CN109145532A - A kind of program white list management method and system for supporting on-line software updating - Google Patents

A kind of program white list management method and system for supporting on-line software updating Download PDF

Info

Publication number
CN109145532A
CN109145532A CN201810945260.4A CN201810945260A CN109145532A CN 109145532 A CN109145532 A CN 109145532A CN 201810945260 A CN201810945260 A CN 201810945260A CN 109145532 A CN109145532 A CN 109145532A
Authority
CN
China
Prior art keywords
white list
program
newly created
program white
file
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201810945260.4A
Other languages
Chinese (zh)
Other versions
CN109145532B (en
Inventor
李晓勇
邓霄霄
郭煜
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
BEIJING PENGCHUANG TIANDI TECHNOLOGY CO LTD
Original Assignee
Beijing Guang Cheng Tong Tai Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Guang Cheng Tong Tai Technology Co Ltd filed Critical Beijing Guang Cheng Tong Tai Technology Co Ltd
Priority to CN201810945260.4A priority Critical patent/CN109145532B/en
Publication of CN109145532A publication Critical patent/CN109145532A/en
Application granted granted Critical
Publication of CN109145532B publication Critical patent/CN109145532B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12Protecting executable software
    • G06F21/121Restricting unauthorised execution of programs
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/105Arrangements for software license management or administration, e.g. for managing licenses at corporate level
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00Arrangements for software engineering
    • G06F8/60Software deployment
    • G06F8/65Updates

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Computer Hardware Design (AREA)
  • Stored Programmes (AREA)

Abstract

The invention discloses a kind of program white list management methods and system for supporting on-line software updating, the relevant information of newly created file is obtained first, successively judge whether newly created file is executable code file, whether in local program white list strategy and whether the main program of newly created file belongs to non-hereditary class method again, the program white list policy characteristics value of newly created file is finally calculated according to the result of judgement, and the characteristic value is inserted into local program white list strategy.The method of the invention and system are by judging that software category determines whether the code after its upgrading credible, and adjust automatically program white list strategy, thus greatly improve program white list mechanism adaptability and easy-to-use easy pipe.

Description

A kind of program white list management method and system for supporting on-line software updating
Technical field
The present invention relates to field of information security technology, it particularly relates to which a kind of program for supporting on-line software updating is white List management method and system.
Background technique
Program white list is a kind of software transfer based on software executable code uniqueness characteristic and executes controlling mechanism, For example an executable program inventory, the executable journey only in this inventory are generated based on executable code file hash value Sequence could be called and be executed by system, and program white list mechanism has good security protection ability and efficiency, can be used for following Security target: 1) malicious code and extorting the prevention of software, due to malicious code and extorts software and is all not belonging to user and clearly permit Perhaps executable program, therefore will not appear in program white list strategy inventory, therefore evil will not be called and be run to system Meaning and extorts software at code, including known and unknown;2) it can be used for specification user's operation behavior, this is to production system Be safely operated particularly important, ratify without administrator, user can not in production system voluntarily installation and operation software program, System operation risk can thus be greatly reduced.
But on-line software updating function will affect the ease for use of program white list mechanism, this is because on-line software updating Old executable code file can be substituted with new executable code file, and these new executable code files are not in program In white list strategy, such system can be refused to call and run these executable codes, lead to software operation failure.
Summary of the invention
It is an object of the invention to propose a kind of program white list management method and system for supporting on-line software updating, with Overcome the above deficiencies in the existing technologies.
To realize the above-mentioned technical purpose, the technical scheme of the present invention is realized as follows:
A kind of program white list management method for supporting on-line software updating, the described method comprises the following steps:
1) relevant information of newly created file is obtained;
2) judge whether the newly created file is executable code file, if it is not, then system is done nothing, if It is to then follow the steps 3);
3) newly created file is inquired whether in local program white list strategy, if, system is done nothing, if Do not exist, thens follow the steps 4);
4) main program corresponding to document creation process is obtained, checks that document creation process institute is right according to non-hereditary class program listing Whether the main program answered belongs to non-hereditary class method, if so, system is done nothing, if it is not, thening follow the steps 5);
5) the program white list policy characteristics value of newly created file is calculated, and the characteristic value is inserted into local program white list In strategy.
Further, recording step 1) to step 5), correlation log is formed, and deciding whether according to predefined requirement will be new Program white list strategy submit to designated place.
Further, the relevant information of newly created file is obtained in step 1) by driving layer Hook Function.
A kind of program white list management system for supporting on-line software updating, the system comprises:
New file creation process monitoring module, including data obtaining module, executable code judgment module and the white name of local program Single judgment module, the data obtaining module are used to obtain the relevant information of newly created file, and the executable code judges mould Block is for judging whether the newly created file is executable code, if it is not, then ends with system process, if so, starting is originally Ground program white list judgment module, the local program white list judgment module, for inquire the newly created file whether In local program white list strategy, if ends with system process, if not existing, startup file creates process analysis module;
Document creation process analysis module, for obtaining main program corresponding to document creation process, according to non-hereditary class method Inventory checks whether main program corresponding to document creation process belongs to non-hereditary class method, if so, ends with system process, if It is not, then startup program white list policy generation module;
Program white list policy generation module, calculates the program white list policy characteristics value of newly created file, and by the feature Value is inserted into local program white list strategy;
The program of third party code program can be downloaded or be called to non-hereditary class program listing maintenance module for setting up those Inventory.
Further, further include log and reporting modules, be used for logging program white list strategy generating correlation log, and press According to predefined requirement, decide whether new program white list strategy submitting to designated place.
Further, the new file creation process monitoring module obtains newly created file by driving layer Hook Function Relevant information.
Beneficial effects of the present invention: after the method for the invention and system are by judging that software category determines its upgrading Whether code credible, and adjust automatically program white list strategy, thus greatly improve program white list mechanism adaptability and Easy-to-use easy pipe.
Detailed description of the invention
Fig. 1 is the flow chart of method of the present invention;
Fig. 2 is the functional module structure schematic diagram of system of the present invention;
Fig. 3 is the tree-shaped structural representation of new file creation process monitoring module of the present invention.
Specific embodiment
With reference to the attached drawing in the embodiment of the present invention, technical solution in the embodiment of the present invention carries out clear, complete Ground description.
As shown in Figure 1, a kind of program white list pipe for supporting on-line software updating described in embodiment according to the present invention Reason method, the described method comprises the following steps:
1) relevant information of newly created file is obtained by driving layer Hook Function.During on-line software updating, system can be incited somebody to action The program in machine code of upgrading is locally downloading together with other upgrading associated documents, and is localling create corresponding new file.
2) whether the newly created file according to newly created file determined property is executable code file, such as PE formatted file in Windows system.If it is not, then system is done nothing, if so, executing step 3).
3) newly created file is inquired whether in local program white list strategy, program white list strategy generally all base It indicates and realizes in the hash value of executable code file, therefore judge whether newly-built executable code file is credible, needs elder generation The hash value of this document is calculated, and is checked whether in program white list strategy.If system is done nothing, if not It is thening follow the steps 4).
4) main program corresponding to document creation process is obtained, document creation process is checked according to non-hereditary class program listing Whether corresponding main program belongs to non-hereditary class method, if so, system is done nothing, if it is not, then executing step It is rapid 5).Non- heredity class method is the program that third party's executable code can be called and be run to those of present invention definition, such as Explorer.exe, cmd program of Windows system, browser, FTP etc. tool.Non- heredity class method cannot be credible by its Attribute passes to the executable code that they are called, and its credible attribute can be then hereditary to its new upgrading by software upgrading Executable code.Non- hereditary class program listing safeguarded by safety manager or third party's security service mechanism, specifically, Provide a kind of representation method and maintenance mechanism for supporting non-hereditary class program listing, comprising: non-hereditary class program listing is by journey File characteristic (such as filename, hash value) expression of sequence, and by the artificial or third party service organization by auxiliary resources information (such as categorical attribute of software download resource) decision and maintenance.I.e. professional is according to the prompt information of software download resource or logical The software description information that other way (such as the description of third party software function and evaluation) obtains is crossed, or by carrying out to software Actual motion analysis, judges whether software program meets non-hereditary class application definition.
5) the program white list policy characteristics value of newly created file is calculated, and it is white that the characteristic value is inserted into local program In list strategy.
In the present embodiment, system is according to the program white list strategy generating process record of newly created file, and according to pipe Reason requires, and decides whether to newly created file program white list policy report to specified administrative center.Administrative center by its It is merged into existing program white list strategy.Hereafter administrative center is white to each program by new program white list policy distribution List service object.
As Figure 2-3, the invention also discloses a kind of program white list management system for supporting on-line software updating, institutes The system of stating includes:
New file creation process monitoring module 1, including data obtaining module 101, executable code judgment module 102 and local journey Sequence white list judgment module 103, the data obtaining module 101 is used to obtain the relevant information of newly created file, described to hold Line code judgment module 102 for judging whether the newly created file is executable code, if it is not, then ends with system into Journey, if so, starting local program white list judgment module 103, the local program white list judgment module 103, for looking into The newly created file is ask whether in local program white list strategy, if ends with system process starts if not existing Document creation process analysis module 2;
Document creation process analysis module 2, for obtaining main program corresponding to document creation process, according to non-hereditary class method Inventory checks whether main program corresponding to document creation process belongs to non-hereditary class method, if so, ends with system process, if It is not, then startup program white list policy generation module 3;
Program white list policy generation module 3, calculates the program white list policy characteristics value of newly created file, and by the feature Value is inserted into local program white list strategy;
The journey of third party code program can be downloaded or be called to non-hereditary class program listing maintenance module 4 for setting up those Sequence inventory.
In the present embodiment, further include log and reporting modules 5, be used for logging program white list strategy generating relevant date Will, and according to predefined requirement, decide whether new program white list strategy submitting to designated place.
In the present embodiment, the new file creation process monitoring module 1 obtains new creation by driving layer Hook Function The relevant information of file.
Above-mentioned each function of the program white list management system of support on-line software updating described in the embodiment of the present invention Module respectively corresponds each operating procedure of the program white list management method of support on-line software updating of the invention, here It repeats no more.
The foregoing is merely illustrative of the preferred embodiments of the present invention, is not intended to limit the invention, all in essence of the invention Within mind and principle, any modification, equivalent replacement, improvement and so on be should all be included in the protection scope of the present invention.

Claims (6)

1. a kind of program white list management method for supporting on-line software updating, which is characterized in that the method includes following steps It is rapid:
1) relevant information of newly created file is obtained;
2) judge whether the newly created file is executable code file, if it is not, then system is done nothing, if It is to then follow the steps 3);
3) newly created file is inquired whether in local program white list strategy, if, system is done nothing, if Do not exist, thens follow the steps 4);
4) main program corresponding to document creation process is obtained, checks that document creation process institute is right according to non-hereditary class program listing Whether the main program answered belongs to non-hereditary class method, if so, system is done nothing, if it is not, thening follow the steps 5);
5) the program white list policy characteristics value of newly created file is calculated, and the characteristic value is inserted into local program white list In strategy.
2. the method according to claim 1, wherein recording step 1) to step 5), correlation log is formed, and press Decide whether new program white list strategy submitting to designated place according to predefined requirement.
3. the method according to claim 1, wherein obtaining new creation by driving layer Hook Function in step 1) The relevant information of file.
4. a kind of program white list management system for supporting on-line software updating, which is characterized in that the system comprises:
New file creation process monitoring module, including data obtaining module, executable code judgment module and the white name of local program Single judgment module, the data obtaining module are used to obtain the relevant information of newly created file, and the executable code judges mould Block is for judging whether the newly created file is executable code, if it is not, then ends with system process, if so, starting is originally Ground program white list judgment module, the local program white list judgment module, for inquire the newly created file whether In local program white list strategy, if ends with system process, if not existing, startup file creates process analysis module;
Document creation process analysis module, for obtaining main program corresponding to document creation process, according to non-hereditary class method Inventory checks whether main program corresponding to document creation process belongs to non-hereditary class method, if so, ends with system process, if It is not, then startup program white list policy generation module;
Program white list policy generation module, calculates the program white list policy characteristics value of newly created file, and by the feature Value is inserted into local program white list strategy;
The program of third party code program can be downloaded or be called to non-hereditary class program listing maintenance module for setting up those Inventory.
5. system according to claim 4, which is characterized in that further include log and reporting modules, it is white to be used for logging program List strategy generating correlation log, and according to predefined requirement, decide whether to submit to new program white list strategy specified Place.
6. system according to claim 4, which is characterized in that the new file creation process monitoring module passes through driving layer The relevant information of Hook Function acquisition newly created file.
CN201810945260.4A 2018-08-20 2018-08-20 Program white list management method and system supporting software online upgrade Active CN109145532B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201810945260.4A CN109145532B (en) 2018-08-20 2018-08-20 Program white list management method and system supporting software online upgrade

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201810945260.4A CN109145532B (en) 2018-08-20 2018-08-20 Program white list management method and system supporting software online upgrade

Publications (2)

Publication Number Publication Date
CN109145532A true CN109145532A (en) 2019-01-04
CN109145532B CN109145532B (en) 2020-08-07

Family

ID=64790130

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201810945260.4A Active CN109145532B (en) 2018-08-20 2018-08-20 Program white list management method and system supporting software online upgrade

Country Status (1)

Country Link
CN (1) CN109145532B (en)

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110516443A (en) * 2019-07-19 2019-11-29 苏州浪潮智能科技有限公司 A kind of application program management-control method and system based on offline intelligence learning
CN111177706A (en) * 2019-12-25 2020-05-19 北京珞安科技有限责任公司 Process white list updating method based on trusted software library
CN111209015A (en) * 2019-10-24 2020-05-29 浙江中控技术股份有限公司 Method for realizing installation tracking based on file filtering driver
CN111651752A (en) * 2020-04-17 2020-09-11 北京大学 Method for acquiring system call white list required by container
CN111914249A (en) * 2020-08-11 2020-11-10 北京珞安科技有限责任公司 Program white list generation method, program updating method and device
CN112131566A (en) * 2020-09-27 2020-12-25 浙江华途信息安全技术股份有限公司 Transparent encryption and decryption anti-cracking method for file and management equipment thereof
CN112380170A (en) * 2020-11-25 2021-02-19 北京珞安科技有限责任公司 Correlation method and device for file updating operation and computer equipment
CN113220329A (en) * 2021-05-25 2021-08-06 北京威努特技术有限公司 Method and device for dynamically tracking white list library of industrial control software updating program
CN113360176A (en) * 2020-03-06 2021-09-07 浙江宇视科技有限公司 Software program upgrading method and device, storage medium and electronic equipment
CN116796331A (en) * 2023-04-26 2023-09-22 之江奇安科技有限公司 Automatic hook method for realizing process monitoring and whitelist mechanism in podman

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101692267A (en) * 2009-09-15 2010-04-07 北京大学 Method and system for detecting large-scale malicious web pages
CN101788915A (en) * 2010-02-05 2010-07-28 北京工业大学 White list updating method based on trusted process tree
US20140280896A1 (en) * 2013-03-15 2014-09-18 Achilleas Papakostas Methods and apparatus to credit usage of mobile devices
CN104933354A (en) * 2014-12-30 2015-09-23 国家电网公司 Trusted computing based white list static measurement method
CN107066884A (en) * 2017-02-21 2017-08-18 郑州云海信息技术有限公司 A kind of compatible processing method of linux system software white list

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101692267A (en) * 2009-09-15 2010-04-07 北京大学 Method and system for detecting large-scale malicious web pages
CN101788915A (en) * 2010-02-05 2010-07-28 北京工业大学 White list updating method based on trusted process tree
US20140280896A1 (en) * 2013-03-15 2014-09-18 Achilleas Papakostas Methods and apparatus to credit usage of mobile devices
CN104933354A (en) * 2014-12-30 2015-09-23 国家电网公司 Trusted computing based white list static measurement method
CN107066884A (en) * 2017-02-21 2017-08-18 郑州云海信息技术有限公司 A kind of compatible processing method of linux system software white list

Cited By (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110516443B (en) * 2019-07-19 2021-11-26 苏州浪潮智能科技有限公司 Application program control method and system based on offline intelligent learning
CN110516443A (en) * 2019-07-19 2019-11-29 苏州浪潮智能科技有限公司 A kind of application program management-control method and system based on offline intelligence learning
CN111209015A (en) * 2019-10-24 2020-05-29 浙江中控技术股份有限公司 Method for realizing installation tracking based on file filtering driver
CN111209015B (en) * 2019-10-24 2023-10-03 浙江中控技术股份有限公司 Method for realizing installation tracking based on file filtering driver
CN111177706A (en) * 2019-12-25 2020-05-19 北京珞安科技有限责任公司 Process white list updating method based on trusted software library
CN113360176B (en) * 2020-03-06 2023-08-25 浙江宇视科技有限公司 Upgrading method and device of software program, storage medium and electronic equipment
CN113360176A (en) * 2020-03-06 2021-09-07 浙江宇视科技有限公司 Software program upgrading method and device, storage medium and electronic equipment
CN111651752A (en) * 2020-04-17 2020-09-11 北京大学 Method for acquiring system call white list required by container
CN111651752B (en) * 2020-04-17 2022-10-14 北京大学 Method for acquiring system call white list required by container
CN111914249A (en) * 2020-08-11 2020-11-10 北京珞安科技有限责任公司 Program white list generation method, program updating method and device
CN112131566A (en) * 2020-09-27 2020-12-25 浙江华途信息安全技术股份有限公司 Transparent encryption and decryption anti-cracking method for file and management equipment thereof
CN112380170A (en) * 2020-11-25 2021-02-19 北京珞安科技有限责任公司 Correlation method and device for file updating operation and computer equipment
CN112380170B (en) * 2020-11-25 2024-08-06 北京珞安科技有限责任公司 File updating operation association method and device and computer equipment
CN113220329A (en) * 2021-05-25 2021-08-06 北京威努特技术有限公司 Method and device for dynamically tracking white list library of industrial control software updating program
CN116796331A (en) * 2023-04-26 2023-09-22 之江奇安科技有限公司 Automatic hook method for realizing process monitoring and whitelist mechanism in podman
CN116796331B (en) * 2023-04-26 2024-04-05 之江奇安科技有限公司 Automatic hook method for realizing process monitoring and whitelist mechanism in podman

Also Published As

Publication number Publication date
CN109145532B (en) 2020-08-07

Similar Documents

Publication Publication Date Title
CN109145532A (en) A kind of program white list management method and system for supporting on-line software updating
CN103559591B (en) Software management system based on trust computing and management method
EP1686469B1 (en) Publishing the status of and updating firmware components
US7308712B2 (en) Automated computer vulnerability resolution system
CN109491682B (en) Method for automatically upgrading permission-controllable block chain system based on intelligent contract
JP4052604B2 (en) Virus detection in client / server systems
JP5191376B2 (en) Risk-based authentication system, risk information acquisition server, and risk-based authentication method
CN103078864B (en) A kind of Initiative Defense Ile repair method based on cloud security
CN112783518B (en) Vehicle-mounted application containerization isolation framework system based on IPFS and implementation method
CN1668010A (en) Tag-based schema for distributing update metadata in an update distribution system
CN1668009A (en) Update distribution system architecture and method for distributing software
CN101151593A (en) Autonomic computing: management agent utilizing action policy for operation
CN101901323B (en) System filtration method for monitoring loading activity of program module
CN104573435A (en) Method for terminal authority management and terminal
CN101268468A (en) Method and apparatus to authenticate source of a scripted code
KR102022058B1 (en) Method and system for detecting counterfeit of web page
CN111159520B (en) Sample identification method, device and safety emergency response system
CN110071924B (en) Big data analysis method and system based on terminal
CN106656927A (en) Method and device for enabling Linux account to be added to AD domain
CN110209675A (en) Credit data querying method and its device on block chain
CN108011767A (en) A kind of configurable operational system of non-intruding
CN105553671A (en) Digital certificate managing method, device and system
CN114826660A (en) Cloud service operation method, electronic device and storage medium
CN106529281A (en) Executable file processing method and device
CN115906184B (en) Method, device, medium and electronic equipment for controlling process to access files

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
TR01 Transfer of patent right
TR01 Transfer of patent right

Effective date of registration: 20221229

Address after: 100000 Supporting rooms 9-11, 1st floor, Building 2, 3 and 6, Chengxiu Garden, Tianxiu Garden, Haidian District, Beijing

Patentee after: BEIJING PENGCHUANG TIANDI TECHNOLOGY Co.,Ltd.

Address before: 100094 7A, Unit 3, Building 3, Shiji Xinjingyuan, No. 9, Beiwa Road, Haidian District, Beijing

Patentee before: BEIJING GUANGCHENG TONGTAI TECHNOLOGY Co.,Ltd.