Storage device and method for protecting against virus/malware thereof and computing system having the same
Disclosed is an operating method of a storage device, which includes detecting virus/malware, performing an authentication operation with a host device when the virus/malware is detected, and entering a recovery mode when the authentication operation indicates that authentication is successful.
1. A method of operating a storage device, the method comprising:
receiving a request at the storage device from a host device;
in response to detecting an attack based on the request, blocking, by the storage device, at least the host from accessing at least a portion of the storage device,
the blocking including setting at least a portions of the storage device to a read-only mode;
after the blocking, performing, by the storage device, an authentication operation with the host device; and
entering a recovery mode in response to the authentication operation succeeding.
2. The method of claim 1 , further comprising:
analyzing a pattern of data of the request.
3. The method of claim 1 , further comprising:
determining whether an access to a trap file is made.
4. The method of claim 3 , further comprising:
generating the trap file;
storing the generated trap file; and
storing address information corresponding to the stored trap file.
5. The method of claim 1 , wherein the blocking comprises:
performing a system lock operation by transitioning the storage device to a system lock state when the attack is detected based on the request.
6. The method of claim 5 , wherein the performing the system lock operation comprises:
blocking an access of an external device to the storage device during a previously determined time,
blocking an access to a memory area of the storage device,
blocking an external device from accessing the memory area except to perform a read operation on the memory area,
blocking an access to a protected area in the memory area, or
blocking an external device from accessing protected area in the memory area except to perform a read operation on the protected area.
7. The method of claim 5 , further comprising:
releasing the system lock state when the authentication operation is successful.
8. The method of claim 4 , further comprising:
determining whether an attempt to modulate the trap file has occurred, and
wherein the blocking comprises:
transitioning the storage device to a system lock state when the attempt to modulate the trap file is made.
9. The method of claim 1 , wherein the performing comprises:
requesting a certification from the host device; and
verifying the certification from the host device.
10. The method of claim 9 , wherein the requesting of the certification includes requesting the certification from the host device by transmitting, by the storage device, an authentication request to the host device asynchronously.
11. The method of claim 9 , wherein the requesting comprises:
recognizing the request for the certification of the host device by periodically polling the storage device.
12. The method of claim 1 , wherein the entering comprises:
transmitting boot data stored in a protected area to the host device.
13. The method of claim 12 , wherein the protected area is not recognizable by the host device until after the authentication operation is successful.