Controller capable of preventing spread of computer viruses and storage system and method thereof

• US 8,776,232 B2
• Filed: 07/17/2009
• Issued: 07/08/2014
• Est. Priority Date: 05/05/2009
• Status: Active Grant

• Current Assignee: Phison Electronics Corporation
• Original Assignee: Phison Electronics Corporation
• Inventors: Yang, Jiunn-Yeong, Lee, Chien-Fu, Wu, Ming-Chou
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US12/504,947
• Publication Number:
  US 20100287616A1
• Time in Patent Office: 1,817 Days
• Field of Search: 726 22- 25
• US Class Current: 726/24
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A controller capable of preventing spread of computer viruses is provided. The controller includes a microprocessor unit, and a first interface unit, a second interface unit, a comparing unit and a filter unit which are coupled to the microprocessor unit. The first interface unit is coupled to a storage medium, and the second interface unit is coupled to a computer host. The comparing unit determines whether data read form the storage medium by the computer host is an automatic executing file. And, the filter unit replaces the read data with a predetermined data and transmit the predetermined data to the computer host when the read data is the automatic executing file. Accordingly, the controller is capable of preventing the spread of the computer viruses designed in an automatic executing file.

Claims

1. A controller, comprising:

a microprocessor unit;

a first interface unit, coupled to the microprocessor unit and configured to connect to a storage medium;

a second interface unit, coupled to the microprocessor unit and configured to connect to a computer host; and

a data management unit, coupled to the microprocessor unit and configured to read data from the storage medium,

wherein the data management unit determines whether the data read from the storage medium is an automatic executing file,

if the data read from the storage medium is the automatic executing file, the data management unit replaces the data read from the storage medium, which is a copy of at least a part of the automatic executing file, with a predetermined data and transmits the predetermined data to the computer host,

wherein when the computer host receives the predetermined data, none operation is executed by the computer host in response to the predetermined data.

2. The controller as claimed in claim 1, wherein the data management unit comprises:

a comparing unit, coupled to the microprocessor unit and configured to determine whether the data read from the storage medium by the computer host is the automatic executing file; and

a filter unit, coupled to the comparing unit and configured to replace the automatic executing file with a predetermined data and transmit the predetermined data to the computer host if the comparing unit determines the data read from the storage medium by the computer host is the automatic executing file.

3. The controller as claimed in claim 1, wherein the storage medium is a flash memory, and the first interface unit is a flash memory interface unit.

4. The controller as claimed in claim 1, further comprising an enabling/disabling unit coupled to the microprocessor unit and used to enable or disable the data management unit.

5. The controller as claimed in claim 1, further comprising a scan unit, coupled to the microprocessor unit and used to scan the storage medium for the automatic executing file according to a file allocation table (FAT) stored in the storage medium, wherein the scan unit records an address storing the automatic executing file in the storage medium as a tag address.

6. The controller as claimed in claim 5, wherein the data management unit determines whether the data read from the storage medium by the computer host is the automatic executing file according to the tag address.

7. The controller as claimed in claim 1, wherein the predetermined data is a random number or a fixed number with a specific information length.

8. A storage system having a function of preventing spread of computer viruses, comprising:

a controller;

a connector, coupled to the controller and configured to connect to a computer host having an operating system;

a storage medium, coupled to the controller and configured to store data to be written by the computer host under control of the controller; and

a data management unit, configured to read data from the storage medium,

wherein the data management unit determines whether the data read from the storage medium is an automatic executing file,

if the data read from the storage medium is the automatic executing file, the data management unit replaces the data read from the storage medium, which is a copy of at least a part of the automatic executing file, with a predetermined data and transmits the predetermined data to the computer host,

wherein when the computer host receives the predetermined data, none operation is executed by the computer host in response to the predetermined data.

9. The storage system having a function of preventing spread of computer viruses as claimed in claim 8, wherein the data management unit is configured in the controller.

10. The storage system having a function of preventing spread of computer viruses as claimed in claim 8, wherein the data management unit is configured in the computer host.

11. The storage system having a function of preventing spread of computer viruses as claimed in claim 10, wherein the data management unit comprises:

a comparing unit and configured to determine whether the data read from the storage medium by the computer host is the automatic executing file; and

a filter unit and configured to replace the automatic executing file with a predetermined data and transmit the predetermined data to the computer host if the comparing unit determines the data read from the storage medium by the computer host is the automatic executing file.

12. The storage system having a function of preventing spread of computer viruses as claimed in claim 8, wherein the storage medium comprises a flash memory or a disk.

13. The storage system having a function of preventing spread of computer viruses as claimed in claim 10, further comprising an enabling/disabling unit coupled to the data management unit and configured to enable or disable the data management unit.

14. The storage system having a function of preventing spread of computer viruses as claimed in claim 10, wherein the data management unit is a high-level driver of a storage device driver.

15. The storage system having a function of preventing spread of computer viruses as claimed in claim 14, wherein the storage device driver further comprises a low-level driver, wherein the low-level driver is configured to collect the data read from the storage medium by the computer host and transmit the collect data to the high-level driver.

16. The storage system having a function of preventing spread of computer viruses as claimed in claim 10, wherein the data management unit is a hook application.

17. A method for preventing spread of computer viruses, comprising:

reading data from the storage medium according to a read command received from an operating system of a computer host;

determining whether the data read from the storage device is an automatic executing file; and

if the data read from the storage medium is the automatic executing file, replacing the data read from the storage medium, which is a copy of at least a part of the automatic executing file, with a predetermined data and transmitting the predetermined data to the operating system,

wherein when the operating system receives the predetermined data, none operation is executed by the operating system in response to the predetermined data.

18. The method for preventing spread of computer viruses as claimed in claim 17, further comprising:

scanning the storage device for the automatic executing file according to a file allocation table (FAT) stored in the storage device; and

recording an address storing the automatic executing file as a tag address when the automatic executing file is found.

19. The method for preventing spread of computer viruses as claimed in claim 18, wherein the step of determining whether the data read from the storage device is the automatic executing file comprise:

determining whether the read command requests to read the data from the tag address; and

identifying the data read from the storage device is the automatic executing file if the operating system reads the data from the tag address.

20. The method for preventing spread of computer viruses as claimed in claim 17, wherein the step of determining whether the data read from the storage device is the automatic executing file comprises:

recognizing whether the data read from the storage device is the automatic executing file through a storage device driver configured in the operating system which is used to drive the storage device.

21. The method for preventing spread of computer viruses as claimed in claim 17, wherein the step of determining whether the data read from the storage device is the automatic executing file comprise:

intercepting the data read from the storage device through a hook application that is configured in the operating system; and

determining whether the data read by the operating system is the automatic executing file.

22. The method for preventing spread of computer viruses as claimed in claim 17, wherein the predetermined data is a random number or a fixed number with a specific information length.