File System Protection Device and Method in Auxiliary Storage Device

Abstract

The present invention relates to a file system protection technology applied to a secondary storage device (20), and to an apparatus and method for protecting a file system by blocking or warning access to or changes to the file system in advance and, if necessary, confirming user permission. A control device (60) is connected to a host interface (30), a data storage device (40), and a user input device (50) to control the operation mode of the secondary storage device and manage and protect file system objects to be protected according to user commands. When the secondary storage device is in management mode, the user can specify file system objects to be protected and set a protection method, and the information set by the user is stored in a protection object database (70). In normal mode, when a host computer accesses a file system object listed in the protection object database, the protection method in the protection object database is referenced to perform a protection operation. In normal mode, the host computer cannot access the protection object database (70) set by the user in setting mode, preventing malicious code from modifying or damaging the protection object database (70).

Description

[Technical field]

[0001] The present invention relates to an auxiliary storage device used in electronic computing devices, computers, and the like, and more particularly to an apparatus and method for protecting a file system stored in the auxiliary storage device. [Background technology]

[0002] In all computers, including personal computers, the OS is recorded in an auxiliary storage device consisting of non-volatile memory or mechanical storage devices, and at startup, the BIOS loads and starts the OS from the auxiliary storage device. In addition, user files and application programs must be stored in the auxiliary storage device. Therefore, the use of an auxiliary storage device is essential to the operation of a computer. Therefore, the OS and user files must not be able to be modified by anyone other than the legitimate user.

[0003] However, in existing computer systems, there is no way to distinguish between legitimate users after passing through security consisting of IDs and passwords. For example, in the case of Windows OS, a security policy is applied that distinguishes between users and restricts access to folders and files, but since the highest administrator is given unlimited authority, it is impossible to respond if a malicious program infiltrates and acts as the highest administrator, or if a malicious third party temporarily gains access authority as an administrator and harms the system or steals information contained in the computer.

[0004] For this reason, there are continuous cases where malicious codes such as ransomware not only encrypt user files but also delete partitions and folders containing system recovery information, but there is no way to solve this problem. In addition, there are frequent cases where unauthorized third parties steal information by secretly copying files containing confidential company information.

[0005] The applicant has filed several inventions to address these issues and recover from system damage (Korean application number 10-2017-0057998, Korean patent registrations 10-1920866 and 10-1920867). These prior application inventions deal with auxiliary storage devices, including an original auxiliary storage device and a backup auxiliary storage device. The original auxiliary storage device is always accessible by the host computer. In contrast, the backup auxiliary storage device is restricted so that user access is only possible under certain conditions (e.g., under recovery mode conditions). Therefore, safe backup and recovery is possible by using these prior application inventions.

[0006] However, these prior art inventions only allow for backup and recovery of file systems, and therefore have the weakness that they can only be dealt with after the fact. Of course, this is not a big problem since perfect recovery is possible after the fact, but if malicious attempts can be prevented from the beginning, it would be of great significance since it would eliminate or significantly reduce the time and cost required to recover from system damage.

[0007] Meanwhile, in the case of existing computers, malicious code monitoring programs mainly monitor by comparing parts of the code with a malicious code database. However, if the code is changed or the code is not in the malicious code database, the monitoring cannot be performed and the computer is left to suffer damage. Even when a method of monitoring the operation of a specific program is used in the case of existing computers, the malicious code may disable the program, causing further damage. Therefore, if there is a way to effectively block malicious code or unauthorized third parties from accessing the file system and attempting to change its shape or copy information contained in files, etc., it would be very meaningful to protect the file system. Summary of the Invention [Problem to be solved by the invention]

[0008] Therefore, the present inventor has developed a file system protection device and method that is applicable not only to the auxiliary storage device previously filed by the present inventor, including the original auxiliary storage device and the backup auxiliary storage device, but also to existing auxiliary storage devices that use only the original auxiliary storage device. Therefore, the present invention proposes a device and method for protecting a file system by blocking or warning in advance access to or changes to the file system and confirming user permission as necessary. [Means for solving the problem]

[0009] To solve the above problem, the present invention aims to protect the file system by analyzing information of a host computer accessing an auxiliary storage device to identify file system objects that constitute the file system, and then, if the file system object is an object to be protected, selectively denying access or allowing access with additional consent from the user.

[0010] Generally, secondary storage devices perform operations such as reading and writing using access information transmitted from a host computer. At this time, the host computer accesses the secondary storage device by specifying the address of the data area to be accessed using the CHS address method (Cylinder Head Sector Addressing) or LBA method (Logical Block Addressing) rather than the file name or folder name.

[0011] In other words, either method uses an address that directly or indirectly specifies a specific area of ​​the storage space (cluster number, head number, sector number, etc.), because the host computer's file system is managed by the host computer and not the secondary storage device. Of course, some secondary storage devices can even exchange file-level information using a separate protocol, but HDD and SSD products that are commonly used in desktop PCs and laptops generally access secondary storage devices by providing addresses directly.

[0012] However, since the access information transmitted at this time generally does not contain information such as a file name or a file path, the access information must be analyzed from the secondary storage device to check whether there is an access to a file system object such as a file, directory, MBR (Master Boot Record), etc. However, such an operation is not necessary in a typical secondary storage device, and if such an operation were to be performed, it would only slow down the processing speed of the secondary storage device without any benefit.

[0013] In comparison, the auxiliary storage device according to the present invention performs such operations, so the processing speed is somewhat slower, but since it prevents unauthorized changes to the file system, it can protect the file system from attacks by malicious codes such as malicious viruses and ransomware. In addition, since it does not use a malicious code database, it has the advantage of being able to avoid slow updates to the database or slow responses due to the emergence of new types of malicious code. In addition, when malicious code or an unauthorized third party accesses the file system, it can be blocked or processed after confirming the user's permission, thereby greatly improving the security of the file system.

[0014] In order to solve the above-mentioned problems, an auxiliary storage device according to a first aspect of the present invention, which embodies the above-mentioned concepts, includes a host interface for communicating with a host computer; a data storage device for storing data; a user input device for receiving input and related information regarding the operation mode of the auxiliary storage device, i.e., normal mode and management mode, from a user; and a control device connected to the host interface, the data storage device, and the user input device for controlling the operation mode of the auxiliary storage device and for managing and protecting file system objects to be protected according to user commands.

[0015] In one embodiment, the control device controls the operation of the secondary storage device to a management mode or a normal mode according to information received from a user input device. When the operation mode of the secondary storage device controlled by the control device is the management mode, the user can specify a file system object to be protected and set a protection method, and the information set by the user is stored in the protected object DB. When the operation mode of the secondary storage device is the normal mode, if the host computer accesses a file system object listed in the protected object DB, the protection operation is performed by referring to the protection method of the protected object DB. In the normal mode, the host computer cannot access the protected object DB in which the information set by the user is stored. This prevents malicious code from modifying or damaging the protected object DB.

[0016] The control device may be implemented as a CPU that controls the auxiliary storage device and related software and hardware, and the user input device may be implemented as an electrical switch operated by a user. Alternatively, the user input device may be implemented as a communication module that confirms one or more user inputs or data based on information transmitted by wire and wirelessly. In this case, the input device of the external terminal may substantially replace the user input device.

[0017] In another embodiment, the control device may further include a protection target object DB management module and a file system protection module.

[0018] Here, the protection object DB management module performs the function of creating or modifying the protection object DB by receiving user input when the secondary storage device is in management mode. At this time, user information can be input through a user input device, or in a restricted environment (for example, after setting the management mode through the user input device of the secondary storage device), the information can be input to the protection object DB management module of the secondary storage device through the host interface using a secondary storage device management program executed in a host computer. The user can designate a file system object to be protected as a protection object and can also designate a protection method.

[0019] Here, methods of protecting the protected object may include "warning," "permission confirmation," "permission confirmation and saving of recovery information," "access denial," etc., among which "saving of recovery information" is applicable when both an original auxiliary storage device and a backup auxiliary storage device are provided, in a manner similar to the inventor's prior invention, and a storage area that cannot be accessed by the host computer is provided.

[0020] The file system protection module may include an access information analysis unit that analyzes access information provided by a host computer, a file system object confirmation unit that confirms a file system object using a storage space of an access address included in the access information, and an object protection unit that selectively processes an access to the access address according to a protection method designated by a user when the confirmed file system object is an object to be protected designated by a user. The file system protection module may further include an access log unit that creates and stores log information consisting of an access time, an address, a type of command, etc.

[0021] The auxiliary storage device according to the second aspect of the present invention for solving the above-described problems further includes a display device that displays the processing state of the control device (for example, the type of file system object and the access processing result, etc.) together with the components of the auxiliary storage device of the first aspect. The control device of the auxiliary storage device according to this second aspect includes a display device driving module that drives the display device, and accordingly, is configured to include a file system protection module with some additional functions.

[0022] The file system protection module here may include an access information analysis unit that analyzes access information provided by the host computer; a file system object confirmation unit that confirms a file system object using the storage space of the access address included in the access information; an object protection unit that selectively processes access to the access address by the protection method specified by the user when the confirmed file system object is a protection target object specified by the user; and a protection state display unit that causes the display device driving module to output the type of the file system object and the access processing result to the display device.

[0023] In addition, the auxiliary storage device according to the third aspect of the present invention for solving the above-described problems further includes a process of confirming user permission input through a user input device in addition to the components of the auxiliary storage device of the second aspect. The process of confirming user permission input is a stage for the user to input whether to permit access to the corresponding address or file system object when the protection method of the file system object is "permission confirmation" or "permission confirmation and recovery information storage".

[0024] The file system protection module of the control device of the auxiliary storage device according to the third aspect may include an access information analysis unit that analyzes access information provided by a host computer; a file system object confirmation unit that confirms a file system object that is using storage space of an access address included in the access information; a protection status display unit that causes a display device driving module to output the type of the file system object and contents requesting permission to the display device when the confirmed file system object is an object to be protected designated by a user and the protection method is "permission confirmation" or "permission confirmation and restore information storage"; and a second object protection unit that performs access when a user permission confirmation input is input from the user input device.

[0025] The protection status display unit of the control device of the second aspect and the protection status display unit and user input device of the control device of the third aspect may be implemented in connection with an external terminal device such as a mobile phone. That is, the user input device may include a wired and wireless communication module and be connected to a mobile phone, and an application may be installed and run on the mobile phone, whereby operations such as managing a DB of protected objects and displaying and permitting access to file system objects may be implemented in an integrated manner.

[0026] Meanwhile, according to yet another aspect of the present invention, there is provided a computer (PC, server computer, mobile terminal, etc.) employing an auxiliary storage device to which the above-mentioned file system protection device in an auxiliary storage device or the file system protection method in an auxiliary storage device is applied.

[0027] The above-mentioned configuration and operation of the present invention will become more apparent from the following detailed description of the preferred embodiments in conjunction with the accompanying drawings. Effect of the Invention

[0028] Compared with the prior art, which focuses on the recovery of a damaged file system, the auxiliary storage device to which the technology of the present invention is applied can prevent or warn of unintended changes to the shape of the file system in advance, thereby protecting the file system from attacks by malicious codes such as malicious viruses and ransomware. In addition, it is possible to take appropriate measures even when a malicious third party temporarily obtains access authority and accesses or harms the system, which is an advantage of being able to protect the file system to a considerable degree.

[0029] In addition, it is possible to protect the file system without many of the problems that existing vaccine programs have, such as the inability to respond when a new type of malicious code appears until the malicious code is registered in the database, or the problem of the host computer slowing down due to the need to constantly run a program to check for malicious code, so it is significant because it can prevent data damage caused by malicious code in advance without inconveniences such as updating the malicious code database at any time or reducing the performance of the host computer. [Brief description of the drawings]

[0030] [Figure 1] 1 is a schematic diagram of an auxiliary storage device according to a first embodiment of the present invention. [Diagram 2] FIG. 2 is a configuration diagram of a control device of an auxiliary storage device in the first embodiment. [Diagram 3] 3 is a configuration diagram of a file system protection module of the control device according to the first embodiment. FIG. [Figure 4] FIG. 11 is a configuration diagram of an auxiliary storage device according to a second embodiment of the present invention. [Diagram 5] FIG. 11 is a configuration diagram of a control device of an auxiliary storage device according to a second embodiment. [Figure 6] FIG. 11 is a configuration diagram of a file system protection module of a control device according to a second embodiment. [Figure 7] FIG. 11 is a configuration diagram of an auxiliary storage device according to a third embodiment of the present invention. [Figure 8]FIG. 11 is a configuration diagram of a control device of an auxiliary storage device according to a third embodiment. [Figure 9] FIG. 13 is a configuration diagram of a file system protection module of a control device according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0031] The advantages and features of the present invention, and the method of achieving the same, will become apparent from the detailed description of the embodiments with accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, and may be implemented in various different forms, but the embodiments are provided to fully disclose the present invention and to fully inform those skilled in the art of the invention of the scope of the invention, and the present invention is defined by the claims.

[0032] Meanwhile, the terms used in the present specification are for the purpose of describing the embodiments and are not intended to limit the present invention. In the present specification, the singular form includes the plural form unless otherwise specified in the text. The terms "comprise" or "comprising" used in the specification do not exclude the presence or addition of one or more other components, steps, operations and / or elements other than the recited components, steps, operations and / or elements.

[0033] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. When referring to components in each drawing, the same reference numerals are used to refer to the same components even if they are displayed in different drawings. In addition, when a detailed description of related known configurations or functions may obscure the gist of the present invention, the detailed description will be omitted.

[0034] 1 is a schematic diagram of an auxiliary storage device 20 according to a first embodiment of the present invention. Basically, a host computer 10 accesses (accesses) the auxiliary storage device 20. The auxiliary storage device 20 comprises a host interface 30 for communicating with the host computer, a data storage device 40 for storing data, a user input device 50 for receiving user input, and a control device 60 connected to the host interface 30, the data storage device 40, and the user input device 50 for controlling the operation mode of the auxiliary storage device and for managing and protecting file system objects to be protected according to user commands.

[0035] The control device 60 includes an operation mode control module (61 in FIG. 2) for controlling the operation mode (normal mode and management mode) of the secondary storage device 20. The normal mode and management mode can be selected by the user through the user input device 50. When the operation mode of the secondary storage device 20 is the management mode, the user can specify a file system object to be protected and set a protection method, and the information set by the user is stored in the protected object DB 70. In the normal mode, when the host computer accesses a file system object listed in the protected object DB, a protection operation is performed by referring to the protection method of the protected object DB. In the normal mode, the host computer cannot access the protected object DB 70 set by the user in the setting mode, so that it is possible to prevent malicious code from modifying or damaging the protected object DB 70.

[0036] Here, a file system object basically means an element or combination of elements that constitute a file system. Therefore, a file system object can be a sector, a cluster, a file path, a file name, a directory, a partition, or a drive itself, or can be a collection of these. Therefore, elements that constitute a file system itself, i.e., MBR (Master Boot Record), PBR (Partition Boot Record), MFT (Master File Table) in the case of NTFS, and FAT (File Allocation Table) in the case of FAT file system, can also be file system objects. Therefore, a file system object can be a storage space such as a sector or cluster specified by CHS or LBA, a specific file such as c: / users / documents / PEACE.doc, a file and the entire directory in a directory that is for temporary use such as / temporary, a partition or drive such as drive D:, or a cluster such as MBR.

[0037] The control device 60 may be implemented as a CPU and related software and hardware that controls the secondary storage device 20, and the user input device 50 may be implemented as an electrical switch operated by a user. Alternatively, the user input device 50 may be implemented as a communication module that confirms one or more user inputs or data based on information transmitted by wire and wirelessly. In this case, an input device of an external terminal may substantially replace the user input device 50. For example, a touch screen or key input device of a mobile phone may be connected to the secondary storage device 20 by a communication method such as Bluetooth and replace the user input device 50. In this case, it may be preferable to use a security protocol to ensure that the information is not exposed to the outside.

[0038] In FIG. 2, the control device 60 further includes a protection target object DB management module 62 and a file system protection module 63 in addition to an operation mode control module 61 .

[0039] When the secondary storage device 20 is in the management mode, the protection target object DB management module 62 performs the function of creating or modifying the protection target object DB 70 in response to a user's input. The user can designate the file system object to be protected as the protection target object and can also designate the protection method. At this time, the user's information can be input through the user input device 50, but it can also be input to the secondary storage device protection target object DB management module 62 through the host interface 30 using a secondary storage device management program executed in the host computer 10 under a restricted environment (for example, after setting the management mode through the user input device of the secondary storage device). When using this method, care should be taken because there is a possibility of being attacked by malicious code using this method if the usage environment is not restricted, but it is preferable to use it after setting the management mode in the secondary storage device because of its ease of use.

[0040] The protection methods are divided into "warning", "permission confirmation", "permission confirmation and recovery information storage", "access denial", etc., and here, recovery information storage can be applied when a storage area that cannot be accessed by the host computer 10 is provided, such as when an original auxiliary storage device and a backup auxiliary storage device are provided in a manner similar to the prior invention of the present inventor. As described above, the protection method for the protection object can be specified by providing the user with a means such as an initialization program or a management program. Meanwhile, the protection method is set by distinguishing whether the access of the host computer 10 is write or read. Therefore, for example, the user can create the protection object DB 70 as follows. It is preferable that the files and directories registered in the protection object DB 70 are automatically updated when the name is changed, but it may be restricted so that the name cannot be changed.

[0041] A configuration example of the protected object DB 70 is shown below. In the DB configuration example below, the object type may be expressed as an address such as LBA0-LBA33, a file path and file name such as D: / PEACE.doc, or a directory such as D: / WORLD. In the above example, write access to the MBR (Master Boot Record) responsible for booting in the case of an NTFS partition and LBA0-LBA33 responsible for booting in the case of a GPT (GUID Partition Table) partition is prohibited.

[0042] [Table 1]

[0043] The "warning" is implemented by simply notifying the user of an access to the file system object through an LED, an alarm, a display device, etc. The "permission confirmation" allows access only when the user has given permission, and may be implemented by outputting a message for permission confirmation to a display device and receiving permission confirmation from the user input device 50, or by checking whether a specific switch is turned on or a variable input through another communication terminal, etc., and determining that permission has been granted automatically if the value is ON. The "access denial" is implemented by unconditionally denying access, and is implemented by notifying the user of the denial of access to the file system object through an LED, an alarm, a display device, etc. after denying access. The "recovery information storage after permission confirmation" allows access with the user's permission, but stores recovery information in preparation for damage to the file system object, and in this case, recovery information storage is possible only when the device is provided with a storage area that is inaccessible to the host computer under normal circumstances.

[0044] Since a file system object generally consists of a number of clusters or sectors, the confirmed user response may be stored and then used to automatically process access to the clusters that make up the file system object. That is, by receiving a user response once and adopting the same response for a certain period of time for all clusters that make up the corresponding file, unnecessary user confirmation work can be eliminated.

[0045] Meanwhile, when the access is a read access, only the permission confirmation or warning among the above-mentioned protection methods can be applied. In particular, in the case of a read access, the permission confirmation is a method that can block in advance an attempt by an unauthorized third party to leak information by secretly copying a file. In this case, the permission of the user required for the permission confirmation can be a simple switch input (for example, through the user input device 50), or it can be triggered by an approval signal input from the user's mobile phone to the control device (for example, a method in which the mobile phone app and the control device are automatically linked and a separate password is automatically input from the mobile phone). That is, when the user input device 50 of the secondary storage device 20 is given a communication terminal function, and the mobile phone and the secondary storage device 20 are connected to each other by installing an app that can communicate with the secondary storage device 20 and operates as the user input device 50, it is possible to process the permission confirmation without the user's intervention (automatic approval). At this time, the app installed in the mobile phone can be activated by receiving a separate password from the user or a unique device number or USIM ID of the mobile phone to be linked to the secondary storage device.

[0046] In addition, it is preferable that the permission check for write access proceeds in a different manner from the permission check by automatic approval for read access. That is, since the shape of the file system must be changed in the case of write access, the automatic approval for read access may result in approving an attack by malicious code. Therefore, it is preferable to use the automatic approval for write access only in the case of "permission check and recovery information storage".

[0047] Fig. 3 is a block diagram of the file system protection module 63 in the control device 60 shown in Fig. 2. The file system protection module 63 may include an access information analysis unit 631 that analyzes access information provided by the host computer 10, a file system object confirmation unit 632 that confirms a file system object using a storage space of an access address included in the access information, and an object protection unit 633 that selectively processes an access to the access address according to a protection method designated by the user if the confirmed file system object is an object to be protected designated by the user.

[0048] In addition to the above configuration, the file system protection module 63 may further include an access log unit 634 that creates and stores log information including access time, address, command type, etc. Using this, a user may manage log information through an application on a mobile phone.

[0049] FIG. 4 is a block diagram of an auxiliary storage device according to a second embodiment of the present invention. The auxiliary storage device 20 of the first embodiment of FIG. 1 further includes a display device 80. Here, the display device 80 may be configured as a combination of an LED, a display, an alarm device, etc., and according to another embodiment, it may be configured as a communication module and a terminal device in a manner similar to the user input device 50, transmit information to the outside via wired and wireless, and the external terminal device may replace the display device. In this case, the user input device 50 and the display device 80 may be integrated into one input / output device. In this case, the integrated input / output device may be implemented as the whole or a part of a terminal connected to the control device through communication (i.e., connected through a communication network or by a specially designed communication means or method).

[0050] 5 is a block diagram of the control device 60 of the auxiliary storage device according to the second embodiment shown in FIG. 4, which further includes a display device driving module 64 for driving a display device 80 in addition to the components shown in FIG. 2. The file system protection module 63 further includes an access information analysis unit 631 for analyzing access information provided by the host computer 10 as shown in FIG. 3, a file system object confirmation unit 632 for confirming a file system object using a storage space of an access address included in the access information, an object protection unit 633 for selectively processing an access to the access address according to a protection method designated by a user if the confirmed file system object is an object to be protected designated by a user, and a protection state display unit 635 for causing the display device driving module 64 to output the type of the file system object and the access processing result to the display device 80.

[0051] Also, as in the first embodiment, the file system protection module 63 may further include an access log unit 634 that creates and stores log information consisting of access time, address, command type, etc. Using this, a user may manage log information through a mobile phone app.

[0052] In this second embodiment, the protection status display unit 635 may be implemented to be connected to an external terminal device such as a mobile phone to transmit or exchange information. This connection may be implemented using a communication network (i.e., using a communication network or a specifically designed communication means or method). In this case, the actual display device 80 is the screen of the mobile phone, and the actual user input device 50 is the input means of the mobile phone, and an application for processing this is executed on the mobile phone. In this case, the control device 60 is connected to the mobile phone through a communication module, and the above-mentioned log information management is also possible through this application.

[0053] Let us consider the above-mentioned example of the protected object DB 70 in detail. In the above example, the user has designated the MBR as the protected object, and the write protection method is "access denied". Let us assume that the host computer 10 is infected with a computer virus and the virus attempts to damage the MBR to make booting impossible. The virus in the host computer 10 issues a write operation command to sector 0 constituting the MBR, and the auxiliary storage device 20 first confirms through a file system object confirmation process that sector 0 belongs to the file system object MBR. Then, it confirms by checking the protected object DB 70 that the write operation to the MBR is denied. Therefore, the auxiliary storage device 20 rejects the write operation command of the host computer 10 and notifies the user of this through the display device 80. At this time, the display device 80 may be the screen of a mobile phone running a mobile phone app as described above. That is, when a warning occurs, the app automatically operates to notify the user that the MBR may have been changed or damaged by the write operation command. At this time, the user may view the log information through the app. Therefore, the user can detect abnormal operation of the host computer 10 by synthesizing such information, and can check for abnormality of the host computer 10 by running a vaccination program or by other methods.

[0054] "Access Denied" can also be reported to the host computer in other ways. In the case of the Windows OS, if an error occurs during a write operation, the chkdsk program may be executed to check for bad sectors, but this may have a significant impact on the operation of the host computer. Therefore, the write operation may be reported to the host computer as successful, and the auxiliary storage device may simply display that access has been denied through the protection status display unit 635. However, if the OS supports the functions of the present invention, such an implementation method may not be necessary.

[0055] 7 is a block diagram of an auxiliary storage device 20 according to a third embodiment of the present invention. The third embodiment further includes a process 90 of receiving a user permission input from the user input device 50 of the auxiliary storage device 20 of the second embodiment shown in FIG. 4. The user permission input process 90 is a process for a user to input whether or not access to a corresponding address or file system object is permitted when the protection method of the file system object is "permission confirmation" or "permission confirmation and recovery information storage".

[0056] 8 is a block diagram of the control device 60 of the secondary storage device 20 according to the third embodiment, and includes a modified file system protection module 63'. As shown in FIG. 9, the file system protection module 63' includes a third access information analysis unit 631 for analyzing access information provided by the host computer 10, a file system object confirmation unit 632 for confirming a file system object using a storage space of an access address included in the access information, a second object protection unit 636 for performing an access when a permission confirmation input is input from the user input device 50, and a second protection state display unit 637 for causing the display device driving module 64 to output the type of the file system object and the permission request content to the display device 80 when the confirmed file system object is a protection target object designated by the user and the protection method is "permission confirmation" or "permission confirmation and restore information storage".

[0057] Also, here, the file system protection module 63′ may further include an access log unit 634 that creates and stores log information consisting of access time, address, command type, etc. Using this, a user may manage the log information through an application on a mobile phone.

[0058] The protection status display unit 635 of Fig. 6 and the second protection status display unit 637 of Fig. 9 may be implemented by being connected to an external terminal device such as a mobile phone. In this case, the actual display device 80 is the screen of the mobile phone, the actual user input device 50 is an input means of the mobile phone, and an application for processing this is executed on the mobile phone. In this case, the control device 60 is connected to the mobile phone through a communication module, and the above-mentioned log information management is also possible through this application.

[0059] Let us consider in detail the case where the user designates D: / PEACE.doc as the protection object as in the above example. Here, let us assume that D: / PEACE.doc occupies sectors 100-111. Since the read protection method and write protection method of the file are both "permission confirmation", the file system protection module 63' warns the user of an attempt to write or read and performs a procedure to obtain permission. For example, let us assume that the host computer 10 is infected with ransomware. In this case, the ransomware will encrypt the file and then try to delete the file. Ransomware generally damages files in the form of overwriting in order to disable the deleted file recovery function of Windows. Here, let us assume that the virus of the host computer 10 issues a write operation command to sector 100 of D: / PEACE.doc. The auxiliary storage device 20 first confirms through a file system object confirmation process that sector 100 belongs to the file system object D: / PEACE.doc. Next, it will confirm the protection object DB 70 and confirm that the write operation to D: / PEACE.doc is performed with the user's permission. Therefore, the auxiliary storage device 20 notifies the user on the display device 80 that a write operation command from the host computer 10 to the file D: / PEACE.doc has occurred, and waits for permission.

[0060] At this time, the display device 80 and the user input device 50 can be replaced by a configuration using a communication module and a mobile phone, as described above. In this case, the screen of the mobile phone is the display device 80, and the touch screen or keys are used as the user input device 50, and an application running on the mobile phone drives this device to implement the function of the file system protection module 63'. That is, when a warning occurs, the application automatically operates to notify the user that a write operation command for D: / PEACE.doc has been received from the host computer 10, and displays on the screen a message asking the user whether to allow this, waiting for confirmation. If the user allows it, the write operation command is executed, and if the user rejects it, the host computer 10's write operation command for the corresponding file is rejected.

[0061] As described above, the access information analysis unit 631 of the file system protection module 63, 63' may be implemented in another embodiment by analyzing the file system of the host computer 10 and checking the file system object using the storage space of the access address included in the access information by using a lookup table including sector and cluster information allocated to files, directories, etc. In this case, it is preferable that the lookup table is created at startup or when the auxiliary storage device 20 is in management mode, not during normal operation, and is then used and updated each time the file system is changed.

[0062] Also, the file system protection module 63, 63' can be manufactured as a hardware or a single chip by separating the whole function or only a part of the function (for example, a function of checking a file system object in a lookup table). When the whole function is manufactured as a chip, the file system protection module 63, 63' can be implemented in a form of executing a program code in which a file system protection method is implemented by having its own memory, CPU interface circuit, and high-speed calculation circuit. On the other hand, it is possible to implement a search-only chip by separating only the function of checking a file system object in a lookup table with an FPGA (Field Programmable Gate Array) and a calculation core. In this case, the search-only chip is composed of a CPU interface circuit, a memory interface circuit having its own shared memory or dedicated memory and capable of accessing the memory of the CPU, and a calculation core equipped with a search engine, and performs a task of checking a file system object using sector or cluster information using a lookup table.

[0063] Meanwhile, when the Windows OS receives a response from the auxiliary storage device that access is not possible, it generally automatically executes the chkdsk program. This is a natural operation of the OS to check for a fault in the auxiliary storage device, but in a structure such as the auxiliary storage device 20 of the present invention, it is an unnecessary task that takes a lot of time. Therefore, it would be more preferable to adjust the OS so that this task is not performed using an OS patch program or the like. If adjustment using an OS patch program is difficult, access may be denied by replying to the OS that the access was actually denied but the writing operation was successful. In this case, a problem of data inconsistency may occur, but since the user is in a situation where the file is protected and has also been warned about inappropriate access, he or she can determine that his or her computer is performing an abnormal operation, and therefore can take appropriate measures. Meanwhile, in this case, the OS will command the remaining sectors 101-111 to be written, but it is preferable to eliminate unnecessary user confirmation tasks by applying the user's response to sector 100 to all clusters constituting the corresponding file for a certain period of time.

[0064] The auxiliary storage device to which the above-described file system protection device in an auxiliary storage device or the file system protection method in an auxiliary storage device is applied can be adopted in electronic computing devices or computers (PCs, server computers, mobile terminals, etc.) of various types and uses and implemented to perform the above-mentioned functions.

[0065] Although the configuration of the present invention has been described in detail through the preferred embodiments of the present invention, those skilled in the art will understand that the present invention may be embodied in specific forms different from those disclosed in the present specification without changing the technical idea or essential features of the present invention. It should be understood that the above-described embodiments are illustrative and not limiting in all respects. The scope of protection of the present invention is defined by the claims below rather than the above detailed description, and all modifications or variations derived from the claims and their equivalents should be interpreted as being included in the technical scope of the present invention.

Claims

1. An apparatus for protecting a file system in an auxiliary storage device having a host interface for communicating with a host computer and a data storage device for storing data, comprising: a user input device for receiving information for selecting an operation mode of the auxiliary storage device and related information from a user; a control device for controlling an operation mode of the auxiliary storage device to manage and protect a file system object to be protected; The operation modes of the auxiliary storage device controlled by the control device include a normal mode in which a protection operation is performed when the access object is a file system object to be protected when the host computer accesses the auxiliary storage device, and a management mode in which a user can designate a file system object to be protected by the user as a protection object and set a protection method for the protection object, The management mode further includes a protection object DB in which a protection object designated by a user and a protection method set by the user are stored, In the normal mode, when the host computer accesses a file system object listed in the protection object DB, the protection operation is performed by referring to the protection method of the protection object DB, The method for protecting the protected object includes: A file system protection device in an auxiliary storage device, characterized in that the file system protection device is characterized by being at least one of "warning" which notifies that access has been made to a specific file system object, "permission confirmation" which allows access only with the user's permission, "access denial" which denies access unconditionally, and "save recovery information after permission confirmation" which allows access with the user's permission but saves recovery information for the file system object.

2. The control device 2. The file system protection device in claim 1, further comprising a file system protection module including: an access information analysis unit that analyzes access information provided by a host computer; a file system object confirmation unit that confirms a file system object that is using a storage space of an access address included in the access information; and an object protection unit that selectively processes access to the access address according to a protection method designated by the user if the confirmed file system object is an object to be protected designated by a user.

3. The file system protection module of the control device 3. The file system protection device in an auxiliary storage device according to claim 2, further comprising an access log unit for creating and storing log information including access times, addresses, and command types.

4. 2. The file system protection device in an auxiliary storage device according to claim 1, further comprising a display device for displaying a processing state of said control device.

5. The control device 5. The file system protection device in claim 4, further comprising: an access information analysis unit that analyzes access information provided by a host computer; a file system object confirmation unit that confirms a file system object that is using a storage space of an access address included in the access information; an object protection unit that selectively processes access to the access address according to a protection method designated by a user if the confirmed file system object is an object to be protected designated by a user; and a file system protection module including a protection status display unit that causes a display device driving module to output the type of the file system object and an access processing result to the display device.

6. 2. The device of claim 1, wherein if the access to the specific file system object is a read access, a method of protecting the object to be protected includes at least one of the warning and permission confirmation.

7. 2. The file system protection device in an auxiliary storage device according to claim 1, characterized in that, when the access to the specific file system object is a write access, the user's permission required for permission confirmation and recovery information storage among the protection methods of the protected object is triggered by an approval signal input to the control device from the user's mobile phone.

8. When the method for protecting the file system object is permission confirmation or permission confirmation and restoration information storage, the user input device 2. The device for protecting a file system in an auxiliary storage device as claimed in claim 1, further comprising a user permission input means for a user to input whether or not access to an address or a file system object is permitted.

9. The control device 9. The file system protection device in claim 8, comprising: an access information analysis unit that analyzes access information provided by a host computer; a file system object confirmation unit that confirms a file system object that is using a storage space of an access address included in the access information; a protection status display unit that causes a display device driving module to output the type of the file system object and contents of a permission request to a display device that displays a processing status of the control device when the confirmed file system object is an object to be protected designated by a user and the protection method is permission confirmation or permission confirmation and restoration information storage; and a file system protection module including an object protection unit that performs access when permission confirmation input is input from the user input device.

10. 1. A method for protecting a file system on an auxiliary storage device having a host interface for communicating with a host computer and a data storage device for storing data, comprising: 1) receiving information for selecting an operation mode of the auxiliary storage device and related information from a user; 2) controlling an operation mode of the auxiliary storage device and managing and protecting the file system object to be protected, where the operation mode of the auxiliary storage device includes a normal mode in which a protection operation is performed when the access object is a file system object to be protected when the host computer accesses the auxiliary storage device, and a management mode in which a user can designate a file system object to be protected by the user as a protection object and set a protection method for the protection object; In the management mode, the protected object designated by the user and the protection method set by the user are stored in the protected object DB, In the normal mode, when the host computer accesses a file system object listed in the protection object DB, a protection operation is performed by referring to a protection method of the protection object DB, The method for protecting the protected object is as follows: A method for protecting a file system in an auxiliary storage device, the method being at least one of "warning" which notifies that access has been made to a specific file system object, "permission confirmation" which allows access only with the permission of the user, "access denial" which denies access unconditionally, and "save recovery information after permission confirmation" which allows access with the permission of the user but saves recovery information for the file system object.

11. 11. The method of claim 10, wherein if the access to the specific file system object is a read access, a method of protecting the object to be protected includes at least one of the warning and permission confirmation.

12. 11. The file system protection method in an auxiliary storage device according to claim 10, characterized in that, when the access to the specific file system object is a write access, the permission confirmation and user permission required for saving recovery information among the protection methods of the protected object are triggered by an approval signal input from the user's mobile phone.

Images