Ubuntu, Kylin, and Tongxin can also be used.

[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A ransomware defense method based on hard disk addressable sector numbers, characterized in that: include: Step 1: The ransomware protection program has a built-in database of all hard disk identification models and their total sector numbers that support the ATA protocol specification, and sets the physical hard disk as its dedicated hard disk. The physical hard disk is divided into a monitoring partition and an HPA partition. When the physical hard disk is working normally, the HPA partition is set with an addressable sector number, and only the monitoring partition can be accessed; Step 2: When the user backs up or the ransomware protection program automatically synchronizes data, the addressable sector number is automatically set to the total number of sectors corresponding to the model of the physical hard disk to access the HPA partition; Step 3: When the computer is attacked by ransomware, migrate the ransomware protection program and physical hard disk to another isolated network computer or complete the local antivirus. Use the ransomware data extraction function of the ransomware protection program to access the HPA partition only after the detection passes, so as to protect the user's backup data from ransomware encryption attacks; The step 1 comprises: Install the ransomware protection program and set the operation-related parameters for the ransomware protection program. The ransomware protection program has built-in support for all hard disk models and their corresponding total number of sectors in the ATA protocol specification, and automatically adapts to the hard disk model identified by the operating system; the operation-related parameters include physical disk, automatic synchronization source directory, data synchronization rules, and synchronization start time; The ransomware defense program automatically divides the first N logical sectors of the physical hard disk into a monitoring partition, and writes bait files of different data formats into the monitoring partition; the logical sector address N+10 and all sectors thereafter are divided into the HPA partition, where the logical sector address N+10 is the HPA partition DBR address; and the key partition identification code, starting address code, and partition sector total number code of the HPA partition master boot record are stored in sectors N-2 and N+8, and finally the HPA instruction sets the addressing sector number to N; in normal use, only the monitoring area can be accessed; The step 2 comprises: Step 21: When the user accesses the HPA partition or the ransomware protection program automatically synchronizes data, the ransomware protection program will automatically detect all bait files in the monitoring partition; Step 22: After the detection passes, if it is an MBR partition, the ransomware protection program reads the key code in sector N-2 and writes it into the preset offset address of the master boot sector, and sends the HPA command through the ATA protocol to set the addressable sector number to the total number of sectors of the physical hard disk; Step 23: The ransomware protection program sends a soft reset command to the physical hard disk through the ATA protocol, then automatically uninstalls the physical hard disk from the operating system, and finally automatically scans the hardware to reload the physical hard disk driver. At this time, the physical hard disk will be re-addressed and the physical hard disk will enter a state where the HPA partition can be accessed. At this time, the automatic synchronization function of the user or the ransomware protection program can access the HPA partition and perform data backup; The step 21 comprises: When a user accesses the HPA partition or the ransomware defense program automatically synchronizes data, the ransomware defense program will automatically detect whether the file names of all bait files in the monitored partition are consistent with the ransomware defense program template library, whether the file lengths are consistent with the ransomware defense program template library, whether the M-binary codes of all bait files are consistent with the ransomware defense program template library of all bait files, and whether the number of files is the total number of files of all bait files; M and N are positive integers.

2. The method according to claim 1, characterized in that After user access or automatic synchronization of the ransomware protection program is completed, the ransomware protection program clears the code in the preset offset address of the master boot sector and sends the HPA command through the ATA protocol to set the addressable sector number to N+10.

3. The method according to claim 1, characterized in that The ransomware defense program sends a soft reset command to the physical hard disk through the ATA protocol, then automatically unloads the physical hard disk from the operating system, and finally automatically scans the hardware to reload the physical hard disk driver. At this time, the physical hard disk will be re-addressed and restored to a state where only the monitoring partition can be accessed.

4. The method according to claim 1, characterized in that The step 3 comprises: When a ransomware encryption attack occurs, you need to complete virus detection on the local machine to confirm that there is no virus process in the computer or migrate the physical hard disk to a safe isolated network computer before you can install and run the ransomware protection program; Use the ransomware data extraction function of the ransomware protection program to format the monitoring partition and write the bait file. The timer starts after the writing is completed. After the timing is completed, the ransomware defense program will detect whether the file names of all bait files in the monitored partition are consistent with the ransomware defense program template library, whether the file lengths are consistent with the ransomware defense program template library, whether the M-binary codes of all files are consistent with the ransomware defense program template library, and whether the number of files is the total number of files of all bait files.

5. The method according to claim 3, characterized in that: If the system fails to pass the ransomware protection program detection, go back and reconfirm whether the virus has been completely detected before installing and running the ransomware protection program.

6. The method according to claim 4 or 5, characterized in that: After the detection passes, the ransomware defense program reads the key code in sector N-2, writes it into the preset offset address of the master boot sector, and sends the HPA command through the ATA protocol to set the addressable sector number to the total number of sectors of the physical hard disk. If the attacked computer is powered on for more than the preset time, most ransomware viruses will clear the idle sectors after encrypting the physical hard disk data to prevent users from extracting data through data recovery methods. At this time, the ransomware defense program cannot read the key code in sector N-2. The ransomware defense program sends the HPA command through the ATA protocol to set the addressable sector number to the total number of sectors of the physical hard disk, and then reads the key code in sector N+10 and writes it into the preset offset address of the master boot sector.

7. The method according to claim 6, characterized in that After the key code in sector N+10 is read again and written into the preset offset address of the master boot sector, the method further includes: The ransomware defense program sends a soft reset command to the physical hard disk through the ATA protocol, then automatically unloads the physical hard disk from the operating system, and finally automatically scans the hardware to reload the physical hard disk driver. At this time, the physical hard disk will be re-addressed and the physical hard disk will enter a state where the HPA partition can be accessed. The user can extract the backed-up data in the HPA partition so that the user can resume normal work.

Images