JPH06149681A - Circuit and method for protecting hard disk and floppy disk from computer virus - Google Patents

Abstract

(57) [Summary] (Correction) [Purpose] To prevent data (information) on the disk from being destroyed by virus programs. An address decoder means and a means for storing a protection program connected to a data bus, a buffer memory means used by the protection program, and a hard and floppy disk controller are directly used without the protection program being operated. The first step of having a motion sensing means for monitoring and selecting only during the initialization function and the write function which directly affects the disk during the function required after the motion sensing circuit is disabled, whether the protection program should be used or not. The second step of judging, the third step of judging the state of the disc and the requested writing area,
In addition, according to the state of the third step, it is determined whether the program should be continued or not and the fourth step is performed to prevent the information stored in the disk from being destroyed by the virus program.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a circuit for protecting a hard disk or a floppy disk from a computer virus and a protection method using the circuit.

With the advent of the computer age, a program (referred to as a “computer virus”) that interferes with the normal functioning of a computer has appeared and has become annoying.

A computer virus is a program that has already been written by someone, and the program stored in the disk moves to the main memory device of the computer when the computer is activated and destroys the data on the disk used by the computer. It disables the whole or part of the disk, and adversely affects program execution.

[0004]

2. Description of the Related Art A conventional method for eliminating computer viruses is as follows.

Before using a program or diskette, a method capable of inspecting a virus in advance is used to determine whether or not a virus has been infected, and a method for resident a virus detection program in the system to inspect a virus is used. This method can be used only when the operating system (hereinafter simply referred to as "OS") is driven, so there is no way to prevent it from being infected with the OS, even if the virus program changes slightly. The virus detection program could not detect this, there was no countermeasure against the new virus, and the process that had to be performed to inspect the virus was difficult. Furthermore,
Even if a hard disk system has a built-in virus check program and it is checked during OS booting, there is no countermeasure when booting through a floppy disk, and the hardware used once the system is infected by a virus. Also, there is a problem that the infection of the floppy disk cannot be prevented.

[0006]

SUMMARY OF THE INVENTION The present invention devised to solve the above problems prevents data (information) stored by utilizing the characteristics of a hard disk and a floppy disk from being destroyed by a virus program. It is an object of the present invention to provide a hard and floppy disk protection circuit that fundamentally deals with the problem, and a hard and floppy disk protection method using the above circuit.

[0007]

In order to achieve the above object, the present invention provides an address which is connected to an address bus and outputs a selection signal in a circuit for protecting a hard disk and a floppy disk from a virus program of a computer system. Decoder means, means for storing a protection program connected to the address decoder means and the data bus, buffer-memory means connected to the address decoder means and the data bus and used by the protection program, The address decoder means and the operation sensing means connected to the data bus to monitor the direct use of the hard disk and the floppy disk controller without the protection program being operated, so that the stored information is not destroyed by the virus program. In the method for protecting hard and floppy disks using the above circuit, the method for protecting the hard disk and the floppy disk using the above-mentioned circuit is performed at the time of the initialization function and the write function that directly affect the functioning disk after the operation sensing circuit is disabled. A first step of selecting only, a second step of determining whether a protection program should be used, a third step of determining the state of the disk and a required writing area,
And a fourth step of processing by judging whether or not the program should be continued according to the state of the third step, and fundamentally coping with that the information stored in the disk is not destroyed by the virus program. .

[0008]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described in detail below with reference to the accompanying drawings.

FIG. 1 is a block diagram schematically showing the configuration of a computer system to which the present invention is applied.
0 is a central processing unit (CPU), 200 is a system ROM
Bios (BIOS: Basic Input Output System), 300 is system memory, 400
Shows a hard disk and floppy disk protection circuit according to the present invention, respectively, and the protection circuit 400 of the present invention is connected to the system as shown in FIG.
The initialization part is executed in the same manner as when the M BIOS is executed, and the processing program that sets necessary information at the time of disk protection and controls the flow of the protection program is installed so as to be executed before the disk processing program. .

FIG. 2 shows the structures of a hard disk and a floppy disk, where a is a data area and b is an information area. The information area b is further a directory (Directory)
It is divided into a feed C, a file allocation table d, and a disc information area e. The disk information area e is an area for storing the physical information of the corresponding disk, and the file allocation table area d shows the structure in which files and the like are stored in the data area a to discriminate the files and the like. , Special codes are used for linked files and bad data areas.

The directory feed c is composed of a file name, a date when the file was created, a size of the file, information related to the file in the file allocation table, a file attribute and the like.

The above three areas c, d, and e can be classified as appropriate data or inappropriate data according to their respective characteristics.

However, whether or not the data area a is valid data cannot be divided at all. However,
It is possible to inspect whether there is a symptom of a virus by prohibiting writing and initialization in all the above areas and using a suspicious program.

FIG. 3 is a block diagram showing a schematic structure of a circuit for protecting a hard disk and a floppy disk from a virus according to the present invention. 410 is an expansion bus, 420 is an address bus decoder section, and 430 is a protection program. The ROM BIOS section 440, a buffer memory section 440 used by the protection program, and 450 an operation sensing circuit section.

As shown in FIG. 1, the protection circuit of the present invention is connected to a computer system to operate, is connected to an address bus, and has an address decoder unit 420 for selecting each unit at the rear end, and the above-mentioned unit. A ROM BIOS section 430 connected to the output terminal of the address decoder section 420 and the data bus and containing a protection program, and a ROM BIOS section 430 connected to the output terminal of the address decoder section 420 and the data bus and required when the protection program operates. A hard and floppy disk controller (not shown) is directly connected to the buffer memory section 440, the output terminal of the address decoder section 420, and the data bus so that the protection program and the disk control program do not operate. From the motion sensing circuit unit 450 that dealt with Composed.

As shown in FIG. 4, the operation detecting circuit unit 450 is connected to the address decoder unit 420 and the data bus to select whether to detect the operation completion signal, a flip-flop 451 and an output terminal of the flip-flop 451 and an expansion bus. An AND gate 452 is connected to 410 to selectively input an operation completion signal (interrupt acknowledge) and output an NMI (non-maskable interrupt) signal or various interrupt signals, or a signal using a similar function, When the disk control program or the protection program operates, the monitoring function is stopped, and when the controller directly operates in the hibernation state, the protection program is provided so that NMI, various interrupt signals, or signals using similar functions are called. do it That NMI, or various interrupt signals or or alert the user by a signal processing portion to use the similar functions, and so as to stop the system. 5 is an operation diagram of a hard disk and a floppy disk of a computer system to which the present invention is applied as described above. 10 is a block in which an application program is executed, 20 is a block in which a protection program according to the present invention is executed, and 30 is a block. A block for executing a hard disk and floppy disk control program, a block for operating a hard disk and a floppy disk controller, a block for driving a hard disk and a floppy disk, and a block for executing hardware operation monitoring function of the present invention. And the dotted line portion in the drawing shows the portion added in the present invention.

Application programs and virus programs are
The hard disk and floppy disk control programs are used through the protection function program of the present invention, and the virus detection program detects the signal generated as the operation completion signal during the control operation and directly uses the hard disk or the floppy disk without the protection program. It also detects when.

The protection program of the present invention checks the disk initialization function and the writing function which affect these disks during the hard disk and floppy disk control programs to check whether the operation is in the correct form or proper data is written. In order to prevent the computer from being infected with computer virus or the system being damaged by inspecting whether or not it is present, and by notifying the user or shutting down the system, see FIG. 6 in more detail. explain.

FIG. 6 is a flow chart of a protection program and a hard disk and floppy disk control program according to the present invention.

According to the protection program of the present invention, after the motion sensing circuit is first disabled (21), a selective inspection is performed only at the initialization function or the write function affecting the disk (22), and the protection program should be used. If the protection program is used, it is checked (23) whether the entire disk is write-protected (24), and if it is not write-protected, it is judged which area the requested function is writing (25). ), If the area is write-protected, it is confirmed whether or not it should be continued (27). If the writing area is the file list and the file application table area in the writing area judgment (25), it is confirmed whether the data to be written is proper data (26). And executing the floppy disk control program, else go to the step of determining whether to continue. If the write area is the data area in the write area determination 25, the program immediately goes over to the hard disk and floppy disk control programs, and if the write area is the disk information area, the process proceeds to a determination step 27 as to whether or not to continue.

In the step 27 of deciding whether or not to continue, if the progress is possible, proceed to the hardware and floppy disk control program to perform the service routing (31).
Thereafter, the motion sensing circuit is enabled, and if it is judged that the progress is impossible, the system is stopped 28, thereby completing all the operations.

FIG. 7 shows that the hardware operates in the situation where the protection program as described above does not operate, and it is judged whether the operation should continue (72), and the operation proceeds (7).
3) A flow chart of a program using an NMI or various interrupt signals or similar functions for performing the function of stopping the system is shown.

[0023]

The present invention constructed and operated as described above has the following effects.

(1) The circuit of the present invention can be added to an existing system to easily protect a disk, and the presence or absence of virus infection can be confirmed.

(2) Since the protection program operates from the time of initializing the hardware (hardware and floppy disk), the safety is improved.

(3) Even if the virus is modified or a new virus is created, a new protection program is not necessary.

(4) It operates regardless of floppy or hard disk booting.

(5) By adding the circuit of the present invention to a computer system, it is possible to prevent the system from being destroyed due to an error during use.

(6) It operates regardless of the operating system (OS).

(7) The virus intrusion is continuously monitored to improve the reliability of information storage.

[Brief description of drawings]

FIG. 1 is a block diagram schematically showing the configuration of a computer system to which the present invention is applied.

FIG. 2 is a structural diagram of a hard disk and a floppy disk.

FIG. 3 is a block diagram showing a schematic configuration of a protection circuit for a hard disk and a floppy disk according to the present invention.

4 is a detailed circuit diagram of an operation monitoring circuit unit in FIG.

FIG. 5 is a hard disk drive and floppy disk operation diagram of a computer system to which the present invention is applied.

FIG. 6 is a flow diagram of a protection program and a hardware and floppy disk control program according to the present invention.

FIG. 7 is a flow diagram of an NMI program according to the present invention.

[Explanation of reference numerals] 10 application program 20 protection program 30 hard and floppy disk protection program 40 hard and floppy disk controller 50 hard and floppy disk drive 60 hard and floppy disk motion sensor 100 CPU 200 system ROM BIOS 300 system memory 400 hardware / Floppy disk protection circuit 410 Expansion bus 420 Address decoder section 430 ROM BIOS section with protection program 440 Buffer memory section used by protection program 450 Motion detection circuit section 451 Flip-flop 452 AND gate a Data area b Information area c Directory area d file Allocation table area e Disk information area

Claims (7)

[Claims] 1. A circuit for protecting a hard disk and a floppy disk from a virus program in a computer system; address decoder means (420) connected to an address bus and outputting a selection signal; the address decoder means (420) and a data bus. Means for storing protection programs connected to
0) and buffer means (440) connected to the address decoder means (420) and the data bus and used by the protection program, which is fundamental to prevent the stored information from being destroyed by a virus program. A hard disk and floppy disk protection circuit characterized by coping with. 2. A motion sensing means (450) connected to the address decoder means (420) and the data bus, for monitoring direct use of the hard disk and floppy disk controller without the protection program being operated. The hard disk and floppy disk protection circuit according to claim 1, further comprising: a fundamental measure to prevent stored information from being destroyed by a virus program. 3. The operation sensing means (450) comprises a flip-flop (451) connected to an address decoder means (420) and a data bus, and an AND gate connected to an output terminal of the flip-flop (451) and an expansion bus. 3. The hard disk and floppy disk according to claim 2, wherein the hard disk and floppy disk are configured as (452), and when the hard disk and floppy disk controllers operate under the protection program fine operation state, a warning is given to the user and the system is stopped. Protection circuit. 4. An address decoder means (420) connected to the address bus for outputting a selection signal, and means (430) connected to the address decoder means and the data bus for storing a protection program. Buffer means (44) connected to the address decoder means and the data bus and used by the protection program.
0) and an operation sensing means (450) connected to the address decoder means and the data bus to monitor the operation of the hard and floppy disk controller, and a computer having a built-in hard and floppy disk protection circuit. In the system hard and floppy disk protection method; after the motion sensing circuit is disabled (21), select only during initialization and write functions that directly affect the functioning disk required (22), first step And determine if a protection program should be used (23) second
Stage, disc state (24) and discriminating required write area (25), third stage, and step 27, determining whether the program should continue depending on the state of the third stage (27) And a method for protecting a hard disk and a floppy disk, which is characterized by fundamentally preventing the information stored in the disk from being destroyed by a virus program. 5. The third step comprises a first step (24) of determining whether the entire disk is write-protected, and which area is written if the entire disk is not write-protected in the first step (24). A second step (25) of determining whether to request, and if the write request of the second step is a file list and file application table area, it is determined whether it is proper data (26) and the data is processed. If the area is an area, the hard and floppy control programs are immediately executed, and if the area requested to be written is the disk information area, the program is executed by a third step of advancing to a step of determining whether or not to continue. The method for protecting a hard disk and a floppy disk according to claim 4. 6. The fourth step is to judge whether or not to continue (27), and if it can be continued, execute a hardware and floppy control program (31, 32), and if not, 5. The hard disk and floppy disk protection method according to claim 4, wherein the system is stopped (28) and the corresponding disk is protected so that data is preserved. 7. When the hard and floppy disk controllers are operated without performing the second and third steps after the first step is performed, it is detected whether the system should be continued or stopped. The hard disk and floppy disk protection method according to claim 4, further comprising a fifth step of judging and processing.