CN101819611B - Real-time comparison and defending method of input data and hardware thereof - Google Patents

Abstract

A real-time comparison and protection method for input data and its hardware, the method includes the following steps: firstly, a piece of data is input to the hardware through an input device connected with the hardware. Then record the data and send the data to an application program of an operating system. Then, the application program processes the data and generates a result data. The result data is received through a control application program and made into a piece of data to be tested, and then the data to be tested is returned to the hardware. Then use an inverse processing unit of the hardware to perform a reverse disassembly operation on the resulting data. Finally, a comparison unit of the hardware is used to compare the data with the data to be tested. In order to achieve the purpose of immediately using the hardware to judge whether the result data is damaged.

Description

Input data real-time comparison protection method and its hardware

technical field

The invention relates to a comparison and protection method and its hardware, in particular to an instant comparison and protection method for input data and its hardware.

Background technique

Due to the vigorous development of information industry technology, computers and the Internet have become an indispensable part of people's lives today. Whether it is personal data or company business data, they can be stored through the media of computers and networks. However, due to the popularization of the Internet today, a large number of network hackers have risen, and they have maliciously invaded, destroyed computer systems, tampered with computer internal data and other illegal activities, which have caused considerable harm to computer information security! As a result, many individuals and enterprises have suffered higher and higher losses, so various technologies for maintaining information security and the developed tool software have been born.

In order to prevent hackers from invading and destroying the data in the computer through various methods and channels, the current common methods can be divided into two mainstream technical means: pre-blocking prevention and post-inspection reconstruction:

Regarding pre-blocking prevention, the most important thing is to prevent hackers once and for all by establishing a firewall, so that the data in the computer is free from the crisis of being tampered with. But after all, the road is one foot high, and the magic is one foot high. Although the firewall technology can block most illegal hackers from invading, after all, some hackers who understand the internal structure of the network can find special network security loopholes or use the method of implanting malicious programs. Enter other people's computers, and then tamper with internal data, so the firewall cannot completely prevent data from being tampered with.

As for the after-the-fact inspection and reconstruction, it is a method of repairing the past, and there are two common methods: one is to use manual methods to check and inspect all the original input data one by one, although it can effectively and thoroughly check which data Altered or destroyed, but this method is very inefficient. Therefore, another way is to use a large-capacity storage device with a program with a hash function (Hash function) function to specify a hash value of a random number that is very difficult to repeat, and pass each input data through the operation of the hash function. Given a unique hash value, the data is backed up in the storage device. Therefore, after a period of time or after some calculations, it is possible to check whether the hash value of the data is consistent with the original recorded value. If there is a difference, if not, then due to the very difficult repeatability of the hash function, it can be known that the data has been tampered with, changed or destroyed, so the backup data is found from the storage device for reconstruction.

Although the characteristics of the hash function can be used to effectively and quickly check which input data has been tampered with, however, the use of this method is not perfect. The program may also be infected, damaged or even tampered with by viruses, causing its function to malfunction and fail to detect abnormalities in the input data, allowing hackers and other criminals to avoid detection and take advantage of the opportunity to invade, destroy and tamper data.

Therefore, how to propose a detection method and device that is difficult to be destroyed by criminals and can quickly and effectively input data and compare detection has become a research direction that related industries want to work hard on.

Contents of the invention

An object of the present invention is to provide a protection hardware for real-time comparison of input data. The input data instant comparison protection hardware of the present invention is suitable for comparing a sum of data input by a connected input device with a sum of result data in an operating system including an application program and a control application program, and The result data is generated by the application program processing the data, and the hardware includes an inverse processing unit and a comparison unit.

The inverse processing unit receives the result data sent back by the control application program, and performs a reverse disassembly operation on the result data to obtain a piece of data to be tested.

The comparison unit receives and records the data input by the input device, and compares the data with the data to be tested sent from the reverse processing unit.

Then, another object of the present invention is to provide a method for instant comparison and protection of input data.

The input data instant comparison protection method of the present invention comprises the following steps:

(1) Inputting a piece of data into the hardware by means of an input device connected to the hardware.

(2) Record the data in the hardware.

(3) Sending the data to an application program in an operating system.

(4) The application program processes the data and generates a result data.

(5) Receive the result data through a control application program, make it a piece of data to be tested, and then return the piece of data to be tested to the hardware.

(6) Using an inverse processing unit of the hardware to perform a reverse disassembly operation on the result data, and then transmit it to the comparison unit of the hardware.

(7) Use a comparison unit of the hardware to compare the data and the data to be tested, and judge whether the two are the same, if so, it means that the result data is correct, if not, it means that the result data was corrupted within the operating system.

The beneficial effect of the present invention is that: by means of the inverse processing unit of the hardware, the result data generated by the operation of the application program on the data is reversely disassembled into the data to be tested, and the comparison unit of the hardware compares the result data of the data. The data to be tested is compared with the original data to achieve the purpose of quickly and effectively judging whether the result data has been tampered with or destroyed.

Description of drawings

Fig. 1 is a block diagram illustrating a preferred embodiment of each element configuration aspect of the present invention's input data real-time comparison protection hardware; and

Figure 2 is a flowchart of the operation of the preferred embodiment.

Detailed ways

Below in conjunction with accompanying drawing and embodiment the present invention is described in detail:

Referring to Fig. 1, the preferred embodiment of the present invention's input data instant comparison protection hardware 3 is applicable to a piece of data 11 inputted by a connected input device 1 and an application program 21 and a control application program 22 A result data 211 in the operating system 2 is compared, and the result data 211 is generated by the application program 21 processing the data 11, and the hardware 3 includes an inverse processing unit 31 and a comparison unit 32 .

The reverse processing unit 31 receives the result data 211 returned by the control application program 22 , and performs a reverse disassembly operation on the result data 211 to obtain a test data 311 .

The comparison unit 32 receives and records the data 11 input by the input device 1 , and compares the data 11 with the data to be tested 311 transmitted from the reverse processing unit 31 . And when the comparing unit 32 compares the data 11 and the data to be tested 311 with the same result, the result data 211 is stored for future data reconstruction. On the contrary, when the comparison result is different, an exception message 321 is output, and the control application program 22 is notified to discard the result data 211 .

In addition, it is worth mentioning that in practical applications, the hardware 3 may further include a control unit 33 connected to the inverse processing unit 31 and the comparison unit 32, so as to control the inverse processing unit 31 and the comparison unit 32 in a unified manner. The operation of the comparison unit 32, such as controlling the flow of the data 11, the result data 211, the data to be tested 311 and the abnormal information 321, when the data 11 must be stored or other operating procedures, etc., is due to The control unit 33 can be used in a very wide range, so it should not be limited to the description of this embodiment.

Referring to Fig. 1 and Fig. 2, the method corresponding to the preferred embodiment of the above-mentioned hardware 3 comprises the following steps:

First, as shown in step 50 , the application program 21 in the operating system 2 is switched from a hidden file to a read-only file that cannot be overwritten by the operating system 2 .

Next, as shown in step 51 , a monitoring program 23 in the operating system 2 is switched from a hidden file to a read-only file that cannot be overwritten by the operating system 2 .

Next, as shown in step 52 , the data 11 is input into the hardware 3 via the input device 1 connected to the hardware 3 . In this preferred embodiment, the mentioned input device 1 may be a keyboard, a mouse, a touch pad and other devices capable of inputting information.

Next, as shown in step 53 , the data 11 is recorded in the hardware 3 . In this preferred embodiment, the data 11 is recorded in the comparison unit 32 of the hardware 3, but in practical applications, the data 11 can also be stored in other storage units with storage functions in the hardware 3 In (not shown in the figure), this is easily conceivable and varied by those skilled in the art, so it should not be limited to the specific example of the preferred embodiment.

Next, as shown in step 54 , the data 11 is sent to the application program 21 .

Then, as shown in step 55 , the application program 21 processes the data 11 and generates the result data 211 .

As shown in step 56 , the application program 21 is monitored by the monitoring program 23 , and when the result data 211 generated by the application program 21 is detected, the result data 211 is sent to the control application program 22 .

What needs to be supplemented here is that the steps of converting the application program 21 and the monitoring program 23 from the hidden form to the read-only form mentioned above in step 50 and step 51 are carried out in sequence. Or carry out at the same time, or intersperse with other steps before the step 56, only need to pay attention to the principle that the mode switching must be completed before the operation of the application program 21 and the monitoring program 23. This is for those skilled in the art It is easy to change and transfer, so it should not be limited to what is disclosed in this preferred embodiment.

Then, as shown in step 57 , the result data 211 is received by the control application program 22 in the operating system 2 and made into the test data 311 , and then the result data 211 is sent back to the hardware 3 . And the control application 22 in this preferred embodiment is a read-only file that cannot be overwritten by the operating system 2 .

It is worth mentioning that the above-mentioned application program 21, monitoring program 23 and control application program 22 are set as read-only files. Prevent these programs from being maliciously tampered with or destroyed by unscrupulous persons.

Next, as shown in step 58 , the inverse processing unit 31 of the hardware 3 is used to reversely disassemble the data to be tested 311 and send it back to the comparison unit 32 of the hardware 3 .

Finally, as shown in step 59, use the comparison unit 32 of the hardware 3 to compare the data 11 and the data to be tested 311 to determine whether they are the same:

If yes, as shown in step 591, it means that the result data 211 is correct, and the result data 211 is stored in a protected area (not shown), so as to facilitate data reconstruction in the future. However, in this preferred embodiment, the protected area does not exist under the operating system 2 , and the protected area can only be accessed through the hardware 3 .

If not, then as shown in step 592, it means that the result data 211 has been damaged when it is generated in the operating system 2, and the result data 211 is discarded, and the abnormal information 321 is displayed on a display device 4 superior.

Next, still referring to Fig. 1 and Fig. 2 in the same way, how a user will use the hardware 3 and related methods described in the above preferred implementation to perform the operation on a computer (not shown) The input data 11 is checked and compared as an example to make a more complete description of the operation process:

Before explaining, it will be assumed that the application program 21 is a Chinese spelling input method application program (just a kind of text input method application program utilizing at least one original code), and the result data 211 is a Chinese character code (that is, A word code that is made up of the original code), and the reverse disassembly operation of the reverse processing unit 31 is to reversely disassemble the result data 211 with the Chinese character code form into at least one spelling symbol (that is, the original code ).

At the beginning, after the pre-work that assumes that the setting of the application program 21 and the monitoring program 23 has been completed as a read-only form, the user utilizes a keyboard directly connected to the hardware 3 (that is, the input device 1) to perform Chinese Typing operation, at this time, when the user typed Chinese on the keyboard according to the spelling input method, the hardware 3 sent these spelling symbols (that is, data) to the Chinese spelling input method application program in the operating system 2 ( Just when the application program 21), these spellings are also stored in the comparison unit 32.

Then, the Chinese spelling input method application program is converted into corresponding Chinese character codes (being the result data 211) according to the received spelling characters; While editing the application program 24, when the monitoring program 23 detects the Chinese character codes generated by the Chinese spelling input method application program, these Chinese character codes will be sent to the hardware through the medium of the control application program 22 Inverse processing unit 31.

Then, the reverse processing unit 31 uses the reverse disassembly operation to disassemble these Chinese character codes into spelling symbols to be detected (that is, the data to be tested 311), and then hand these data to be tested 311 to the same hardware Comparing unit 32 within.

Finally, the comparison unit 32 compares the spelling symbols (data 11) input by the user through the keyboard with the spelling symbols to be tested (data to be tested 311) to determine the Chinese character Whether the code (result data 211) has been tampered with or destroyed.

When the comparing result of these spelling symbols and the spelling symbols to be tested is the same by the comparison unit 32, it means that the Chinese character code produced by the Chinese spelling input method application program is not tampered with or destroyed. , and can be used for follow-up operations and these Chinese character codes can be stored; yet, when the comparison result of the comparison unit 32 is different, the abnormal information 321 is output, and by means of display devices such as liquid crystal screens 4. Present the abnormal information 321, and notify the control application program 22 to discard the Chinese character code (result data 211).

From the above, it can be known that the instant input data comparison protection method and its hardware 3 of the present invention mainly use the reverse processing unit 31 of the hardware 3 to reversely disassemble the result data 211 generated by the application program 21 for the data 11. Decomposing the data to be tested 311, and the comparison unit 32 of the hardware 3 compares and detects the data to be tested 311 with the original data 11, so as to quickly and effectively determine whether the result data 211 has been tampered with or destroyed .

In addition, the present invention not only proposes the protection function of detecting whether the input data 11 is destroyed or tampered with in real time, but also because the application program 21, the monitoring program 23 and the control application program 22 are all in a read-only form when executing their operations. , to prevent these programs from being maliciously tampered with or destroyed by lawless persons, so as to achieve the effect of improving the double protection of data security, so the purpose of the present invention can indeed be achieved.

Claims (13)

1. An input data instant comparison protection method is characterized in that comprising the following steps: (1) Inputting a piece of data into the hardware through an input device connected to the hardware; (2) Record the data in the hardware; (3) Sending the data to an application program in an operating system; (4) The application program processes the data and generates a result data; (5) Receive the result data through a control application program and make it a piece of data to be tested, and return the data to be tested to the hardware; (6) Using a reverse processing unit of the hardware to perform a reverse disassembly operation on the data to be tested; and (7) Use a comparison unit of the hardware to compare the data and the data to be tested, and judge whether the two are the same, if so, it means that the result data is correct, if not, it means that the result data was corrupted within the operating system. 2. The input data real-time comparison protection method according to claim 1, characterized in that: in the step (2), the data is recorded in the comparison unit of the hardware. 3. the input data instant comparison protection method as claimed in claim 2, is characterized in that: in this step (7), when judging that this piece of data and this piece of result data are identical, this piece of result data is stored in within a protected area. 4. the input data instant comparison protection method as claimed in claim 3 is characterized in that: in the step (7), the protected area does not exist under the operating system, but only the protected area can be protected by the hardware. to access. 5. the input data instant comparison protection method as claimed in claim 3, is characterized in that: in this step (7), when judging that this data and this result data are different, this result data is discarded, And display an abnormal message on a display device. 6. The input data real-time comparison protection method as claimed in claim 5, characterized in that: also comprising a step (eight) between the step (four) and the step (five), by a monitoring program for the The application program monitors, and when the result data generated by the application program is detected, the result data is sent to the control application program. 7. the input data instant comparison protection method as claimed in claim 6, is characterized in that: also comprise a step (nine) before this step (4), this application program is before this data is processed, from A file in hidden form is switched to a read-only form that cannot be overwritten by the operating system and processed later. 8. The input data real-time comparison protection method according to claim 7, characterized in that: in the step (5), the control application program is a read-only file that cannot be overwritten by the operating system. 9. the input data instant comparison protection method as claimed in claim 8, is characterized in that: also comprise a step (ten) before this step (eight), this monitoring program is before this application program is monitored, from A file in hidden form is switched to a read-only form that cannot be overwritten by the operating system and processed later. 10. The input data instant comparison protection method as claimed in claim 1, characterized in that: in the step (3) and the step (4), the application program is a text input method application utilizing at least one original code program, and the result data is a character code, and in the step (6), the reverse disassembly operation of the reverse processing unit reversely disassembles the result data in the form of character code into the original code. 11. An input data real-time comparison protection hardware, suitable for comparing a piece of data input by a connected input device with a piece of result data in an operating system including an application program and a control application program , and the result data is generated by the application program processing the data, characterized in that: the hardware includes a comparison unit and an inverse processing unit, the comparison unit receives and records the data input by the input device , and receive the return of the result data ordered as a piece of data to be tested, and then compare the data with the data to be tested, the reverse processing unit is connected between the control application program and the comparison unit, and then Before the comparison unit receives the data to be tested returned by the control application program, it performs a reverse disassembly operation on the data to be tested, and then transmits it to the comparison unit. 12. The input data real-time comparison protection hardware as claimed in claim 11, characterized in that: when the comparison unit performs the same comparison result on the data and the data to be tested, the result data is stored, And when the comparing unit compares the data and the data to be tested with a different result, it outputs an abnormal message, and notifies the control application program to discard the resulting data. 13. The input data real-time comparison protection hardware according to claim 12, characterized in that: the reverse disassembly operation of the reverse processing unit reversely disassembles the data in the form of a character code into at least one original code.

Images