CONTROLLER CAPABLE OF PREVENTING SPREAD OF COMPUTER VIRUSES AND STORAGE SYSTEM AND METHOD THEREOF

• US 20100287616A1
• Filed: 07/17/2009
• Published: 11/11/2010
• Est. Priority Date: 05/05/2009
• Status: Active Grant

• Current Assignee: Phison Electronics Corporation
• Original Assignee: Phison Electronics Corporation
• Inventors: Wu, Ming-Chou, Lee, Chien-Fu, Yang, Jiunn-Yeong
• Granted Patent: US 8,776,232 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A controller capable of preventing spread of computer viruses is provided. The controller includes a microprocessor unit, and a first interface unit, a second interface unit, a comparing unit and a filter unit which are coupled to the microprocessor unit. The first interface unit is coupled to a storage medium, and the second interface unit is coupled to a computer host. The comparing unit determines whether data read form the storage medium by the computer host is an automatic executing file. And, the filter unit replaces the read data with a predetermined data and transmit the predetermined data to the computer host when the read data is the automatic executing file. Accordingly, the controller is capable of preventing the spread of the computer viruses designed in an automatic executing file.

Claims

1. A controller, comprising:

a microprocessor unit;

a first interface unit, coupled to the microprocessor unit, and used to connect a storage medium;

a second interface unit, coupled to the microprocessor unit, and used to connect a computer host; and

a data management unit, coupled to the microprocessor unit, and used to transmit a predetermined data to the computer host to replace data read from the storage medium by the computer host when the data read from the storage medium by the computer host is an automatic executing file.

2. The controller as claimed in claim 1, wherein the data management unit comprises:

a comparing unit, coupled to the microprocessor unit, and used to determine whether the data read from the storage medium by the computer host is the automatic executing file; and

a filter unit, coupled to the comparing unit, and used to transmit the predetermined data to the computer host to replace the data read from the storage medium by the computer host when the comparing unit determines the data read from the storage medium by the computer host is the automatic executing file.

3. The controller as claimed in claim 1, wherein the storage medium is a flash memory, and the first interface unit is a flash memory interface unit.

4. The controller as claimed in claim 1, further comprising an enabling/disabling unit coupled to the microprocessor unit and used to enable or disable the data management unit.

5. The controller as claimed in claim 1, further comprising a scan unit, coupled to the microprocessor unit and used to scan the storage medium for the automatic executing file according to a file allocation table (FAT) stored in the storage medium, wherein the scan unit records a address storing the automatic executing file in the storage medium as a tag address.

6. The controller as claimed in claim 5, wherein the data management unit determines whether the data read from the storage medium by the computer host is the automatic executing file according to the tag address.

7. The controller as claimed in claim 1, wherein the predetermined data is a random number or a fixed number with a specific information length.

8. A storage system having a function of preventing spread of computer viruses, comprising:

a controller;

a connector, coupled to the controller, and used to connect a computer host having an operating system;

a storage medium, coupled to the controller, and used to store data to be written by the computer host under control of the controller; and

a data management unit, used to transmit a predetermined data to the computer host to replace data read from the storage medium by the computer host when the data read from the storage medium by the computer host is an automatic executing file.

9. The storage system having a function of preventing spread of computer viruses as claimed in claim 8, wherein the data management unit is configured in the controller.

10. The storage system having a function of preventing spread of computer viruses as claimed in claim 8, wherein the data management unit is configured in the computer host.

11. The storage system having a function of preventing spread of computer viruses as claimed in claim 10, wherein the data management unit comprises:

a comparing unit, used to determine whether the data read from the storage medium by the computer host is the automatic executing file; and

a filter unit, used to transmit the predetermined data to the computer host to replace the data read from the storage medium by the computer host when the comparing unit determines the data read from the storage medium by the computer host is the automatic executing file.

12. The storage system having a function of preventing spread of computer viruses as claimed in claim 8, wherein the storage medium comprises a flash memory or a disk.

13. The storage system having a function of preventing spread of computer viruses as claimed in claim 10, further comprising an enabling/disabling unit coupled to the data management unit and used to enable or disable the data management unit.

14. The storage system having a function of preventing spread of computer viruses as claimed in claim 10, wherein the data management unit is a high-level driver of a storage device driver.

15. The storage system having a function of preventing spread of computer viruses as claimed in claim 14, wherein the storage device driver further comprises a low-level driver, which is used to collect the data read from the storage medium by the computer host, and transmit the collect data to the high-level driver.

16. The storage system having a function of preventing spread of computer viruses as claimed in claim 10, wherein the data management unit is a hook application.

17. A method for preventing spread of computer viruses, comprising:

providing a storage device to couple to a computer host, wherein the computer host has an operating system;

determining whether data read from the storage device by the operating system is an automatic executing file; and

transmitting a predetermined data to the operating system to replace data read from the storage device by the operating system when the data read from the storage device by the operating system is the automatic executing file.

18. The method for preventing spread of computer viruses as claimed in claim 17, further comprising:

scanning the storage device for the automatic executing file according to a file allocation table (FAT) stored in the storage device; and

recording a address storing the automatic executing file as a tag address when the automatic executing file is found.

19. The method for preventing spread of computer viruses as claimed in claim 18, wherein the step of determining whether the data read from the storage device by the operating system is the automatic executing file comprise:

determining whether the operating system reads the data from the tag address; and

determining the data read from the storage device by the operating system is the automatic executing file when the operating system reads the data from the tag address.

20. The method for preventing spread of computer viruses as claimed in claim 17, wherein the step of determining whether the data read from the storage device by the operating system is the automatic executing file comprises:

recognizing whether the data read from the storage device by the operating system is the automatic executing file through a storage device driver configured in the operating system which is used to drive the storage device.

21. The method for preventing spread of computer viruses as claimed in claim 17, wherein the step of determining whether the data read from the storage device by the operating system is the automatic executing file comprise:

intercepting the data read from the storage device by the operating system through a hook application that is configured in the operating system; and

determining whether the data read by the operating system is the automatic executing file.

22. The method for preventing spread of computer viruses as claimed in claim 17, wherein the predetermined data is a random number or a fixed number with a specific information length.