A method for preventing hard disk from being maliciously erased based on terminal instructions

Abstract

The present invention discloses a method for preventing a hard disk from being maliciously erased based on a terminal instruction, comprising: installing control software in an operating system, installing a hardware card on a mainboard, the hardware card comprising a main control chip and a TTL chip; the control software establishes a connection with a disk through the main control chip and the TTL chip in turn; when the main control chip detects an attack, it immediately calls the TTL chip to send a terminal online command to the hard disk, and after the hard disk receives the terminal online command, it is forced to enter a T-level state, the magnetic head returns to the start-stop zone, and the hard disk is offline from the operating system, and no reading or writing work can be performed, so as to prevent the hard disk from being maliciously erased. The present invention utilizes the terminal online command of the hard disk, which belongs to the normal scheduling of the hard disk's own firmware level, and the magnetic head automatically returns to the start-stop zone, which will not cause damage to the hard disk and the data stored in the hard disk, and can effectively prevent the hard disk from being maliciously erased.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for preventing a hard disk from being maliciously erased based on terminal instructions. Background Art

[0002] More and more important data is recorded on storage media. Once traditional network security protection strategies encounter situations similar to the EternalBlue vulnerability that escalates privileges and implants viruses to erase the hard disk or maliciously erase the hard disk, the key processes of the relevant antivirus and security protection software will be closed immediately. There is no way to warn of malicious hard disk erasure and no effective blocking method, which cannot meet data security needs. Summary of the invention

[0003] In view of this, the present invention provides a method for preventing a hard disk from being maliciously erased based on terminal instructions.

[0004] The present invention discloses a method for preventing a hard disk from being maliciously erased based on terminal instructions, which comprises:

[0005] The control software is installed in the operating system, and the hardware card is installed on the mainboard. The hardware card includes a main control chip and a TTL chip. The control software establishes a connection with the disk through the main control chip and the TTL chip in turn. When the main control chip detects an attack, it immediately calls the TTL chip to send a terminal online command to the hard disk. After the hard disk receives the terminal online command, it is forced to enter the T-level state, the magnetic head returns to the start-stop area, and the hard disk is offline from the operating system, and no reading or writing operations can be performed to prevent the hard disk from being maliciously erased.

[0006] Furthermore, the control software automatically locates the file stored in the first cluster in the data area of ​​the hard disk partition, modifies and shifts it to other free clusters; and generates a monitoring file in DOC format in the first cluster. After that, the control software automatically extracts the key sectors of the file system in the hard disk according to the file system type and stores them in the storage chip of the hardware card, and automatically synchronizes the key sectors of the file system during subsequent use; the key sectors of the file system include MBR sectors, GPT sectors, FAT, MFT sectors, and directory table sectors; the storage chip is connected to the main control chip.

[0007] Furthermore, when the control software process is closed, the link between the control software and the hardware card is interrupted, the MBR sector and GPT sector are erased or tampered with; the DOC format monitoring file is cleared or tampered with, then the main control chip of the hardware card automatically calls the TTL chip to send the terminal online command, so that the hard disk enters the T-level state to protect the data in the hard disk from further erasure and tampering.

[0008] Furthermore, after the hacker intrusion or virus attack is completed, most non-system critical processes will be terminated immediately to facilitate subsequent attacks; the main control chip of the hardware card monitors in real time and shakes hands with the control software API. Once it is found that the control program is attacked by hackers or viruses, the control software process is terminated, the API handshake is interrupted, and the main control chip immediately calls the TTL chip to send the terminal online command. The hard disk immediately enters the T-level state and cannot perform any reading and writing work. At the same time, the magnetic head automatically enters the start-stop area. The firmware must be reloaded after the hard disk is powered on and off, and the hard disk can work normally.

[0009] Furthermore, the control software monitors the operating system cache write pages. When a large number of write pages are found, the control software will automatically read the first cluster of DOC format monitoring files in the data area; if it is found that the file name of the DOC format monitoring file has been tampered with, the file has been deleted, or the first N bytes of the file header do not conform to the preset template and the key identification codes of other DOC format monitoring files have been tampered with, it means that the hard disk may be in a damaged state; the damaged state includes being attacked by a ransomware virus, maliciously deleting files, and maliciously encrypting files; N is a positive integer.

[0010] Furthermore, when the control software finds that the hard disk may be in a damaged state, it immediately sends a signal to the main control chip. The main control chip immediately calls the TTL chip to send a terminal online command to the disk. The hard disk immediately enters the T-level state and cannot perform any reading and writing operations. At the same time, the magnetic head automatically enters the start-stop area. The firmware must be reloaded after the hard disk is powered on and off, and the hard disk can work normally.

[0011] Furthermore, the control software monitors the operating system cache write pages. When a large number of write pages are found, the control software will automatically read the critical sectors. For the attack method of the KILLDISK program, the operating system API is written, and it is written from the beginning to the end according to the system and hard disk scheduling. The MBR table located in sector 0 is an erased sector. The control software only needs to monitor whether some bytes of the MBR table are specified values ​​to preliminarily determine whether the hard disk has been maliciously erased. Similarly, other critical sectors are also determined by monitoring whether the key code matches the standard template. Critical sectors include MBR sectors and DBR sectors.

[0012] Furthermore, when the control software finds that the hard disk may have been maliciously erased, it immediately sends a signal to the main control chip. The main control chip immediately calls the TTL chip to send a terminal online command to the disk. The hard disk immediately enters the T-level state and cannot perform any reading and writing operations. At the same time, the magnetic head automatically enters the start-stop area. The firmware must be reloaded after the hard disk is powered on and off, and the hard disk can work normally.

[0013] Furthermore, the computer is turned off, the attacked hard disk is disassembled, and all sectors of the attacked hard disk are mirrored to another hard disk using a disk mirroring tool; the mirrored hard disk, control software, and hardware card are installed in a safe and non-toxic isolated network computer.

[0014] Furthermore, the control software automatically scans the key sectors of the mirror disk and compares them with the key sectors automatically synchronized in the storage chip of the hardware card. When tampered or erased sectors are found, the control software automatically calls the data in the storage chip of the hardware card to write to the corresponding offset address to repair and restore the data.

[0015] Due to the adoption of the above technical scheme, the present invention has the following advantages: the present invention utilizes the terminal online command of the hard disk, which belongs to the normal scheduling of the firmware level of the hard disk itself. After execution, the magnetic head will automatically return to the start-stop area, so it will not cause damage to the hard disk and the data stored in the hard disk; it avoids the dilemma that once the traditional network protection scheme is broken through through security loopholes, social engineering and other methods, it cannot be monitored and there is no blocking method. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0017] Figure 1 This is a schematic diagram of a hard disk sending a terminal online command to enter a T-level state according to an embodiment of the present invention;

[0018] Figure 2 The control software and hardware card principle diagram of the embodiment of the present invention;

[0019] Figure 3 The present invention is a flowchart of a method for preventing a hard disk from being maliciously erased based on terminal instructions according to an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The present invention is further described in conjunction with the accompanying drawings and embodiments, and the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field should fall within the scope of protection of the embodiments of the present invention.

[0021] The present invention provides an embodiment of a method for preventing a hard disk from being maliciously erased based on a terminal instruction, which comprises:

[0022] See also Figure 1For mechanical hard disks, a terminal online command is sent to the hard disk through the TTL (transistor logic level) protocol. After the hard disk RX and TX ports receive the terminal online command, no matter whether the hard disk is reading or writing, it will be forced to enter the T-level state, the head will return to the start-stop area, and the hard disk will be offline from the operating system, and no reading or writing work can be performed. Based on this, the PCI-E (high-speed serial computer expansion bus standard) hardware control card and WINDOWS operating system control software are developed. The hardware control card is mainly composed of a TTL protocol chip, a main control chip, and a storage chip. It establishes real-time monitoring and protection logic with the control software. The hardware card RX port is connected to the hard disk TX port, and the hardware card TX port is connected to the hard disk RX port. Once illegal writing is detected, the main control chip immediately calls the TTL chip to send a terminal online command to the hard disk, causing the hard disk to enter the T-level state, such as Figure 2 shown.

[0023] This embodiment requires the installation of control software in the operating system, the installation of hardware card on the mainboard, and the RX and TX ports of the hardware card are connected to the TX and RX ports of the hard disk respectively. After the installation is completed, the control software will automatically locate the files stored in the first cluster of the data area in the hard disk partition, and modify and shift them to other free clusters. And generate a 32KB "monitoring.DOC" file in cluster 1. After that, the control software will automatically extract the key MBR (master boot record) sector, GPT (globally unique identifier partition table) sector, FAT (file configuration table), MFT (master directory table) sector, directory table sector and other key sectors of the file system in the hard disk according to the file system type and store them in the storage chip of the hardware card, and automatically synchronize the key sectors during subsequent use. When it is found that the control software process is closed, the link between the control software and the hardware card is interrupted; the MBR and GPT key sectors are erased or tampered; the "monitoring.DOC" file is cleared or tampered, the hardware card main control chip automatically calls the TTL chip to send the terminal online command, so that the hard disk enters the T-level state to protect the data in the hard disk from being further erased and tampered.

[0024] In an optional embodiment, see Figure 3 , the specific steps are as follows:

[0025] S1: Install the control software on the operating system; install the hardware card on the mainboard and connect it to the hard disk RX and TX ports.

[0026] S2: The control software accesses the hard disk partition, automatically shifts the original data area cluster 1 file to other free sectors through the file system, and writes a 32KB "monitoring.DOC" bait file in cluster 1 of the data area.

[0027] S3: The control software automatically reads the key sectors of the file system MBR partition table, GPT partition table, DBR boot sector table, FAT table, MFT table, directory table, etc. and stores them in the storage chip, and automatically synchronizes the sectors that conform to the standard template code during daily use. Among them, the MBR partition table, GPT partition table, and DBR boot sector table basically do not change in daily work. The FAT table, MFT table, directory table, and other table items related to file management will change when writing new files or changing storage directories, etc., and require automatic synchronization by the control software. However, the size of such management tables is usually within 10MB, so the automatic synchronization function of this method has almost no effect on the read and write performance of the hard disk.

[0028] S4: After the hacker intrusion or virus attack is completed, most non-system critical processes will be terminated immediately to facilitate subsequent attacks.

[0029] S5: The hardware card main control chip monitors the handshake with the control software API (application programming interface) in real time. Once it finds that the control program is attacked by hackers or viruses and the control software process is terminated, or the API handshake is interrupted, the main control chip immediately calls the TTL chip to send the terminal online command. The hard disk immediately enters the T-level state and cannot perform any reading and writing operations. At the same time, the magnetic head automatically enters the start-stop area. The firmware must be reloaded after the hard disk is powered on and off, and the hard disk can work normally.

[0030] S6: The control software monitors the operating system cache write pages. When a large number of write pages are found, the control software will automatically read the "Monitor.DOC" file in cluster 1 of the data area. If it is found that the "Monitor.DOC" file name has been tampered with, the file has been deleted, or the file header 0x00 to 0x02 bytes do not conform to the standard D0CF11 template, and other "Monitor.DOC" file key identification codes have been tampered with, it means that the hard disk may be under ransomware attack, malicious file deletion, malicious file encryption, etc.

[0031] S7: After the control program discovers these behaviors, it immediately sends a signal to the main control chip. The main control chip immediately calls the TTL chip to send a terminal online command. The hard disk immediately enters the T-level state and cannot perform any reading or writing operations. At the same time, the magnetic head automatically enters the start-stop area. The firmware must be reloaded after the hard disk is powered off and powered on, and the hard disk can work normally.

[0032] S8: The control software monitors the operating system cache write pages. When a large number of write pages are found, the control software will automatically read the key sectors such as MBR and DBR. For example, in the attack method such as KILLDISK program, the program calls the operating system API for writing, so it is impossible to call the head to write in reverse through the firmware, and it can only be written from the beginning to the end according to the system and hard disk scheduling. Therefore, under normal circumstances, the MBR table located in sector 0 is an erased sector. The control software only needs to monitor whether the bytes 0x511 and 0x512 of the MBR table are 55AA to preliminarily determine whether the hard disk has been maliciously erased. Similarly, other key sectors are also determined by monitoring whether the key code matches the standard template.

[0033] S9: When the control program finds that the hard disk may be maliciously erased, it immediately sends a signal to the main control chip. The main control chip immediately calls the TTL chip to send a terminal online command. The hard disk immediately enters the T-level state and cannot perform any reading and writing operations. At the same time, the magnetic head automatically enters the start-stop area. The firmware must be reloaded after the hard disk is powered on and off, and the hard disk can work normally.

[0034] S10: Turn off the computer, disassemble the attacked hard disk, and use the disk imaging tool to image all sectors of the attacked hard disk to another hard disk.

[0035] S11: Install the mirrored hard disk, control software, and hardware card into a safe and virus-free isolated network computer.

[0036] S12: The control software automatically scans the key sectors of the mirror disk and compares them with the key sectors automatically synchronized in the hardware card storage chip. If a tampered or erased sector is found, the control software automatically calls the data in the storage chip to write to the corresponding offset address to repair and restore the data.

[0037] The present invention utilizes the terminal online command of the hard disk, which belongs to the normal scheduling of the hard disk's own firmware level. After execution, the magnetic head will automatically return to the start-stop area, so it will not cause damage to the hard disk and the data stored in the hard disk. It avoids the dilemma that once the traditional network protection solution is broken through by security loopholes, social engineering and other methods, it cannot be monitored and there is no blocking method.

[0038] Since the core technology of the present invention is based on the normal scheduling of the hard disk's own firmware, the operating system applicable to the present invention is not limited to the WINDOWS operating system, and other operating systems such as Linux, Ubuntu, Kylin, and Tongxin can also be used.

[0039] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for preventing a hard disk from being maliciously erased based on terminal instructions, characterized in that: include: Install control software in the operating system, install hardware card on the mainboard, the hardware card includes main control chip and TTL chip; the control software establishes connection with the disk through main control chip and TTL chip in turn; when the main control chip detects attack behavior, it immediately calls TTL chip to send terminal online command to the hard disk, after the hard disk receives the terminal online command, it is forced to enter T level state, the magnetic head returns to the start-stop zone, and the hard disk is offline from the operating system, unable to perform any reading and writing work, so as to prevent the hard disk from being maliciously erased; The control software automatically locates the files stored in the first cluster in the data area of ​​the hard disk partition, modifies and shifts them to other free clusters; and generates a monitoring file in the first cluster in the DOC format. After that, the control software automatically extracts the key sectors of the file system in the hard disk according to the file system type and stores them in the storage chip of the hardware card, and automatically synchronizes the key sectors of the file system during subsequent use; the key sectors of the file system include MBR sectors, GPT sectors, FAT, MFT sectors, and directory table sectors; the storage chip is connected to the main control chip; The control software monitors the operating system cache write pages. When a large number of write pages are found, the control software will automatically read the first cluster of DOC format monitoring files in the data area; If it is found that the file name of the DOC format monitoring file has been tampered with, the file has been deleted, or the first N bytes of the file header do not conform to the preset template, and the key identification code of other DOC format monitoring files has been tampered with, it means that the hard disk may be in a damaged state; the damaged state includes being attacked by ransomware, maliciously deleting files, and maliciously encrypting files; N is a positive integer; The control software monitors the operating system cache write pages. When a large number of write pages are found, the control software will automatically read the critical sectors. For the attack method of the KILLDISK program, the operating system API is written, and it is written from the beginning to the end according to the system and hard disk scheduling. The MBR table located in sector 0 is an erased sector. The control software only needs to monitor whether some bytes of the MBR table are the specified values ​​to preliminarily determine whether the hard disk has been maliciously erased. Similarly, other critical sectors are also determined by monitoring whether the key code matches the standard template. Critical sectors include MBR sectors and DBR sectors.

2. The method for preventing a hard disk from being maliciously erased based on terminal instructions according to claim 1, characterized in that: When the control software process is closed, the link between the control software and the hardware card is interrupted, the MBR sector and GPT sector are erased or tampered with; the monitoring file in DOC format is cleared or tampered with, and the main control chip of the hardware card automatically calls the TTL chip to send the terminal online command, so that the hard disk enters the T-level state to protect the data in the hard disk from being further erased and tampered with.

3. The method for preventing a hard disk from being maliciously erased based on terminal instructions according to claim 1, characterized in that: After the hacker intrusion or virus attack is completed, most non-system critical processes will be terminated immediately to facilitate subsequent attacks; the main control chip of the hardware card monitors in real time and shakes hands with the control software API. Once it finds that the control program is attacked by hackers or viruses, it terminates the control software process, and the API handshake interrupts the attack. The main control chip immediately calls the TTL chip to send the terminal online command, and the hard disk immediately enters the T-level state and cannot perform any reading and writing work. At the same time, the magnetic head automatically enters the start-stop area. The firmware must be reloaded after the hard disk is powered on and off, and the hard disk can work normally.

4. The method for preventing a hard disk from being maliciously erased based on terminal instructions according to claim 1, characterized in that: When the control software finds that the hard disk is in a damaged state, it immediately sends a signal to the main control chip. The main control chip immediately calls the TTL chip to send a terminal online command to the disk. The hard disk immediately enters the T-level state and cannot perform any reading and writing operations. At the same time, the magnetic head automatically enters the start-stop area. The firmware must be reloaded after the hard disk is powered on and off, and the hard disk can work normally.

5. The method for preventing a hard disk from being maliciously erased based on terminal instructions according to claim 1, characterized in that: When the control software finds that the hard disk may be maliciously erased, it immediately sends a signal to the main control chip. The main control chip immediately calls the TTL chip to send a terminal online command to the disk. The hard disk immediately enters the T-level state and cannot perform any reading and writing operations. At the same time, the magnetic head automatically enters the start-stop area. The firmware must be reloaded after the hard disk is powered on and off, and the hard disk can work normally.

6. The method for preventing a hard disk from being maliciously erased based on terminal instructions according to any one of claims 1 to 5, characterized in that: Shut down the computer, disassemble the attacked hard disk, and use the disk imaging tool to image all sectors of the attacked hard disk to another hard disk; install the imaged hard disk, control software, and hardware card to a safe and non-toxic isolated network computer.

7. The method for preventing a hard disk from being maliciously erased based on terminal instructions according to claim 6, characterized in that: The control software automatically scans the key sectors of the mirror disk and compares them with the key sectors automatically synchronized in the storage chip of the hardware card. When tampered or erased sectors are found, the control software automatically calls the data in the storage chip of the hardware card to write to the corresponding offset address to repair and restore the data.

Images