Method for resisting encryption ransomware attack, solid state disk, electronic equipment and storage medium

Abstract

The invention discloses a method for resisting encryption ransomware attacks, a solid state disk, electronic equipment and a storage medium, and relates to the technical field of data storage and data security, and the method comprises the following steps: adding a special flash translation layer used for managing a mapping relationship between a logic address and a physical address to be recycled in an SSD (Solid State Disk), a conventional flash memory conversion layer used for managing the mapping relation between the logic address and the physical address is followed; configuring a real-time clock chip in the SSD to generate an RTC timestamp of a physical address, and responding to an operation command from a host based on a special flash translation layer, a conventional flash translation layer and a real-time clock; a set of confrontation strategy and implementation technical scheme is provided on SSD hardware to support production of highly-safe SSD equipment, and all encrypted ransomware attacks can be recognized and defended in advance; meanwhile, virus infection of other computers and illegal tampering of programs by privileges in the user can be prevented, and the safety of data and executable programs stored in the SSD can be protected to the utmost extent.

Description

Technical Field

[0001] The present invention relates to the technical field of data storage and data security, and more specifically, to a method for resisting encryption ransomware attacks, a solid-state hard drive, an electronic device and a storage medium. Background Art

[0002] Crypto-ransomware attacks, also known as crypto-ransomware, are a special type of malware that uses various encryption algorithms to encrypt user files and requires victims to pay a ransom to obtain the decryption key. This cryptographic-based attack is extremely harmful, and many vicious cases have occurred around the world, causing huge economic losses and even social disorder.

[0003] Currently, most of the defenses against encryption ransomware attacks are based on dynamic detection technology of file activities, but this dynamic behavior detection technology has a lag, causing some files to be encrypted before identification. In addition, file activity detection based on the operating system kernel is difficult to defend against encryption ransomware attacks with administrator privileges.

[0004] Using the hardware characteristics of solid-state drives (SSDs) to achieve hardware-level defense has gradually attracted the attention of researchers. SSDs naturally have a "page update" mechanism. The encrypted data generated by encryption ransomware attacks are written to new free physical pages, while the original data remains intact in the short term as "invalid" physical pages to be recovered. This makes it possible to recover the original data. However, how to accurately detect encryption ransomware attacks at an early stage under the limited computing power of SSDs has become an extremely severe challenge.

[0005] At present, under the existing computer technology conditions, it is very difficult and costly to manufacture comprehensive and universal data storage devices and storage systems that can defend against encryption ransomware attacks. However, in the application fields of trusted data resources and data assets, the common feature of their data is that once the data is generated, it is permanently unchangeable (such as the company's monthly financial reports, transaction vouchers, and government personnel files). In particular, most of this type of data involves economic activities. Once it is destroyed by the encryption ransomware virus, it will directly cause the company's operations to stop. In response to the actual needs of secure storage of this type of data, there is an urgent need for a special storage device that can resist encryption ransomware attacks, detect in advance, and prevent illegal data rewriting. Summary of the invention

[0006] The purpose of the present invention is to provide a method for countering encrypted ransomware attacks and a solid-state drive (SSD) for targeted purposes. Aiming at the fields of trusted data resources and data assets, the basic property of static and unchanged data and the characteristics of encrypted ransomware attacks, a complete set of countermeasure strategies and implementation technical solutions are provided on SSD hardware to support the production of a highly secure SSD device that can effectively identify and defend against various types of encrypted ransomware attacks and protect data security.

[0007] The above object of the present invention is achieved through the following technical solutions: In a first aspect, the present application provides a method for resisting crypto-ransomware attacks, comprising the following specific steps: Add a special flash translation layer VAT in the SSD to manage the mapping relationship between logical addresses and physical addresses to be reclaimed; The conventional flash translation layer FTL for managing the mapping relationship between logical addresses and physical addresses is used in the SSD; The SSD is equipped with a real-time clock chip RTC, which is used to generate the RTC timestamp of the physical address and the abnormal time point queue TQ; Based on the special flash translation layer VAT, the conventional flash translation layer FTL and the real-time clock RTC, respond to operation commands from a host, wherein the operation commands include write commands, read commands and rollback commands.

[0008] Based on the above technical solution, the present invention can also be improved as follows.

[0009] Furthermore, the special flash translation layer VAT mentioned above includes a VAT bitmap and a VAT mapping table, wherein the VAT bitmap is used to record the working status of each logical address, and the VAT mapping table is used to record the physical address to be reclaimed corresponding to each logical address. When the physical address to be reclaimed does not exist, it is also used to record the RTC timestamp of the physical address corresponding to the logical address in the conventional flash translation layer FTL.

[0010] Furthermore, the above response is a write command from the host, specifically: Obtain the working state of the VAT bitmap equivalent logical address according to the logical address of the write command. If the working state is occupied, calculate and save the attack rate AR of the encryption ransomware attack, then perform a no-op, and return a write success to the host. The attack rate AR is the cumulative number of times the above encryption ransomware attack occurs within N seconds, where N>=1. If the working state is an idle state, a regular write operation is performed using the conventional flash translation layer FTL, and then the RTC timestamp of this write operation is recorded in the table entry of the peer logical address in the VAT mapping table. At the same time, the working state of the peer logical address in the VAT bitmap is updated to an occupied state, and a write success is returned to the host.

[0011] Furthermore, the above response is a read command from the host, specifically: Obtaining the working state of the VAT bitmap equivalent logical address according to the logical address of the read command, and if the working state is an occupied state, performing a conventional read operation using the conventional flash translation layer FTL, and returning a read success to the host; If the working state is idle and the current RTC time exceeds the first time point in the abnormal time point queue TQ, and the exceeding time reaches more than one hour, the current RTC time is pushed into the abnormal time point queue TQ; the abnormal time point queue TQ is a first-in-first-out queue; If the working state is an idle state and the current attack rate AR value is greater than or equal to a threshold, an alarm signal is generated, and a conventional read operation is performed using the conventional flash translation layer FTL, and a read success is returned to the host.

[0012] Furthermore, the above response is a rollback command from the host, specifically: According to the specified time point of the rollback command or the time point in the abnormal time point queue TQ, it is determined whether the time point is out of limit. If the time point is out of limit, the rollback failure is returned to the host. Otherwise, each table entry falling into the time point range is obtained from the VAT mapping table and the conventional flash translation layer FTL, and the table entry content of the VAT mapping table is exchanged one by one with the corresponding table entry content in the conventional flash translation layer FTL, and the VAT bitmap is updated according to the table entry content in the conventional flash translation layer FTL after the exchange: that is, if the table entry content is the RTC timestamp, the VAT bitmap is updated to the idle state and the PBA of the equivalent logical address in the FTL is updated to "invalid"; otherwise, the VAT bitmap is updated to the occupied state and the PBA of the equivalent logical address in the FTL is updated to "valid", and the rollback success is returned to the host.

[0013] In a second aspect, the present application provides a solid-state hard drive, which uses any method of countering encryption ransomware attacks in the first aspect to defend against encryption ransomware viruses and protect data in the solid-state hard drive from being rewritten by the virus.

[0014] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method of any one of the first aspects is used to defend against encrypted ransomware viruses and protect data in the electronic device from being rewritten by viruses.

[0015] In a fourth aspect, the present application provides a non-transitory computer-readable storage medium, which stores computer instructions. When a computer executes the instructions, any method in the first aspect is used to defend against encrypted ransomware viruses and protect data in the computer from being rewritten by viruses.

[0016] Compared with the prior art, the present invention has at least the following beneficial effects: In this application, the real-time clock chip equipped in the SSD is used to generate the RTC timestamp, and based on the special flash translation layer VAT and the conventional flash translation layer FTL, the write command, read command and rollback command from the host are responded to, which can automatically detect the encryption ransomware attack and alarm, and can prevent all the damage of the encryption ransomware virus in advance. At the same time, it can also prevent other computer virus infections and privileged persons from illegally tampering with executable programs, and close to the ultimate protection of the data and executable programs stored in the SSD. At the same time, this method can protect the program code, key parameters and business rules from being arbitrarily changed by humans, so it supports unmanned trusted application systems; when this method is used to save data resources or data assets (such as account books, transaction contracts or vouchers, property rights certificates, etc.), it can meet the basic accounting rules (i.e. prohibiting later modifications and adding hedging records during error correction) and the permanent nature of data, so that ordinary data can be converted into high-quality, high-value data that meets "judicial credibility"; in particular, it can also strictly limit the data manipulation power of system privileged persons and eliminate data security threats from internal users (such as preventing embezzlement, black box operations, etc.). BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of this application, and do not constitute a limitation of the embodiments of the present invention. In the drawings: Figure 1 A schematic diagram of a special flash translation layer and a conventional flash translation layer in an embodiment of the present invention; Figure 2 A schematic diagram of a flow chart of writing commands in an embodiment of the present invention; Figure 3 Schematic diagram of the flow of reading commands in an embodiment of the present invention; Figure 4 Schematic diagram of the process of rolling back commands in an embodiment of the present invention; Figure 5 Schematic diagram of a solid state hard disk device in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0019] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0021] In the description of the embodiments of the present invention, "plurality" means at least 2.

[0022] Embodiment 1: This embodiment provides a method for resisting encryption ransomware attacks, including the following specific steps: S1, adding a special flash translation layer VAT in the SSD to manage the mapping relationship between the logical address and the physical address to be recycled; S11, a conventional flash translation layer FTL for managing a mapping relationship between a logical address and a physical address is used in the SSD; S12, a real-time clock chip RTC is provided in the SSD to generate an RTC timestamp of a physical address and an abnormal time point queue TQ; Among them, FTL (conventional flash translation layer) is the core metadata of conventional SSD (solid state drive). The main controller of SSD relies on FTL to manage its large number of NAND storage units. Conventional SSD usually has only one layer of FTL, which completes the translation and conversion of host logical address vs SSD physical address, PBA (physical address) page allocation, waste block recovery, bad block replacement, wear leveling and other management tasks; however, in order to fight against encryption ransomware attacks, new functions need to be added. In order to keep the conventional tasks of FTL basically unchanged and not increase its complexity, a dedicated FTL called VAT (special flash translation layer) can be added. VAT also works under the control of SSD master CPU, and it mainly undertakes the task of fighting against encryption ransomware attacks.

[0023] Optionally, the above-mentioned special flash translation layer VAT includes a VAT bitmap and a VAT mapping table, the VAT bitmap is used to record the working status of each logical address, the VAT mapping table is used to record the physical address to be reclaimed corresponding to each logical address, and when the physical address to be reclaimed does not exist, it is also used to record the RTC timestamp of the physical address corresponding to the logical address in the FTL.

[0024] Among them, the VAT mapping table is a mapping table with special functions. It is used to record the physical address to be recycled. The physical address to be recycled is generated by the "page update" feature naturally possessed by the SSD, in which the original data of the logical address is temporarily stored. This is to utilize the "page update" feature of the SSD to achieve data "rollback" to eliminate the damage caused by the virus. When there is no physical address to be recycled, the VAT mapping table is used to record the RTC timestamp of the PBA corresponding to the logical address in the FTL; the VAT bitmap saves the working status of all logical addresses of the SSD, and its initial value is "free". Once the logical address is used, it is immediately updated to "occupied". The VAT bitmap is inside the SSD and cannot be accessed by the encrypted ransomware virus; the entry point for the virus to launch an attack can be divided into two types: one is to directly attack the storage device through the host bottom driver. At this time, since it cannot know the current working status of its target address, illogical read and write behavior will inevitably occur; the second is to launch an attack through the file system of the host OS, at which time it will encounter a strong blockade described in the next step.

[0025] S2, based on the special flash translation layer VAT, the conventional flash translation layer FTL and the real-time clock RTC, responds to the operation command from the host, the operation command includes a write command, a read command and a rollback command.

[0026] Among them, RTC (real-time clock) is a hardware integrated circuit chip used to generate the internal time of the SSD. The internal time of the SSD can form its own timing system or be synchronized with the actual time (such as Beijing time); when the host data is written to the PBA, the current RTC time is used as the timestamp of the PBA.

[0027] Optionally, the above response comes from a write command from the host, such as Figure 2 As shown, specifically: S21, obtain the working status of the VAT bitmap peer logical address according to the logical address of the write command, if the working status is occupied, calculate and save the attack rate AR of the encryption ransomware attack, then perform a no-operation, and return a write success to the host; if the working status is idle, use the conventional flash translation layer FTL to perform a conventional write operation, and then record the RTC timestamp of this write operation in the table entry of the peer logical address in the VAT mapping table, and at the same time update the working status of the peer logical address in the VAT bitmap to occupied, and return a write success to the host.

[0028] Among them, the main target of the crypto-ransomware attack is the data already existing in the SSD (data files or executable programs seen at the host OS layer), so a strong blocking measure is taken here: that is, it is forbidden to rewrite any existing data in the SSD logical address space; this prevents the crypto-ransomware virus from causing "fatal" damage to user data; further, in order to prevent crypto-ransomware or other viruses from using the "storage exhaustion" tactic (such as creating a large number of invisible junk files) to maliciously block the user host, the VAT mapping table is also used here to save the RTC timestamp of the "write" operation, so that the rollback command extended by the present invention can be used when necessary to eliminate the damage caused by the virus; through these two steps, the crypto-ransomware cannot achieve its purpose of extorting money, and cannot cause any damage to the data in the SSD.

[0029] Optionally, the above response comes from a read command from the host, such as Figure 3 As shown, specifically: S22, obtaining the working state of the logical address of the VAT bitmap equivalent according to the logical address of the read command, if the working state is occupied, performing a conventional read operation using the conventional flash translation layer FTL, and returning a read success to the host; If the working state is idle and the current RTC time exceeds the first time point of the abnormal time point queue TQ, and the exceeding time reaches more than one hour, the current RTC time is pushed into the abnormal time point queue TQ, and the abnormal time point queue TQ is a first-in-first-out queue (FIFO); If the working state is idle and the current attack rate AR value is greater than or equal to the threshold, an alarm signal is generated, and a conventional read operation is performed using a conventional flash translation layer FTL, and a read success is returned to the host.

[0030] Among them, when an encryption ransomware attack occurs, it needs to "first" read out its target data for encryption. If the logical address of its target data is in the "occupied" state, the SSD master CPU cannot find the abnormality; but if the logical address is in the "free" state, it is obviously abnormal because almost no application reads undefined data (some OS uncommon functions and disk tool programs are exceptions, but in the SSD application scenarios of the present invention, the user (operator) is aware of the impact of its operation, so exceptions are not a problem). At this time, the SSD master CPU combines the AR value to determine that an encryption ransomware attack is occurring and alarms by flashing the light.

[0031] The abnormal time point queue TQ is used to record the time list when the encryption ransomware behavior is detected, in preparation for executing the rollback command.

[0032] Optionally, the above response is a rollback command from the host, such as Figure 4 As shown, specifically: S23, judging whether the time point is out of limit according to the specified time point of the rollback command or the time point in the abnormal time point queue TQ, if the time point is out of limit, returning rollback failure to the host, otherwise obtaining each table entry falling into the time point range from the VAT mapping table and the conventional flash translation layer FTL, exchanging the table entry content of the VAT mapping table and the equivalent table entry content in the conventional flash translation layer FTL one by one, and updating the VAT bitmap according to the table entry content in the conventional flash translation layer FTL after the exchange: that is, if the table entry content is the RTC timestamp, then the VAT bitmap is updated to the idle state and the PBA of the equivalent logical address in the FTL is updated to "invalid", otherwise the VAT bitmap is updated to the occupied state and the PBA of the equivalent logical address in the FTL is updated to "valid", and finally returning rollback success to the host.

[0033] Among them, the rollback command is a professional maintenance tool for the SSD of the present invention. The rollback command can be operated and executed within a limited time after the virus attack occurs, and is used to eliminate the junk data generated by the virus; the time point range of the rollback command refers to the time span from now to a certain point in the past (for example, 12 hours).

[0034] Embodiment 2: The purpose of this embodiment is to support the production of an SSD device that resists encryption ransomware attacks, such as Figure 5 As shown in the figure, the SSD device includes three components: a baseboard, a main controller, and a NAND storage array. Among them: The bottom plate is a PCB circuit board, which carries the encryption ransomware attack alarm light ALARM, the main controller, the NAND array, and other necessary auxiliary electronic components; The main controller includes CPU, OTP (one-time programming memory), DRAM, RTC, VAT bitmap, VAT mapping table, and FTL (flash translation layer); the CPU is responsible for overall scheduling and uses the metadata provided by VAT and FTL to complete various computing and processing tasks; OTP solidifies and saves the algorithms of SSD key parameters and various work tasks; DRAM provides the high-speed cache required by the CPU when working; RTC is a hardware real-time clock chip, which is used to generate the local time of the SSD. The SSD local time can form its own timing system or be synchronized with the actual time (such as Beijing time); when user data is written to PBA, the specific RTC value is used as the timestamp of the PBA; FTL is the core metadata of a conventional SSD, which completes the translation and conversion of the host logical address vs. SSD physical address, PBA page allocation, waste block recovery, bad block replacement, wear leveling and other management tasks under CPU scheduling. The SSD in this embodiment has two layers of flash translation layers, namely VAT and FTL.

[0035] Specifically, the VAT includes a VAT bitmap and a VAT mapping table.

[0036] The VAT bitmap is a data structure added by the present invention, which saves the working status of all logical addresses accessible to the SSD host. Its initial value is "free". Once the logical address is used, it is immediately updated to "occupied"; the VAT mapping table is also a data structure added by the present invention, which is used to record the physical address to be reclaimed corresponding to each logical address, and when the physical address to be reclaimed does not exist, it is also used to record the RTC timestamp of the physical address corresponding to the logical address.

[0037] FTL, VAT mapping table and VAT bitmap are stored in the reserved storage space in the NAND array when static, and are loaded into the DRAM or SRAM high-speed dynamic memory on the motherboard when the SSD is powered on and initialized. The addressing space size of FTL, VAT mapping table and VAT bitmap is the same, which is the logical address LBA space of the SSD.

[0038] The above-mentioned NAND storage array is the storage medium of the SSD. Part of its storage space is reserved for storing SSD metadata or as a bad block backup, and the other part of the storage space can be allocated as the physical address PBA for the host to store data. Obviously, the PBA addressing space is larger than the LBA.

[0039] Furthermore, the ALARM light is used to send out an alarm and flash when the CPU detects a suspected attack by a ransomware virus. However, the flashing alarm does not mean that the virus attack has caused data damage, but only reminds the user that a suspected virus attack is occurring. In fact, the stored data of the SSD in this embodiment cannot be destroyed online by a ransomware virus or other viruses (unless the NAND medium is disassembled on site).

[0040] Optional, with Figure 1 The two-layer FTL architecture of the present invention is demonstrated, and the system design concept of layered processing is used to make the processing tasks of each layer clear and simple to operate, and to minimize the crossover between layers, making the SSD device more robust. At the same time, it inherits the mature technology of the second-layer conventional FTL; among them, the first-layer VAT (special flash conversion layer) of this embodiment includes a VAT bitmap and a VAT mapping table. It can be seen that the VAT bitmap is an extremely important component of the present invention. By using the characteristics that the encrypted ransomware virus is difficult to know the current working state of the SSD logical address, its blind attack will inevitably appear unreasonable operations of accessing undefined data, so that the CPU discovers the existence of its attack; at the same time, it uses the characteristics that the virus must forcibly rewrite the existing data to catch its trace again; this embodiment adopts a method of prohibiting the rewriting of existing data to strongly block it. Of course, in other embodiments, the method of temporarily transferring the PBA data of the virus's attack target can also be adopted, and then the user uses the rollback command of the present invention to make its attack fail.

[0041] Further, the flowchart of writing data, reading data and rolling back data in this embodiment is shown in the attached Figure 2 , Attachment Figure 3 , Attachment Figure 4 ; Traditional SSDs also support full disk reset, delete commands, and erase commands. Obviously, they are not applicable to the SSD products of the present invention, and implementers must remove these commands. It should be made clear that this embodiment introduces the "rollback" command implemented in the SSD, and sets an operable time limit for this command. On the one hand, this limit avoids the disaster of intentional or unintentional or malicious rollback of all data (the SSD's waste block recovery mechanism does not allow rollback for too long). On the other hand, this limit reflects the "chronological" sealing feature of trusted data resources or data assets. (Chronology means compiling data periodically at a fixed time and prohibiting later modifications, such as a company's monthly financial report). It can be seen that the real-time clock RTC in this embodiment is an indispensable and important component.

[0042] This embodiment is designed to protect common user files or programs, and can also protect user data assets or data resources (whose characteristic is that once the data is generated, it cannot be changed permanently). However, this embodiment does not include the "disk encryption" function and cannot be used to save any classified files. If necessary, this embodiment supports the implementer to add the disk encryption function or component in the main controller. This embodiment does not support partition protection (or no protection) of the storage space of the SSD to avoid complications and loopholes, so as to ensure data security.

[0043] Embodiment 3: The embodiment of the present application provides a solid-state hard drive, which achieves defense against encryption ransomware and protection of data security through any method of countering encryption ransomware attacks in the first aspect.

[0044] An embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method of any one of the first aspects is used to defend against encryption ransomware and protect data security.

[0045] An embodiment of the present application also provides a non-transitory computer-readable storage medium, which stores computer instructions. When the computer executes the instructions, any method in the first aspect is used to achieve defense against encryption ransomware and protect data security.

[0046] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for resisting crypto-ransomware attacks, characterized in that: The specific steps include: Add a special flash translation layer VAT in the SSD to manage the mapping relationship between logical addresses and physical addresses to be reclaimed; The conventional flash translation layer FTL for managing the mapping relationship between logical addresses and physical addresses is used in the SSD; The SSD is equipped with a real-time clock chip RTC, which is used to generate the RTC timestamp of the physical address and the abnormal time point queue TQ; Based on the special flash translation layer VAT, the conventional flash translation layer FTL and the real-time clock RTC, respond to operation commands from a host, wherein the operation commands include write commands, read commands and rollback commands.

2. A method for resisting encryption ransomware attacks according to claim 1, characterized in that: The special flash translation layer VAT includes a VAT bitmap and a VAT mapping table. The VAT bitmap is used to record the working status of each logical address, and the VAT mapping table is used to record the physical address to be reclaimed corresponding to each logical address. When the physical address to be reclaimed does not exist, it is also used to record the RTC timestamp of the physical address corresponding to the logical address in the conventional flash translation layer FTL.

3. A method for resisting encryption ransomware attacks according to claim 2, characterized in that: Respond to the write command from the host, specifically: Obtain the working state of the VAT bitmap equivalent logical address according to the logical address of the write command. If the working state is occupied, calculate and save the attack rate AR of the encryption ransomware attack, then perform a no-op, and return a write success to the host. The attack rate AR is the cumulative number of times the above encryption ransomware attack occurs within N seconds, where N>=1. If the working state is an idle state, a regular write operation is performed using the conventional flash translation layer FTL, and then the RTC timestamp of this write operation is recorded in the table entry of the peer logical address in the VAT mapping table. At the same time, the working state of the peer logical address in the VAT bitmap is updated to an occupied state, and a write success is returned to the host.

4. A method for resisting encryption ransomware attacks according to claim 2, characterized in that: Respond to the read command from the host, specifically: Obtaining the working state of the VAT bitmap equivalent logical address according to the logical address of the read command, and if the working state is an occupied state, performing a conventional read operation using the conventional flash translation layer FTL, and returning a read success to the host; If the working state is idle and the current RTC time exceeds the first time point in the abnormal time point queue TQ, and the exceeding time reaches more than one hour, the current RTC time is pushed into the abnormal time point queue TQ; the abnormal time point queue TQ is a first-in-first-out queue; If the working state is an idle state and the current attack rate AR value is greater than or equal to a threshold, an alarm signal is generated, and a conventional read operation is performed using the conventional flash translation layer FTL, and a read success is returned to the host.

5. The method for resisting encryption ransomware attack according to claim 2, characterized in that: Respond to the rollback command from the host, specifically: According to the specified time point of the rollback command or the time point in the abnormal time point queue TQ, it is determined whether the time point is out of limit. If the time point is out of limit, the rollback failure is returned to the host. Otherwise, each table entry falling into the time point range is obtained from the VAT mapping table and the conventional flash translation layer FTL, and the table entry content of the VAT mapping table is exchanged with the corresponding table entry content in the conventional flash translation layer FTL one by one, and the VAT bitmap is updated according to the table entry content in the conventional flash translation layer FTL after the exchange: that is, if the table entry content is an RTC timestamp, the VAT bitmap is updated to an idle state and the PBA of the equivalent logical address in the FTL is updated to "invalid"; otherwise, the VAT bitmap is updated to an occupied state and the PBA of the equivalent logical address in the FTL is updated to "valid", and the rollback success is returned to the host.

6. A solid state hard disk, characterized in that: Using the method described in any one of claims 1-5, defense against encryption ransomware viruses is achieved, and data in the solid-state hard disk is protected from being rewritten by viruses.

7. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method described in any one of claims 1 to 5 is used to defend against encryption ransomware viruses and protect data in electronic devices from being rewritten by viruses.

8. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and when the computer executes the instructions, the method described in any one of claims 1-5 is used to defend against encryption ransomware viruses and protect data in the computer from being rewritten by viruses.

Images