Patent Application
20050138396
The present invention relates to computer systems and more particularly to a method and system for preventing denial of service attacks on a computer system with a hard disk supporting a Host Protected Area.
Certain hard disks, including a hard disk on a personal computer, are often “partitioned” into multiple logical subdivisions. Each partition is essentially a separate portion of the disk, which is addressed and handled separately from the other partitions. The partition table of the disk (contained in the master boot record) tells the operating system of the extent of the partition as well as its type.
In some instances, it is desirable to place certain information and/or applications in an area that cannot be accessed by the operating system. Such an area is known as a Host Protected Area (HPA) or hidden partition. Such a partition is created by specific commands in the hard disk's microcode so that the actual control structure of the hard disk defines the HPA. For example, commands for creating an HPA in an ATA type hard disk are provided at http:/www.t13.org. The control structure defining the HPA, if it exists, is typically found in one sector, e.g., the last sector, of the hard disk. Notably, the partition table in the master boot record makes no reference to the HPA. Hence, the HPA is literally “invisible” to the operating system. The HPA is typically password protected to prevent an unauthorized user from issuing commands that would alter the control structure and from tampering with the content stored in the HPA.
The normal boot process of a computer system actuates the computer for reading from the partitions. At an appropriate point during the boot process, the system BIOS examines the hard disk prior to loading the operating system. In particular, BIOS reads the last sector of the hard disk to determine if it contains a valid control structure for an HPA. If an HPA is detected and if BIOS supports such a structure, BIOS enables the HPA. If an HPA is not detected, i.e., an HPA has not been created in the hard disk's control structures or if BIOS does not support such a structure, BIOS does nothing and continues with the normal boot process. This normal boot process includes loading the master boot record from the hard drive, investigating the partition table to find the different disk partitions, and loading the operating system from a bootable partition. After the operating system is fully loaded, the bootable partition, and all other partitions that the operating system is capable of interpreting, i.e., defined in the partition table, become fully accessible by the user.
A serious security problem presents itself if a hard disk that supports an HPA does not have an HPA. Because BIOS merely continues with the normal boot process if it does not detect an HPA, the hard disk is susceptible to a denial of service attack. For example, a rogue application introduced into the system, e.g., a virus, can issue the hard disk command sequence that creates the HPA, designate the entire hard disk as the HPA, and lock the HPA with a random password. Although rebooting the computer system can eliminate the password, the HPA setting survives across power cycles. Accordingly, the entire hard disk will continue to be designated an HPA and only the appropriate hard disk commands can alter the configuration.
Accordingly, a need exists for a system and method for preventing a denial of service attack on a computer system that has a hard drive that supports an HPA but does not have an HPA. The present invention addresses such a need.
The present invention is directed to a method and system for preventing a denial of service attack on a computer system. The method of the present invention includes setting a size of a hard disk within the computer system to a full capacity if the hard disk does not contain a host protected area, and locking the size such that the hard disk is protected from an attempt to reset the size of the hard disk resulting in a denial of service.
Through the aspects of the present invention, a system BIOS locks the hard disk in a current or full capacity, depending on the existence of an HPA, before continuing with the normal boot process. By doing so, the hard disk configuration is protected from a rogue application attempting to create an HPA, where one does not already exist. Accordingly, the hard disk is protected from denial of service attacks.
The present invention relates to computer systems and more particularly to a method and system for preventing denial of service attacks on a computer system with a hard disk supporting a Host Protected Area. The following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements. Various modifications to the preferred embodiment and the generic principles and features described herein will be readily apparent to those skilled in the art. Thus, the present invention is not intended to be limited to the embodiment shown but is to be accorded the widest scope consistent with the principles and features described herein.
As stated above, this process fails to protect the hard disk 106 from a rogue application when the hard disk 106 does not contain an HPA 106a or if BIOS does not support such a structure. In one scenario, the rogue application can issue the appropriate commands to reset the configuration in the hard disk 106 to designate the entire hard disk 106 as an HPA 106a. In another scenario, the rogue application can bypass the commands and write a valid HPA control structure directly to the last sector of the hard disk 106 to reset the configuration. Once this is done, the hard disk 106 and all its data are essentially invisible to the computer system, thus resulting in a denial of service.
According to a preferred embodiment of the present invention, BIOS 104 performs an enhanced boot sequence to protect the hard disk 106 from such denial of service attacks.
If the HPA 106a is not found in the hard disk 106 or if BIOS does not support the HPA, BIOS 104 resets the size of the hard disk 106 to a full capacity, which is defined as the maximum capacity less one sector, namely the last sector in step 212. After the hard disk size is reset to the current capacity (step 210) or, alternatively, to the full capacity (step 212), BIOS 104 locks the size for the hard disk 106 with, for example, a random password, in step 214.
Accordingly, at this point in the boot sequence, the size of the hard drive 106 is locked at a current capacity (e.g., if an HPA 106a is present) or at a full capacity (e.g., if an HPA 106a is not present or if BIOS does not support the HPA 106a) by a random password. From this point forward, BIOS 104 performs the normal boot sequence (step 216) which includes loading the master boot record, loading the operating system, and transferring control to the operating system.
Through aspects of the present invention, a hard disk 106 that supports an HPA, but does not have such a structure is protected from commands to create an HPA issued by an unauthorized user or rogue application. Moreover, by setting the size of the hard disk 106 to the full capacity, rather than the maximum capacity, if the hard disk 106 does not have an HPA or if BIOS does not support such a structure, the last sector of the hard disk 106 is essentially hidden from the operating system. Thus, a rogue application cannot create an HPA by writing directly to the last sector of the hard disk. By setting and locking the size of the hard disk 106 during the initial phases of the boot process, the computer system is protected from denial of service attacks of this kind.
Although the present invention has been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations to the embodiments and those variations would be within the spirit and scope of the present invention. Accordingly, many modifications may be made by one of ordinary skill in the art without departing from the spirit and scope of the appended claims.
