CN112417437A - Trusted cloud platform based program white list generation method - Google Patents

Trusted cloud platform based program white list generation method Download PDF

Info

Publication number
CN112417437A
CN112417437A CN202011172954.2A CN202011172954A CN112417437A CN 112417437 A CN112417437 A CN 112417437A CN 202011172954 A CN202011172954 A CN 202011172954A CN 112417437 A CN112417437 A CN 112417437A
Authority
CN
China
Prior art keywords
file
white list
program
file name
name
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202011172954.2A
Other languages
Chinese (zh)
Inventor
魏明
阮安邦
陈凯
陈旭明
翟东雪
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Octa Innovations Information Technology Co Ltd
Original Assignee
Beijing Octa Innovations Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Octa Innovations Information Technology Co Ltd filed Critical Beijing Octa Innovations Information Technology Co Ltd
Priority to CN202011172954.2A priority Critical patent/CN112417437A/en
Publication of CN112417437A publication Critical patent/CN112417437A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562Static detection
    • G06F21/564Static detection by virus signature recognition
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Bioethics (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)

Abstract

The invention discloses a program white list generating method based on a trusted cloud platform, which comprises an operation installation program, a scanning encryption program internal file name and a generated file white list, wherein the operation installation program is installed on a computer needing to generate the white list, the operation installation program is exported while the operation installation program is obtained, whether the file name is successfully compared with the file name of the black list is judged through setting, virus screening can be carried out before the file is operated, files and virus files can be deleted, the generated file white list and the virus files filtered by the generated file white list are selectively stored through a recovery area reserved for isolating the files, the files are recorded through storing the file names to the black list under the condition of not selecting to be stored, the virus files are prevented from entering again, manual selection is carried out on the filtered suspicious files, the method can prevent the files which can not be judged by trusting from being cleaned.

Description

Trusted cloud platform based program white list generation method
Technical Field
The invention relates to the technical field of computer security, in particular to a program white list generation method based on a trusted cloud platform.
Background
The aim of the white-listing technique is not to prevent certain things from being specified, and it takes the opposite of the black-listing, using a list of entities (programs, email addresses, domain names, web addresses) that are "known to be good". There is no need to run antivirus software that must be continuously updated, anything that is not on the list will be prevented from running, and the system can be protected from zero-day attacks.
White-listing techniques are simple and give administrators and companies greater authority to control programs that can be run on a network or on a machine, and have the advantage that entities other than those on the list cannot be run or pass, and the disadvantage that entities that are not on the list cannot be run or pass.
Because the running of programs belonging to the white list can pass smoothly in the running of the white list, virus files which are difficult to be perceived can still run smoothly once the white list is trusted, and the problems that a computer is attacked and the files are lost and the like are easily caused in the past, the encryption is required to be carried out when the white list is generated, and the virus library is required to be used for timely screening.
Disclosure of Invention
The invention aims to provide a program white list generation method based on a trusted cloud platform, so as to solve the problems in the background technology.
In order to achieve the purpose, the invention provides the following technical scheme:
a program white list generation method based on a trusted cloud platform comprises an operation installation program, a scanning encryption program internal file name and a generated file white list, wherein the operation installation program is installed on a computer needing to generate the white list, the operation installation program is exported while the operation installation program is obtained, then the encryption program internal file name program is carried out, after encryption is finished, whether the file name is compared with a blacklist file name or not is judged, the file name scanned and entered in the scanning encryption program internal file name program is successfully screened, when part of the judged file names are the program names in the blacklist, a prompt operation is carried out on an operation process through a dialog box popping up an isolation file, after the file name in the encryption program is scanned, trust information of a cloud client is obtained, and according to the trust percentage of the cloud client after the trust information of the cloud client is obtained, and autonomously judging whether the file is reserved or not, if so, scanning the file name in the recording program, and if not, isolating the file so as to pop up a dialog box of the isolated file.
As a further scheme of the invention: the file name in the scanning and recording program is backed up and stored through the generated file white list, so that the error identification of the internal content of the file name in the scanning and recording program is avoided, and the recovery and the searching of the lost file are facilitated.
As a still further scheme of the invention: and after judging whether the file name is successfully compared with the file name of the blacklist or not and before generating the file white list, loading a file of a pre-generated white list and scanning and recording the file name in the program, wherein the file name in the scanning and recording program scans and records the file name of the loaded file after judging whether the file name loaded in the pre-generated white list is successfully compared with the file name of the blacklist or not and screening, and the generated file white list is realized.
As a still further scheme of the invention: the method comprises the steps that a dialog box for popping up the isolation file comprises a recovery area for reserving the isolation file, whether the recovery area for reserving the isolation file is conducted or not is determined according to prompt operation of a popup window in the dialog box for popping up the isolation file, if yes, the file with the partial file name being judged as the program name in a blacklist is recovered to be a trust area file, the file name is extracted to the whitelist for running after the recovery area file is stored, specifically, the program running in the white list after the file name is extracted is recorded, deletion can be timely found after errors are judged subjectively, if not, the file name in the recovery area for reserving the isolation file is entered into the blacklist for storing the file name, then, the file in the recovery area is deleted, and virus files are removed.
As a still further scheme of the invention: the file name in the scanning recording program comprises a file name in the scanning program and a file name in the recording program, the file name in the scanning program and the file name in the recording program are also included before the generated file white list, the file white list generated also comprises an encrypted backup file white list, an encrypted file white list and a file white list copying and transmitting, and the backup file, the file migration and the file of the transmission area are respectively backed up.
As a still further scheme of the invention: the file white list is copied and transmitted and then comprises a migration area, the file is migrated and transferred through the file white list copying and transmitting area, if the file is transferred, the file white list enters the encryption migration area and is locked by a personal cloud white list database, if the file white list copying and transmitting area is interrupted, the personal cloud white list database is immediately encrypted, the personal cloud white list database also comprises a popup window alarm after being encrypted, and then the last transmission position is recorded and stored.
As a still further scheme of the invention: and the file white list is copied and transmitted and then further comprises a file white list migration area, the file white list migration area further comprises retransmission from the position of last transmission interruption, if the retransmission from the position of last transmission interruption is interrupted, popup window alarm is carried out, the transmitted file is not reserved, and if the retransmission from the position of last transmission interruption is finished, the file white list enters into an encrypted migration transmission and is locked by a personal cloud white list database.
As a still further scheme of the invention: before the generated file white list, after scanning the file name in the recording program, deleting the file with repeated records.
Compared with the prior art, the invention has the beneficial effects that:
1. whether the file name is successfully compared with the file name of the blacklist or not can be judged through setting, virus screening can be carried out before the file runs, the file and the virus file can be deleted, the generated file white list and the virus file filtered by the generated file white list can be selectively stored in a recovery area reserved for isolating the file, the file is deleted under the condition that the file is not selected to be stored, the file is recorded in the blacklist through the stored file name, the virus file is prevented from entering again, manual selection is carried out on the filtered suspicious file, and the trustable and unreterminable file can be prevented from being cleaned.
2. The generated file white list is encrypted to backup the file white list, the file white list is encrypted and the file white list is copied and transmitted, so that multiple backup can be performed on the generated file white list, and the repeated recording of the files can be avoided by deleting the files which are repeatedly recorded.
3. The file white list copying and transmitting device comprises a migration area, the generated file white list can be transmitted and stored to a cloud for data storage, and the file white list copying and transmitting area is interrupted, and then the file white list is encrypted through a personal cloud white list database and is recorded and stored with a last transmission position through a popup window alarm, so that migrated data can be transmitted continuously.
4. The file is encrypted by the personal cloud white list database after retransmission interruption from the position of last transmission interruption, and the transmitted file is deleted after warning, so that the operation of a virus program in the transmission process can be prevented, the risk of data theft can be reduced to the greatest extent, and the file white list migration zone can perform retransmission later by retransmission from the position of last transmission interruption.
Drawings
FIG. 1 is a flowchart of an operational agent framework of a trusted cloud platform based program white list generation method;
FIG. 2 is a flowchart of a dialog box for popping up an isolation file in a trusted cloud platform based program white list generation method;
FIG. 3 is a flowchart of a procedure before and after a file white list generated in a trusted cloud platform based procedure white list generation method;
FIG. 4 is a flowchart of a file white list migration zone in a trusted cloud platform based program white list generation method;
FIG. 5 is a flowchart of a file white list replication transmission area in a trusted cloud platform based program white list generation method;
FIG. 6 is a flowchart of a trusted cloud platform based method for generating a white list of programs after scanning and recording filenames in the programs;
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
Referring to fig. 1 to 6, in an embodiment of the present invention, a trusted cloud platform based program white list generation method includes running an installed program, scanning a file name in an encrypted program and a generated file white list, where the running installed program is installed on a computer that needs to generate a white list, while exporting the running installed program, obtaining the file name in the program, then performing an encryption program internal file name program, after encryption is completed, screening file names scanned in the file name scanning program in the encrypted program by judging whether the file names are compared with the file names of a black list successfully, when a part of the file names are judged to be the program names in the black list, performing a prompt operation on an operation process by popping up a dialog box for isolating files, after scanning the file names in the encrypted program, obtaining trust information of cloud clients, and performing a trust percentage according to the cloud clients after obtaining the trust information of the cloud clients, and autonomously judging whether the file is reserved or not, if so, scanning the file name in the recording program, and if not, isolating the file so as to pop up a dialog box of the isolated file.
Preferably, the file name in the scanning and recording program is backed up and stored through a generated file white list, so that the error identification of the internal content of the file name in the scanning and recording program is avoided, and the recovery, the use and the searching of the lost file are facilitated.
Preferably, after judging whether the file name is successfully compared with the file name of the black list and before generating the file white list, the file white list also comprises a file loaded with a pre-generated white list and a file name in a scanning recording program, the file name in the scanning recording program scans and records the file name of the file loaded with the pre-generated white list after judging whether the file name is successfully compared with the file name of the black list and screening the file name of the file loaded with the pre-generated white list, so as to realize the generated file white list, the file white list and the virus file filtered by the generated file white list can be deleted by using virus screening before the file is operated through setting and judging whether the file name is successfully compared with the file name of the black list, the generated file white list and the virus file filtered by the generated file white list can be selectively stored through a recovery area reserved for isolating the file, the file name is stored to the black list for recording after the file is deleted under the condition that the, the virus files are prevented from entering again, the filtered suspicious files are manually selected, and the trusted and untudable files can be prevented from being cleaned.
Preferably, the dialog box for popping up the isolation file comprises a recovery area for reserving the isolation file, whether the recovery area for reserving the isolation file is performed or not is determined according to prompt operation of a popup window in the dialog box for popping up the isolation file, if so, the file with the partial file name judged as the program name in the blacklist is recovered to be a trust area file, the file name is extracted to the whitelist for operation after the file in the recovery area is stored, particularly, the program operated in the white list for extracting the file name is recorded, so that the file can be searched and deleted in time after the subjective judgment is made, if not, the file name in the recovery area for reserving the isolation file is entered into the blacklist for storage, the file in the recovery area is deleted, and the virus file is removed.
Preferably, the file names in the scanning and recording program comprise file names in the scanning program and file names in the recording program, the generated file white list also comprises the file names in the scanning program and the file names in the recording program before the generated file white list, the generated file white list also comprises an encrypted backup file white list, an encrypted file white list and file white list copying and transmitting, files of the backup file, the file migration and transmission area are respectively backed up, and the generated file white list is encrypted to backup the file white list, the encrypted file white list and the file white list copying and transmitting, so that multiple backup can be performed on the generated file white list.
Preferably, the file white list is further provided with a migration area after being copied and transmitted, the generated file white list can be transmitted and stored to the cloud for data storage, the migrated data is continuously transmitted by recording and storing the last transmission position through personal cloud white list database encryption and popup window alarm after the file white list copying and transmitting area is interrupted, the file white list is migrated and transferred through the file white list copying and transmitting area, if the transfer is completed, the file white list enters the personal cloud white list database for encryption and migration transmission and is locked, if the file white list copying and transmitting area is interrupted, the personal cloud white list database encryption is immediately performed, the personal cloud white list database encryption further comprises popup window alarm, and then the last transmission position is recorded and stored.
Preferably, the file white list replication transmission further comprises a file white list migration zone, the file white list migration zone further comprises retransmission from the position of the last transmission interruption, if the retransmission from the position of the last transmission interruption, the popup alarm is carried out without reserving the transmitted file, the transmitted file is deleted after the retransmission interruption from the position of the last transmission interruption and the warning is carried out by the encryption of the personal cloud white list database, the operation of a virus program in the transmission process can be prevented, the risk of data theft can be reduced to the maximum extent, and if the retransmission from the position of the last transmission interruption is finished, the file white list enters the encryption migration transmission and is locked by the personal cloud white list database.
Preferably, the method further comprises deleting the files recorded repeatedly after scanning the file names in the recording program before generating the file white list, so that the problem of information duplication can be avoided.
Although the present invention has been described in detail with reference to the foregoing embodiments, it will be apparent to those skilled in the art that various changes in the embodiments and/or modifications of the invention can be made, and equivalents and modifications of some features of the invention can be made without departing from the spirit and scope of the invention.

Claims (8)

1. A program white list generation method based on a trusted cloud platform comprises the steps of running an installed program, scanning file names in an encrypted program and generating a file white list, and is characterized in that: the method comprises the steps that a running and installing program is installed on a computer needing to generate a white list, the running and installing program is exported, simultaneously, the file name in the program is obtained, then, the program of the file name in the program is encrypted, after encryption is completed, whether the file name is compared with the file name in the black list or not is judged, the file name scanned and entered in the program scanning and encrypting program is successfully screened, when part of the judged file name is the program name in the black list, prompt operation is carried out through a dialog box for popping up an isolation file, after the file name in the encrypting program is scanned, trust information of a cloud client is obtained, whether the file is reserved or not is autonomously judged according to the trust degree percentage of the cloud client after the trust information of the cloud client is obtained, if yes, the file name in the program is scanned and recorded, if not, the file is isolated, thereby performing a dialog to pop up the isolated file.
2. The method according to claim 1, wherein the method comprises: the file name in the scanning and recording program is backed up and stored through the generated file white list, so that the error identification of the internal content of the file name in the scanning and recording program is avoided, and the recovery and the searching of the lost file are facilitated.
3. The method according to claim 1, wherein the method comprises: and after judging whether the file name is successfully compared with the file name of the blacklist or not and before generating the file white list, loading a file of a pre-generated white list and scanning and recording the file name in the program, wherein the file name in the scanning and recording program scans and records the file name of the loaded file after judging whether the file name loaded in the pre-generated white list is successfully compared with the file name of the blacklist or not and screening, and the generated file white list is realized.
4. The method according to claim 1, wherein the method comprises: the method comprises the steps that a dialog box for popping up the isolation file comprises a recovery area for reserving the isolation file, whether the recovery area for reserving the isolation file is conducted or not is determined according to prompt operation of a popup window in the dialog box for popping up the isolation file, if yes, the file with the partial file name being judged as the program name in a blacklist is recovered to be a trust area file, the file name is extracted to the whitelist for running after the recovery area file is stored, specifically, the program running in the white list after the file name is extracted is recorded, deletion can be timely found after errors are judged subjectively, if not, the file name in the recovery area for reserving the isolation file is entered into the blacklist for storing the file name, then, the file in the recovery area is deleted, and virus files are removed.
5. The method according to claim 1, wherein the method comprises: the file name in the scanning recording program comprises a file name in the scanning program and a file name in the recording program, the file name in the scanning program and the file name in the recording program are also included before the generated file white list, the file white list generated also comprises an encrypted backup file white list, an encrypted file white list and a file white list copying and transmitting, and the backup file, the file migration and the file of the transmission area are respectively backed up.
6. The method according to claim 5, wherein the method comprises: the file white list is copied and transmitted and then comprises a migration area, the file is migrated and transferred through the file white list copying and transmitting area, if the file is transferred, the file white list enters the encryption migration area and is locked by a personal cloud white list database, if the file white list copying and transmitting area is interrupted, the personal cloud white list database is immediately encrypted, the personal cloud white list database also comprises a popup window alarm after being encrypted, and then the last transmission position is recorded and stored.
7. The method according to claim 5, wherein the method comprises: and the file white list is copied and transmitted and then further comprises a file white list migration area, the file white list migration area further comprises retransmission from the position of last transmission interruption, if the retransmission from the position of last transmission interruption is interrupted, popup window alarm is carried out, the transmitted file is not reserved, and if the retransmission from the position of last transmission interruption is finished, the file white list enters into an encrypted migration transmission and is locked by a personal cloud white list database.
8. The method according to claim 5, wherein the method comprises: before the generated file white list, after scanning the file name in the recording program, deleting the file with repeated records.
CN202011172954.2A 2020-10-28 2020-10-28 Trusted cloud platform based program white list generation method Pending CN112417437A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011172954.2A CN112417437A (en) 2020-10-28 2020-10-28 Trusted cloud platform based program white list generation method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011172954.2A CN112417437A (en) 2020-10-28 2020-10-28 Trusted cloud platform based program white list generation method

Publications (1)

Publication Number Publication Date
CN112417437A true CN112417437A (en) 2021-02-26

Family

ID=74841420

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011172954.2A Pending CN112417437A (en) 2020-10-28 2020-10-28 Trusted cloud platform based program white list generation method

Country Status (1)

Country Link
CN (1) CN112417437A (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114244610A (en) * 2021-12-17 2022-03-25 山石网科通信技术股份有限公司 File transmission method and device, network security equipment and storage medium
CN115935431A (en) * 2023-01-05 2023-04-07 北京微步在线科技有限公司 White list generation method and device of risk detection engine

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101110656A (en) * 2006-07-18 2008-01-23 宇龙计算机通信科技(深圳)有限公司 File transferring method for wireless network hard disk system
CN106776124A (en) * 2016-11-25 2017-05-31 腾讯科技(深圳)有限公司 Data back up method and device
CN107506645A (en) * 2017-08-30 2017-12-22 北京明朝万达科技股份有限公司 A kind of detection method and device for extorting virus
CN108401012A (en) * 2018-01-31 2018-08-14 山东汇贸电子口岸有限公司 A kind of document breakpoint transmission method
CN110493302A (en) * 2019-07-01 2019-11-22 联想(北京)有限公司 A kind of document transmission method, equipment and computer readable storage medium

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101110656A (en) * 2006-07-18 2008-01-23 宇龙计算机通信科技(深圳)有限公司 File transferring method for wireless network hard disk system
CN106776124A (en) * 2016-11-25 2017-05-31 腾讯科技(深圳)有限公司 Data back up method and device
CN107506645A (en) * 2017-08-30 2017-12-22 北京明朝万达科技股份有限公司 A kind of detection method and device for extorting virus
CN108401012A (en) * 2018-01-31 2018-08-14 山东汇贸电子口岸有限公司 A kind of document breakpoint transmission method
CN110493302A (en) * 2019-07-01 2019-11-22 联想(北京)有限公司 A kind of document transmission method, equipment and computer readable storage medium

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114244610A (en) * 2021-12-17 2022-03-25 山石网科通信技术股份有限公司 File transmission method and device, network security equipment and storage medium
CN114244610B (en) * 2021-12-17 2024-05-03 山石网科通信技术股份有限公司 File transmission method and device, network security equipment and storage medium
CN115935431A (en) * 2023-01-05 2023-04-07 北京微步在线科技有限公司 White list generation method and device of risk detection engine

Similar Documents

Publication Publication Date Title
US11379582B2 (en) Methods and apparatus for malware threat research
US10437997B2 (en) Method and apparatus for retroactively detecting malicious or otherwise undesirable software as well as clean software through intelligent rescanning
US9424428B2 (en) Method and system for real time classification of events in computer integrity system
US7673324B2 (en) Method and system for tracking an operating performed on an information asset with metadata associated therewith
US8484737B1 (en) Techniques for processing backup data for identifying and handling content
US8533818B1 (en) Profiling backup activity
US8214895B2 (en) Whitelist and blacklist identification data
JP2012146317A (en) Network security system and method
CN112417437A (en) Trusted cloud platform based program white list generation method
CN109120584B (en) Terminal security protection method and system based on UEFI and WinPE
CN108229162B (en) Method for realizing integrity check of cloud platform virtual machine
US7617258B2 (en) System for real-time healing of vital computer files
CN116260627A (en) APT detecting system based on data tracing graph label
CN114186222A (en) Lesovirus protection method and system
Bui et al. Issues in computer forensics
RU2535504C1 (en) System and method for treating website content
US12010133B2 (en) Security threat monitoring for network-accessible devices
CN112100591A (en) Method for reinforcing safety information of computer host
Slokkker et al. Digital Forensic Investigation of Data Theft on the Google Cloud Platform
CN117972676A (en) Application detection method and device, electronic equipment and storage medium
CN115718733A (en) Method and system for classified storage of files based on hash value
CN115114079A (en) Backup method of format file

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20210226

RJ01 Rejection of invention patent application after publication