Computer data storage device with additional data recovery function and control method thereof

Abstract

A computer data storage device connected with a host computer through a host interface includes: a storage unit storing data and including a user area and a security area; a user input / output unit which receives input and associated information about a normal mode and a management mode, which are operating modes of the computer data storage device, from a user and displays the input and associated information; and the control unit is communicated with a host computer and is connected with the storage unit and the user input / output device to control the working mode. The control unit is configured to create recovery information for holding data stored in the user area when a host computer wants to change configuration or content information of the user area and store the recovery information in the secure area. For the user area, the host computer can freely change the configuration or content information of the file system, and for the security area, the host computer cannot change the configuration or content information of the file system but is readable in the normal mode. In the management mode, the host computer can change the configuration or content information of the file system.

Description

Technical Field

[0001] The present invention relates to a computer data storage device and file system management technology, and in particular, to a file system management technology. In using a data storage device having a storage space divided into a user area and a security area, when a user learns that the file system is damaged, the damaged file system can be restored without switching the computer to a recovery mode. Background Art

[0002] Generally speaking, a data storage device such as a solid state drive (SSD) or a hard disk drive (HDD) attached to a computer is regarded as a passive device from the perspective of the computer, and performs the work of accessing a specified sector or cluster according to a command received from the computer. However, the applicant has applied for inventions related to data storage devices (WO 2018 / 208032, WO 2018 / 212474, and WO 2019 / 00951), which give active functions to existing data storage devices to enable recovery when the file system of the computer is damaged due to ransomware or virus attacks. These prior application inventions relate to an auxiliary storage device including an original auxiliary storage device and a backup auxiliary storage device, the original auxiliary storage device can be accessed by the host computer at any time, but the backup auxiliary storage device is restricted to be accessible only under specific conditions (such as recovery mode). Therefore, safe backup and recovery can be achieved by using the prior application inventions.

[0003] In particular, the auxiliary storage device of WO 2018 / 212474 in the prior application invention includes another central processing unit (CPU) and a storage medium unit for protecting and monitoring the file system independently of the connected host computer. The storage medium unit includes: a user area (userarea) storing the operating system (OS) of the host computer and readable and writable by the computer, and a recovery area (recovery area) selectively storing a copy of the OS of the host computer and determining the read and write of the host computer according to the mode (normal mode, recovery mode) selected by the mode selection switch.

[0004] If the normal mode is selected by the mode selection switch, the recovery area completely blocks access to the host computer. Furthermore, in the case where the recovery mode is selected by the mode selection switch, if the host computer requests the OS in the user area at startup, a copy of the OS stored in the recovery area can be selectively provided to the host computer. Furthermore, in the case where the host computer changes the contents of the files or clusters in the user area in the normal mode, the information required to restore the existing files or clusters is stored in the recovery area, and the changed files are stored in the user area. In the recovery mode, the user restores the changed file system using the information required for restoration stored in the recovery area. Summary of the invention

[0005] Technical issues

[0006] In the prior invention of the present inventor, the operating mode needs to be changed to the recovery mode in order to restore the file system, so the configuration and process are somewhat complicated. Therefore, it is considered that if the damage of the file system can be restored without changing to the recovery mode, the user can respond quickly, which is of great significance.

[0007] Therefore, the present inventor proposes a computer data storage device that can restore damaged data or files without additional mode conversion.

[0008] Technical Solution

[0009] Looking at the aforementioned prior application invention, the information for recovery is stored in a recovery area inaccessible to the host computer OS in the storage medium unit, and then the recovery is performed using the information in the recovery area, and both the recovery operation and the deletion of the recovery area data can only be performed in the recovery mode. The reason why it is configured to be available only in the recovery mode is that if the recovery area is exposed to an environment outside the recovery mode, the recovery area may be damaged. On the other hand, in order to enter the recovery mode, some time-consuming processes must be experienced, such as restarting the host computer or confirming whether the host computer is infected.

[0010] Although this is a safe method, it is inconvenient because it takes a lot of time. In order to solve this problem, if a method is provided that can read the information of the recovery area for recovery work even in normal mode, it is possible to easily confirm the changes in the file system and perform recovery, which has a great advantage.

[0011] According to the above-mentioned prior application invention, the file system of the host computer is configured to include only the user area and the recovery area is not included in the file system of the host computer in the normal mode, so there is a problem of inaccessibility, which must be solved in order to implement the method of the present invention. To this end, the computer data storage device of the present invention is configured to have the recovery area of ​​the prior application invention or a security area different from the recovery area.

[0012] That is, the computer data storage device of the present invention includes a storage unit having a user area and a security area, and operates in a normal mode and a management mode. The configuration or content of the file system in the user area can always be changed by the host computer, including changing the attributes of file system objects such as partitions, folders, and files. The recovery information generated by the computer data storage device of the present invention to restore the user area is stored in the security area. The recovery information is included in the file system of the user area and displayed in the normal mode, but the host computer cannot change or delete it, and can only read it. The host computer can only change and delete it in the management mode.

[0013] The security area is different from the recovery area (or recovery area) of the prior invention. It is displayed in the file system of the host computer in normal mode. It cannot be written, deleted, or its attributes can be changed, but it can be read. Therefore, when the file system is damaged, the recovery program can use the recovery information provided by the security area to quickly perform the recovery operation of the file system. If the recovery program is stored in the security area, it can be more secure against attacks by malicious code. If the host computer attempts to change the attributes of the security area or attempts to delete or write in the normal mode, it will be rejected by the computer data storage device.

[0014] The security area can be generated by setting part of the space of the data storage device as the security area during manufacturing, or by setting part of the user area as the security area in the management mode. Alternatively, in the case where the prior application invention has a recovery area, a part of the recovery area can be designated as a security area that can be displayed and used in the management mode to generate the security area. In this case, the data storage device can be configured to have both a recovery mode (refer to the prior application invention) and a management mode.

[0015] On the other hand, when the host computer wants to delete or change the content of the storage device, the computer data storage device of the present invention creates recovery information for restoring the content and stores it in a secure area. In this case, since the recovery information is created by default each time the corresponding sector or cluster is changed, the user's files can be restored even if the ransomware or hacker deletes or encrypts them. The recovery information includes all changes to the file system, so the user can restore the file system to a desired time point in any case.

[0016] Furthermore, the computer data storage device of the present invention has the following functions: if the host computer deletes the configuration or content information (e.g., Master File Table (MFT), File Allocation Table (FAT), etc.) in order to delete the files or folders in the user area, the corresponding configuration or content information is analyzed and the files or folders according to the configuration or content information are generated in the security area. For example, if the host computer deletes the configuration or content information of the corresponding file when deleting the specific file spring.docx in the user area, the cluster constituting spring.docx is released from the occupied state, and the storage device of the present invention can also generate a backup file named spring_backup202204051230001.docx in the security area with reference to the configuration or content information before the occupied state is released, thereby providing recovery information that can be used immediately. Therefore, the user can read spring_backup202204051230001.docx and quickly and easily restore spring.docx without switching to the management mode when a problem occurs.

[0017] On the other hand, when the ransomware that has controlled the host computer deletes the file Spring.docx, it may attempt to determine the storage location of the file data in the configuration or content information after reading the configuration or content information of the corresponding file and directly overwrite the cluster. In this case, the storage device of the present invention creates the content of the corresponding cluster and other information required for recovery in the form of a file and generates it in a safe area, thereby providing the user with information for recovery.

[0018] If the mode of a computer data storage device is changed to management mode, the host computer (essentially, OS and applications) can freely use the secure area in this state, so recovery information may be deleted, so you should be careful. Generally speaking, most OS including Windows can change the attributes of file system objects such as folders and files to read-only, but this is ultimately under the control of the OS, and malicious code such as ransomware can change these attributes to delete or encrypt, so it is not safe.

[0019] Taking the method of generating a security zone as an example, there is a method in which a user generates a partition or folder with a preset name in the management mode to create a security zone. For example, if the manufacturer of the data storage device of the present invention is designed to identify a partition or folder generated with the name "RECOVERY" as a security zone, the user can generate the name of the partition or folder as "RECOVERY" to create a security zone. In this case, the data storage device of the present invention can create recovery information when the file system is changed and store it in the partition or folder named RECOVERY as the security zone.

[0020] Furthermore, the user can specify the size of the safe area and set the management method of the recovery information in the management mode. As an example of the management method of the recovery information, the management method can be set to notify the user and request management of the safe area when there is no spare space in the safe area due to the accumulation of recovery information. As another example of the management method of the recovery information, the management method can also be set to manage the safe area in a way that does not set a limit on the size of the safe area and deletes the stored recovery information after a certain period of time.

[0021] On the other hand, the generation and management process of the security zone can be executed by the user running the management program. For example, when a user purchases the computer data storage device of the present invention and runs the management program on the host computer, the user receives a guide to change the use mode to the management mode. When the user switches to the management mode and inputs the location, name, size, etc. of the security zone, the security zone is created. In this case, the recovery program can be stored in the security zone. Afterwards, when the user changes the mode to the normal mode, the computer data storage device creates recovery information and stores it in the security zone each time the configuration or content of the user zone changes. Although it has been mentioned in the foregoing, the attributes and content of the security zone cannot be changed by the host computer in the normal mode but can only be read, and can only be changed and deleted by the host computer in the management mode.

[0022] The computer data storage device of the present invention embodies the above-mentioned concept in order to solve the above-mentioned technical problems. The device is composed of: a host interface for communicating with a host computer; a storage unit divided into a user area and a security area for storing data; a user input and output unit for receiving input and related information about the working mode of the computer data storage device, that is, the normal mode and the management mode from the user and displaying it; and a control unit connected to the host interface, the storage unit and the user input and output unit to control the working mode;

[0023] For the user area of ​​the storage unit, the host computer can always change the configuration or content, including changing the attributes of file system objects such as partitions, folders, and files;

[0024] For the security area of ​​the storage unit, the computer data storage device creates and stores recovery information for restoring the user area. The security area is included in the file system of the user area and displayed in normal mode, but cannot be changed or deleted by the host computer and can only be read. It can only be changed and deleted in management mode.

[0025] In this case, the working mode of the computer data storage device can be determined according to the data value received through the communication between the host computer and the host interface in addition to using the user input and output unit, and the working status can be displayed by the user input and output unit.

[0026] In this case, the recovery information may be that when the host computer deletes the configuration or content information in order to delete the files or folders in the user area, the computer data storage device of the present invention analyzes the corresponding configuration or content information and generates files or folders in the secure area based on the configuration or content information.

[0027] The above-mentioned specific features and other features of the present invention will become more apparent through the following specific embodiments described with reference to the accompanying drawings.

[0028] Effects of the Invention

[0029] The data storage device of the present invention creates recovery information and stores it in a secure area when the host computer wants to delete or change the stored content. In this case, the recovery information can be created each time the corresponding sector or cluster is changed, so the file system can be restored even if the ransomware or hacker deletes and encrypts the user's files. Moreover, since the recovery information includes all changes to the file system, the user can restore the file system to a desired time point in any case. Moreover, unlike the prior invention, which can only read the recovery information stored in the recovery area in the recovery mode, in the computer storage device of the present invention, the recovery information stored in the secure area can be read even in the normal mode. Therefore, the user can quickly restore the damaged file system even if he does not switch to the recovery mode. Being able to view the recovery information in the normal mode is a major advantage, and the user can use the recovery information to immediately restore the damaged file system.

[0030] Furthermore, when the host computer deletes the configuration or content information of files or folders in the user area, the configuration or content information is analyzed and a transfer file or folder is generated in the safe area according to the configuration or content information, so that the user can quickly restore the files or folders when a problem occurs. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 is a diagram showing the structure of a computer data storage device according to an embodiment of the present invention;

[0032] Figure 2A flowchart of a method for generating a safe area;

[0033] Figure 3 A flowchart of another method for generating a safe area;

[0034] Figure 4a to Figure 4e The following is a sample diagram of a file system used to illustrate the working and recovery processes in normal mode. DETAILED DESCRIPTION

[0035] The preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings. The terms used in the following description are used to describe the preferred embodiments of the present invention, and the purpose is not to limit the present invention. In this specification, the singular includes the plural, unless otherwise specified. Moreover, the terms "comprise, comprising, etc." used in this specification are used as the meaning that one or more other constituent elements, steps, actions and / or elements other than the mentioned constituent elements, steps, actions and / or elements are not excluded and are additional.

[0036] See also Figure 1 , the computer data storage device 10 according to the embodiment of the present invention comprises: a host interface 100 for communicating with a host computer 20; a data storage unit 200, whose area is divided into a user area 201 and a security area 202; a user input and output unit 300, which receives input and associated information about the working mode of the data storage device 10, that is, the normal mode and the management mode from the user and displays it; and a control unit 400, which is connected to the host interface 100, the storage unit 200, and the user input and output unit 300 to control the working mode of the computer data storage device 10. In this case, the input about the normal mode and the management mode can also be received through the host interface 100, although there are certain risks. On the other hand, the user input and output unit 300 includes an indicator 301 such as an LED for displaying the working mode and a mode switch 302 for selecting the working mode. Regarding the state of the indicator 301, for example, when it is green, it is the normal mode, and when it is red, it is the management mode.

[0037] As described above, the computer data storage device 10 according to the present invention includes a storage unit 200 having a user area 201 and a security area 202 and operates in a normal mode and a management mode. For the user area 201, the configuration or content of the file system can always be freely changed by the host computer, including changes to the attributes of file system objects such as partitions, folders, and files. For the security area 202, the computer data storage device 10 creates recovery information for restoring the user area 201 and stores it in the security area 202. The security area 202 and its content are included in the file system of the user area 201 and displayed in the normal mode, but the host computer cannot change or delete it and can only read it. The host computer can only change and delete it in the management mode.

[0038] That is, unlike the recovery area of ​​the prior invention, the secure area 202 is displayed in the computer's file system in normal mode, and cannot be written, deleted, or changed in attributes, but can be read. Therefore, when the file system is damaged, the recovery program can use the recovery information provided by the secure area 202 to quickly perform the file system recovery operation. If the recovery program is stored in the secure area 202, it can be more secure against attacks from malicious code. In normal mode, the computer data storage device 10 rejects attempts to change the attributes of the secure area 202 or to delete or write.

[0039] The following describes in detail the method for creating the security zone 202. The security zone 202 can be created by various methods. In one embodiment, the security zone 202 can be created by running a management program on the host computer 20.

[0040] As an example, see Figure 2 After the user connects the computer data storage device 10 of the present invention to the host computer 20, the user runs the management program provided in the host computer. When the management program of the host computer 20 is running, it guides the user to use the mode switch 302 or receive a password and transmit it through the host interface 100 in order to convert the mode of the computer data storage device 10 to the management mode.

[0041] When the user selects the management mode using the mode switch 302 of the user input and output unit 300, a conversion signal for conversion to the management mode is input to the control unit 400 of the data storage device 10. After receiving the conversion signal, the control unit 400 converts the mode to the management mode and changes the indicator 301 of the user input and output unit 300 to red. The management program of the host computer 20 receives the change to the management mode through the computer data storage device 10 and the host interface 100.

[0042] As another example, see Figure 3, the management program guides the user to use the mode switch 302 or enter a password in order to convert the mode of the computer data storage device 10 to the management mode. If the user enters the password, the management program of the host computer 20 transmits the password to the control unit 400 of the data storage device 10 through the host interface 100, and the control unit 400 can compare it with the preset password to enter the management mode. The setting and management of passwords can be easily achieved according to the common processes in general computer equipment. However, when using a password, although it is easy to confirm that the management mode has been entered, it may become an attack path for malicious code, so it should be noted.

[0043] Next, see Figure 2 and Figure 3 When the management program of the host computer 20 requests the status information of the computer data storage device 10 through the host interface 100 and waits, the computer data storage device 10 provides the profile information including its own manufacturing number, system software version, current working mode, information of the user area 201, and information of the security area 202. The management program receives this information to confirm that the computer data storage device has entered the management mode.

[0044] Before changing to the management mode, the user must confirm whether there is malicious code. Because malicious code can read the information of the computer data storage device 10 or change or delete the content of the security area 202, it should be noted.

[0045] Then, in the state of management mode, the management program of the host computer 20 guides the user to set the attributes of the secure area 202, etc. For example, the user is guided to determine the name of the secure area 202. In one embodiment, the user can assume that the secure area 202 is set in the top folder of the primary partition and named MY_RECOVERY_DATA. In addition, the user can set the size of the secure area 202 and the management method of the recovery information. For example, the size of the secure area 202 can be set to 100 GB, and the configuration or content of the user area 201 is prohibited from being changed when there is no spare space due to the continuous accumulation of recovery information in the secure area 202, and a notification is issued to the user to request the management of the secure area 202. Among them, the indicator 301 can be used as a method of notifying the user of the management request of the secure area 202. For example, the indicator 301 can be changed from green to green flashing to guide the user to delete the old recovery information because there is no spare space in the secure area 202. As another example of setting the management method of the secure area, it can be set to delete the recovery information after a certain period of time when the recovery information stored in the secure area 202 increases to a certain level or more. For example, the user can set the recovery information up to 48 hours ago to be deleted in order of age when the free space of the security area 202 reaches less than 5%. However, it is preferred that the recovery information is managed in this case by the host computer 20 notifying the user and deleting after receiving confirmation.

[0046] The security area setting information set by the user is transmitted from the host computer 20 to the computer data storage device 10 through the host interface 100. At this time, a security area has been created in the computer data storage device 10. According to the situation, if the security area 202 has been created, a recovery program can be stored therein.

[0047] When the user finishes the settings and wants to terminate the management program, he sends a termination command to the host computer 20. In response, the management program guides the user to change the working mode to the normal mode. The user uses the mode switch 302 ( Figure 2 ) or through the hypervisor ( Figure 3 ) is changed to normal mode, then whenever the configuration or content of the user area 201 is changed, the computer data storage device 10 performs the operation of creating recovery information and storing it in the secure area 202 (for example, the MY_RECOVERY_DATA folder). In normal mode, the properties and content of the secure area cannot be changed by the host computer and can only be read.

[0048] The following Figures 4a to 4e The specific examples in the following section will explain the working and recovery processes in normal mode.

[0049] The user area 201 is initially Figure 4aA file system having two folders, data and system, is created as a user creates a folder named MY_RECOVERY_DATA in the security area 202, such as Figure 4b There is a file system that also includes a secure area MY_RECOVERY_DATA folder. At this point, the MY_RECOVERY_DATA folder is empty.

[0050] Now, suppose the user creates a new document book.docx using MS-WORD and stores it in the top-level data folder. Then, the file system of the host computer is as follows: Figure 4c Change to a form including book.docx. At this time, it is assumed that book.docx is stored in clusters 01 to 04 of the storage unit 200 of the computer data storage device 10. Next, consider the following situation: the ransomware Lockbit invades, reads the file information of book.docx (such as FAT, MFT) to create an encrypted file book.lockbit, knows that book.docx is stored between clusters 01 to 04, and deletes the configuration or content (composition) information by overwriting the corresponding cluster. In this case, when the control unit 400 receives an overwrite job request, it creates an access record (access record) containing the content and associated information of the corresponding clusters 01 to 04 before the job and stores it in the MY_RECOVERY_DATA folder which is a secure area. At this time, since the content of the cluster storing the configuration or content information has changed, this is also stored in the form of an access record. As a result, the file system (such as MFT, FAT, etc.) is changed to the following: Figure 4d and 4e As shown. Figure 4d You can see that book.docx has been deleted and book.lockbit has been generated. Figure 4e You can see that 5 access records are generated in the MY_RECOVERY_DATA folder as recovery information. At this point, the computer data storage device can be used Figure 4e The access record of the host computer or when the configuration or content information is deleted, it can be used to generate recovery information in the form of a backup file such as book_backup202204051230001.docx that can be used immediately. In addition to the access record, the recovery information can also include information about the association between access records (which objects are constituted on the file system).

[0051] Figure 4eThe first few digits AR202202111722 in the access record file name indicate that it is an access record (AR) generated at 17:22 on February 11, 2022. The last few digits indicate the serial number. The ones starting with C indicate the content and associated information of clusters 01 to 04, and the ones starting with T indicate the content and associated information of clusters containing file system configuration or content information including MFT. The associated information may include information indicating the correlation of multiple clusters. That is, it may include information that clusters 01 to 04 form a file book.docx, for example, information that these five access records form a file book.docx.

[0052] Even if the ransomware Lockbit attempts to delete the contents of the MY_RECOVERY_DATA folder, since the contents are located in the secure area 202, changes to the attributes and contents are prohibited, so the recovery information including the access records is safe. In addition, since the recovery information is continuously generated due to the ransomware Lockbit, when the set 100GB capacity is filled, the control unit 400 no longer responds to the request of the host computer but requests user confirmation, so the recovery information is always safe.

[0053] The recovery process is described in detail below. When the user finds that he is infected with ransomware, the user runs a ransomware removal program to delete the ransomware and performs a recovery process on the host computer 20. At this time, there is no need to switch to the management mode in order to perform the recovery process, and the user runs the recovery program in normal mode. The information required for recovery is stored in the MY_RECOVERY_DATA folder as a safe area, so it can be easily restored. That is, in the above example, book.docx is actually deleted by the ransomware, but because there is an access record as recovery information, book.docx can be restored afterwards.

[0054] The above describes the embodiments for realizing the concept of the present invention. However, the technical scope of the present invention is not limited to the embodiments and drawings described above, but is determined by reasonable interpretation of the scope of the claims.

Claims

1. A computer data storage device connected to a host computer to store data, characterized in that: include: A host interface for communicating with the host computer; A storage unit, including a user area and a security area; A user input and output unit receives input and associated information about the working mode of the computer data storage device, i.e., the normal mode and the management mode, from the user and displays the input; as well as A control unit connected to the host interface, the storage unit and the user input and output device to control the working mode, The control unit is configured to create recovery information for saving data stored in the user area and store it in the secure area when the host computer intends to change the configuration or content of the user area, For the user area, the host computer can freely change the configuration or content. For the security area, the host computer cannot change the configuration or content in normal mode but can read it. In management mode, the host computer can change the configuration or content.

2. The computer data storage device according to claim 1, characterized in that When the file system stored in the secure area is damaged, a recovery program is used to perform a recovery operation of the file system using the recovery information of the secure area.

3. The computer data storage device according to claim 1, wherein the control unit further has the following functions: When the host computer deletes information related to configuration or content in order to delete a file or folder in the user area, the host computer analyzes the information related to the configuration or content and generates the file or folder in the secure area.

4. The computer data storage device according to claim 1, characterized in that The secure area is displayed as part of the user area in the normal mode, and configuration or content change requests from the host computer are rejected.

5. The computer data storage device according to claim 1, characterized in that The size of the security area and the management method of the restoration information stored in the security area are set in the management mode.

6. The computer data storage device according to claim 5, characterized in that The recovery information management method is configured to notify the user when the security area has no spare space due to the accumulation of recovery information.

7. The computer data storage device according to claim 5, characterized in that The restoration information management mode is configured to delete restoration information stored in the security area after a preset time.

8. A computer data storage device control method, comprising: A host interface for communicating with a host computer; a storage unit including a user area and a security area; and a user input and output unit, which receives input and associated information about the working mode, i.e., the normal mode and the management mode, from the user and displays it, wherein the computer data storage device control method comprises: When the host computer intends to change the configuration or content of the user area, it creates recovery information for saving the data stored in the user area and stores it in the secure area. When the configuration or content of the user area is changed, it uses the recovery information of the secure area to perform a recovery operation of the user area. For the user area, the host computer can freely change the configuration or content. For the security area, in normal mode, the host computer cannot change the configuration or content but can read it. In management mode, the host computer can change the configuration or content.

9. The computer data storage device control method according to claim 8, further comprising: When the host computer deletes information related to configuration or content in order to delete a file or folder in the user area, the host computer analyzes the information related to the configuration or content and generates the file or folder in the secure area.

10. The computer data storage device control method according to claim 8, further comprising: In the management mode, the security area is designated as a part of the user area.

11. The computer data storage device control method according to claim 8, further comprising: In the management mode, the security area is generated as a partition or a folder displayed in the user area.

12. The computer data storage device control method according to claim 8, further comprising: In the management mode, the size of the security area and the recovery information management method are set.

13. The computer data storage device control method according to claim 12, wherein the recovery information management method comprises: When the secure area has no spare space due to the accumulation of restoration information, the user is notified to request management of the secure area.

14. The computer data storage device control method according to claim 12, wherein the recovery information management method comprises: The restoration information stored in the security area after a preset time is deleted.

Images