KR20080011775A - Intelligent patch management and installation system, and method thereof - Google Patents

Abstract

An intelligent patch management/installation system and a method thereof are provided to enhance stability/security for software in a client terminal by providing an installation list/sequence capable of installing a patch in the shortest path, and installing a patch file in a safe time point after monitoring process and library information in real-time. A patch managing/installing system provides a patch definition file for checking a patch and a patch file to a plurality of client computers(200), receives/stores patch installation information, system information needed for installing the patch, and patch information for an installation state, and receives/stores a patch installation result. Each client computer collects/generates whether a patch is installed, system information for patch installation, patch information of an installation state by using the received patch definition file, transmits the information to the system, and provides the installation list/sequence capable of installing the patch in the shortest path by analyzing the patch information. Each client terminal generates a patch installation command in the safe time point by monitoring the process/library information in real-time, receives/installs the patch file by the patch installation command, and transmits the patch installation result to the system.

Description

Intelligent patch management and installation system and its method {INTELLIGENT PATCH MANAGEMENT AND INSTALLATION SYSTEM, AND METHOD THEREOF}

1 is an overall network configuration diagram of an intelligent patch management and installation system according to an embodiment of the present invention

2 is a block diagram of an intelligent patch management and installation system according to a preferred embodiment of the present invention

FIG. 3 is a diagram illustrating patch information inspected and collected by the patch inspecting unit illustrated in FIG. 2.

FIG. 4 is a flowchart illustrating an example of an implementation of a patch inspecting unit and a patch command unit illustrated in FIG.

FIG. 5 is a flowchart illustrating an example of implementing a patch inspecting unit and a patch command unit in the patch management unit shown in FIG. 2; FIG.

6 is an operation flowchart showing an example of the implementation of a patch installation device shown in FIG.

7 is a view showing an example of the implementation of the patch monitoring unit shown in FIG.

***** Explanation of the main symbols in the drawings *****

100: patch management and installation operating system unit 110: patch management server

111: patch definition file 120 (n): distribution server

121: patch definition file 122: patch file

200 (1) to 200 (n): client computer (PC)

300: patch management and installation application

300A: patch management unit 310: patch inspection unit

320: patch command unit 330: patch information

331: System Information 332: Correlation Information

333: Patch Installation Information

334: Information about installation conditions 335: Surveillance information

336: Command information for installation 300B: Patch installation unit

340: patch monitoring unit 350: patch file

401: system startup

402: Whether the process is used

403: Whether to use library

404: Binary availability 405: Shutdown

The present invention relates to an intelligent patch management and installation system and a method thereof, and more particularly, to an intelligent patch management and installation system and a method for installing software patches quickly and safely.

Patches are used to supplement problems with software distributed in software development or to apply changes to the technology used in the software. In general, it updates the vulnerable binary file and the set value used in the binary file, and comprehensively includes adding / deleting / modifying the program according to the change of continuous update from the developer / seller.

Patches come in a variety of forms. Security patches that update vulnerable binary files, updates that change product versions for software, roll up updates that include different patches provided over a period of time, cumulative cumulative updates for the same software, software Bug fixes to eliminate errors in the software, feature packs that provide additional features of the software, and service packs that are delivered as continuous update changes include patches for a period of time, and changes or additions to programs associated with the software. It also includes

Examination of patches and installation of patches should confirm whether the installed software product is installed and the installed version of the software product.

One of the difficulties in checking and installing patches is that the method of installation and application differs depending on the type of patch to be applied, and to install and apply other types of patches quickly. In the case of security patches, it is necessary to install them urgently due to the expected damage from the vulnerability, and the patch may not be applied until the reboot after installation. In addition, patches that contain dependencies between patches will have redundant installation and retrograde elements.

The second of the difficulties in checking and installing patches is difficult to determine whether the system is used for the system's stability and whether it is used for the processes and libraries used at the time of installation. For example, an error may occur when a patch installed in a system is not reflected by a rebooting element or a patch is forcibly installed while a process or a library is being used.

A third factor that is difficult to apply is that system administrators or users may not apply all of the computers that are currently in use, even if a patch that exposes security issues exists. Conflicts between different software that might appear in patching. In addition, due to concerns about occurrence of work disturbances and work efficiency detriment factors, they are exclusive. In this case, the system administrator or user wants to apply through various patch application policies and needs a patch inspection and patch installation device that can reflect this stably.

Accordingly, the present invention has been made to solve the above problems, and an object of the present invention is to analyze the system information and patch information and operation status necessary for patch installation of a client computer to install the patch in the shortest path and the installation order It provides intelligent patch management and installation system and method that can improve the stability and security of client's software by providing real-time monitoring of information about processes and libraries and installing patch files at safe time. have.

Intelligent patch management and installation method according to the present invention for achieving the above object comprises the steps of: (a) transmitting a patch definition file to the client computer via a communication network in the patch management server; (b) receiving the patch definition file at the client computer, collecting and generating patch information on whether the patch is installed, system information required for patch installation, and installation status, and transmitting the patch information to the patch management server; (c) receiving and storing installation information of a patch for the client computer at the patch management server; (d) analyzing the patch information on the client computer, outputting an installation list and installation order for installing the patch in the shortest path, and real-time monitoring of information on processes and libraries to generate a patch installation command at a safe time; ; And (e) receiving and installing a patch file from a distribution server through the communication network by the patch installation command and transmitting the result to the patch management server.

The client computer generates and collects system information necessary for patch installation, patch information, and patch information analyzed by an operation state by the patch definition file received from the patch management and installation operating system unit to manage and install the patch. Transmits to the system unit, analyzes the patch information, provides an installation list and installation order for installing the patch in the shortest path, and monitors information on processes and libraries in real time to generate a patch installation command at a safe time point, and the patch And a patch management and installation application for receiving and installing a patch file from the patch management and installation operating system unit by an installation command and transmitting the result to the patch management and installation operating system unit.

Preferably, the patch file is transmitted with respect to a patch installed based on information in the patch definition file.

The patch information may include system information corresponding to a precondition for installing the patch, information on installation conditions, correlation information of the patches, patch installation information related to the patch installation, monitoring information, and command information about installation. It is preferable to include.

The patch definition file includes a patch definition file for individual patches, and preferably includes correlation information between patches, information for patch checking, and information necessary for installation between a software product and a patch.

The distribution server preferably analyzes the patch definition file according to the request of the client computer and supplies a patch file suitable for the client computer.

In addition, the intelligent patch management and installation system according to the present invention for achieving the above object, respectively supply a patch definition file and a patch file to check the patch to the client computer via a communication network, and whether or not to install the patch from the client computer A patch management and installation operating system unit for receiving and storing patch information on system information and installation state required for patch installation, and receiving and storing patch installation results; And generate and collect patch information analyzing system information, patch information, and operation state necessary for patch installation by the patch definition file received from the patch management and installation operating system unit, and transmit the patch information to the patch management and installation operating system unit. By analyzing the patch information, it provides an installation list and the installation order to install the patch in the shortest path, and monitors the information on the process and library in real time to generate a patch installation command at a safe time, and by the patch installation command And a plurality of client computers having a patch management and installation application for receiving and installing a patch file from the patch management and installation operating system unit and transmitting the result to the patch management and installation operating system unit.

The patch management and installation operating system unit supplies the patch definition file to a client computer through the communication network, receives and stores system information, patch information, and patch information about an operation state necessary for patch installation from the client computer, A patch management server for receiving and storing a patch installation result; And a distribution server analyzing the patch definition file according to a request of the client computer and supplying a patch file suitable for the client computer.

The patch management and installation application generates, collects and transmits the patch information analyzing the system information, patch information, and operation state necessary for patch installation of the client computer by receiving the patch definition file, and transmits the patch information to the patch management server. A patch management device configured to analyze the patch information, provide an installation list and an installation order for installing the patch in the shortest path, and monitor the information on processes and libraries in real time to generate a patch installation command at a safe time point; And a patch installation device unit receiving the patch file from the distribution server by the patch installation command received from the patch management device unit and installing the patch file according to the installation list and the installation order.

The patch management device unit receives the patch definition file from the patch management server, analyzes the information on whether the client computer applies the patch, and analyzes the patch information to generate and collect patch information, and the patch management server Patch inspection unit for transmitting to; And a patch command unit generating a list capable of installing a patch in the shortest path according to the correlation and patch information of the patches, and instructing the patch installation apparatus unit to install the patch.

Preferably, the patch installation device unit includes a patch monitoring unit configured to monitor in real time whether the system is started and terminated, whether a process is used, whether a library is used, or whether a binary is used.

Preferably, the patch file is transmitted with respect to a patch installed based on information in the patch definition file.

The patch information may include system information corresponding to a precondition for installing the patch, information on installation conditions, correlation information of the patches, patch installation information related to the patch installation, monitoring information, and command information about installation. It is preferable to include.

The patch definition file includes a patch definition file for individual patches, and preferably includes correlation information between patches, information for patch checking, and information necessary for installation between a software product and a patch.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 and 2 are the overall network configuration diagram and internal configuration diagram of the intelligent patch management and installation system according to a preferred embodiment of the present invention.

Intelligent patch management and installation system according to the present invention, as shown in Figures 1 and 2, the patch management and installation operating system unit 100 having a patch management server 110 and a distribution server (120 (n)) And a plurality of client PCs {200 (n)} for managing and installing a patch file by accessing the patch management and installation operating system unit 100 through a network.

The patch management and installation operating system unit 100 supplies a patch definition file 111 and a patch file 122 for checking a patch to the plurality of client computers 200 (n) through a network, respectively, and the client Receives and stores patch information about whether the patch is installed, system information required for patch installation, and installation state from the computer {200 (n)}, and receives and stores a patch installation result. To this end, the patch management and installation operating system unit 100 is configured to include a patch management server 110 and the distribution server (120 (n)).

At this time, the patch management server 110 supplies a patch definition file 111 for checking a patch to the client computer 200 (n) through the communication network, thereby providing a patch from the client computer 200 (n). Receives and saves patch information about system status and installation status for installation and patch installation, and receives and saves patch installation results.

In addition, the distribution server 120 (n) analyzes the patch definition file 111 according to the request of the client computer 200 (n), and thus the patch file 122 suitable for the client computer 200 (n)}. ).

The patch management server 110 and the distribution server (120 (n)) can be configured as a single server according to the configuration, can use a variety of computer devices and the plurality of client computers (200 (n) over a network) }. In addition, the distribution server 120 (n) may be configured in plural so as to constitute a plurality of client computers 200 (n). In addition, the network may be the same network or a separate network.

The client computer 200 is composed of the patch management server 110 and the client / server structure is operated according to the mutual request. An example environment for implementing a server and a client is described in more detail with reference to FIG.

2 shows an exemplary embodiment of a patch management server 110, a distribution server 120 (n), and a client computer 200 suitable for implementing the patch management device 101 and the patch installation device 102.

The patch management server 110 and the distribution server 120n may distribute patch definition files 111 and 121 for patch inspection. The patch definition file may be configured to be distributed by the patch management server 110 or the distribution server 120 according to a configuration. The patch file 350 of the distribution server 120 may be distributed according to a client's request.

The plurality of client computers (200 (n)), whether the patch is installed by the patch definition file 110 received from the patch management server 110 of the patch management and installation operating system unit 100 and patch installation Collect and generate patch information 330 about the patch information about the system information and the installation state required for the transmission to the patch management server 110, analyze the patch information 330 to install the patch in the shortest path. Provides a list of installations and the order of installation, monitors information about processes and libraries in real time, generates patch installation commands at a safe point of time, and the patch installation commands from the distribution server {120 (n)}. ) Includes a patch management and installation application 300 that receives and installs and transmits the result to the patch management server 110.

Here, the patch management and installation application 300 is configured to include a patch management device 300A and a patch installation device 300B, as shown in FIG.

The patch management apparatus 300A collects and generates patch information 330 about patch information on whether the patch is installed, system information required for patch installation, and patch status by using the patch definition file 111. Send to the patch management server 110, analyze the patch information 330 to generate an installation list and installation order to install the patch in the shortest path, and real-time monitoring of information about the process and the library at a safe time Generates a patch installation command, and transmits the patch installation result to the patch management server (110).

The patch installation device unit 300B receives the patch installation command from the patch management device unit 300A, requests the distribution server 120 (n) to receive the required patch file, and receives the patch with the shortest path. Install in accordance with the installation list and the order of installation.

To this end, the patch management unit 300A includes a patch inspecting unit 310, a patch command unit 320 and patch information 330, and the patch installation unit 300B includes a patch monitoring unit 340, It includes a patch file 350.

Here, the patch inspecting unit 310 receives the patch definition file 111 from the patch management server 110 and analyzes the information on the patch and whether the client computer 200 applies the patch. The patch information 330 is generated and transmitted to the patch management server 110.

The patch command unit 320 analyzes the patch information 330, analyzes an algorithm for installing a patch in the shortest path, and generates an installation list and transmits an installation command to the patch installation unit 300B. .

The patch monitoring unit 340 monitors the start and end of the system, whether the process is used, whether the library is used, and whether the binary is used.

The patch information 305 is information obtained by analyzing the information checked by the patch inspection unit 310 using the patch definition file 111 and information of the client computer 200 about the patch.

The patch installation device unit 300B quickly and securely installs the patch file 350 to the distribution server 120 by using the patch monitoring unit 340 for a patch that needs to be installed. In this case, the patch file 350 transmits a command based on the patch information 330, and may be transmitted from a server of a software developer / supplier rather than the distribution server 120.

The patch management device unit 300A checks whether the patch inspection unit 310 applies the patch to the client computer 200 and notifies the patch management server 110. The patch management server 110 may issue various patch installation instructions for the N patches to the patch management apparatus 300A based on a patch check result.

The patch command unit 320 analyzes the patch information 330 to generate an installation list using an algorithm that can install a patch in the shortest path, and instructs the patch installation unit 300B. The patch installation device unit 300B receives and receives a patch file required for the execution performed by the patch command unit 320 from the distribution server 120.

FIG. 3 is a diagram illustrating patch information 330 inspected and collected by the patch inspecting unit 310 illustrated in FIG. 2.

The patch information 330 is information analyzed by the patch checker 310, and collects information on a patch installed in the client computer 200 and patch application according to an installed program after system booting. In addition, the information described in the patch definition file 111 is inspected and collected. For example, information such as whether a process associated with installing a patch is running, whether a library or binary file is being used by a program.

As shown in FIG. 3, the patch information 330 includes system information 331, correlation information 332, patch installation information 333, information on installation conditions 334, monitoring information 335, Contains command information 336 for the installation. In this case, the correlation information 332 includes information on the patch-specific interconnection relationship and the patch-dependent dependency, and may determine the patch installation order and the number of patch installations that can be quickly applied to various patch application policies. .

An exemplary method for implementing the patch inspecting unit 310 and the patch command unit 320 will be described in more detail with reference to FIG. 4.

FIG. 4 is a flowchart illustrating an example of implementing the patch inspecting unit 310 and the patch command unit 320 shown in FIG. 2.

First, the patch inspection unit 310 performs patch inspection and information collection (step S101), and the patch command unit 320 receives a patch installation command from the patch management server 110 (step S103) and installs a patch. A command for generating is generated (step S105). At this time, the patch installation order and the number of patch installations are determined.

Next, the patch command unit 320 issues a command for patch installation to the patch installation device unit 300B (step S107). Accordingly, the patch installation device unit 300B receives and installs a patch file from the distribution server 120 based on the patch file 350.

Next, the patch installation unit 300B checks the patch installation result in the patch inspection unit 310 and transmits the result to the patch management server 110 through the patch management unit 300A ( Steps S109 and S111).

On the other hand, the command generation step for installing the patch (S105) is the client computer (using the information corresponding to the various system information associated with the patch of the client computer 200, the product information of the software, the installation elements of the patch and the software ( Is processed through the shortest installation path algorithm of the most stable patch.

In addition, the result information sending step (S511) for the commanded installation notification for transmitting the result to the patch management server 110 is checked and transmitted for the dependent patch not directly related to the installation. For example, if patch B is completely dependent on patch A, when patch A is installed and applied, patch B is installed and applied.

An implementation between the patch inspecting unit 310 and the patch command unit 320 for the patch installation will be described in more detail with reference to FIG. 5.

FIG. 5 is a flowchart illustrating an example of implementing the patch inspecting unit 310 and the patch command unit 320 of the patch management apparatus 300A shown in FIG. 2.

First, the patch inspection unit 310 performs a re-inspection for installing the patch (step S201), and then determines whether the patch file can be installed (step S203). At this time, if the patch file can be installed (YES in step S203), the patch file installation command is issued to the patch installation unit 300B to install the patch file (step S205). After the patch file is installed, the patch installation is checked (step S207), and it is then determined whether there is another patch file to be installed (step S209). At this time, if there is no other patch file to be installed, the patch file installation work is completed (step S211).

On the other hand, in step S203, if it is not possible to install the patch file (NO in step S203), the flow advances to step S209.

The patch command unit 320 may command n patches, and proceed sequentially for n patches. Individual patches or a plurality of patches for which the stability of the client computer 200 is confirmed may be installed, and are configured to be installed after re-inspection for handling an exception situation for the use of a client program. For example, when a user of the client computer 200 uses a program for a task or a necessary task, it may be inconvenient for other tasks to install a patch of the computer, and a conflict between patches may occur.

FIG. 6 is a flowchart illustrating an implementation of the patch installation apparatus 300B shown in FIG. 2.

First, when the patch installation device unit 300B receives a command for installing a patch file from the patch command unit 320 of the patch management device unit 300A (step S301), the patch file is distributed from the distribution server 120. Is received (step S303). In operation S305, it is determined whether the received patch file is applicable to the client computer 200 in real time. At this time, if real-time application is possible (YES in step S305), the patch file is installed (step S309), and the patch inspection unit 310 of the patch management device unit 300A is notified of the patch installation information (step S311). ).

On the other hand, if it is not possible to apply in real time in the step (S305) (No in step S305) by using the patch monitoring unit 340 to install a patch file (step S307), the patch installation information to the patch The patch inspection unit 310 of the management device unit 300A is notified (step S311).

In the step (S301), the command delivery for the installation command the installation of individual patches or multiple patches in the patch command unit 320. The patch file 350 for an individual patch or multiple patches is sent by the distribution server 120. If the patch fails to be installed in real time according to the use of the process, the library, and the binary file, the patch is monitored using the patch monitoring unit 340 in real time to the point where it can be installed. The patch monitoring unit 340 operates separately to the patch management device 300A and the patch installation device 300B in separate processes, and exchanges information with the patch installation device 300B.

The patch installation 350 using the patch monitoring unit 340 in step S307 is described in more detail with reference to FIG. 7.

7 is a diagram illustrating an implementation example of the patch monitoring unit 340 illustrated in FIG. 2.

The patch monitoring unit 340 is a real-time monitoring-based device that can be installed safely and quickly when the patch cannot be applied in real time, the start of the system (401), whether the process is used (402), whether the library is used (403) ), Binary usage 404, system shutdown 405, and the like.

The present invention is not limited to the above-described embodiments, but can be variously modified and changed by those skilled in the art, which should be regarded as included in the spirit and scope of the present invention as defined in the appended claims. something to do.

As described above, according to the intelligent patch management and installation system and the method according to the present invention, the stability and security of the software of the client using an algorithm and an installation device that can be installed quickly and securely according to the client environment for various patch applications Can improve sex.

In addition, it is possible to effectively remove elements of fast and redundant installation by using the algorithm that can be applied in the shortest distance by identifying information about vulnerable patches of the system and patch information applicable to the system.

Claims (14)

In the intelligent patch management and installation method, (a) transmitting, at the patch management server, the patch definition file to the client computer via a communication network; (b) receiving the patch definition file at the client computer, collecting and generating patch information on whether the patch is installed, system information required for patch installation, and installation status, and transmitting the patch information to the patch management server; (c) receiving and storing installation information of a patch for the client computer at the patch management server; (d) analyzing the patch information on the client computer, outputting an installation list and installation order for installing the patch in the shortest path, and real-time monitoring of information on processes and libraries to generate a patch installation command at a safe time; ; And (e) receiving and installing a patch file from a distribution server through the communication network by the patch installation command, and transmitting the result to the patch management server. The method of claim 1, wherein the client computer is: The patch definition file received from the patch management and installation operating system unit generates and collects patch information analyzing system information, patch information, and operation state necessary for patch installation, and transmits the patch information to the patch management and installation operating system unit. Analyze the patch information to provide an installation list and the installation order to install the patch in the shortest path, to monitor the information about the process and the library in real time to generate a patch installation command at a safe time point, And a patch management and installation application that receives and installs a patch file from a patch management and installation operating system unit and transmits the result to the patch management and installation operating system unit. The method of claim 2, wherein the patch file is: Intelligent patch management and installation method characterized in that the transmission for the patch to be installed based on the information in the patch definition file. The method of claim 2, wherein the patch information is: System information corresponding to a precondition for the patch to install, information on the installation conditions, the correlation information of the patch, patch installation information related to the patch installation, monitoring information, command information about the installation includes Intelligent patch management and installation methods. The method of claim 2, wherein the patch definition file is: Consists of patch definition files for individual patches, Intelligent patch management and installation method, comprising information on the correlation between patches, information for patch checking, and information required for installation between software products and patches. The server of claim 1, wherein the distribution server is: Intelligent patch management and installation method characterized in that for analyzing the patch definition file in accordance with the request of the client computer to supply a patch file for the client computer. In the intelligent patch management and installation system, It supplies a patch definition file and a patch file for checking a patch to a client computer through a communication network, and receives and stores patch information about whether the patch is installed, system information necessary for patch installation, and installation status from the client computer. Patch management and installation operating system unit for receiving and storing the installation result; And Generate and collect patch information analyzing system information, patch information, and operation state necessary for patch installation by the patch definition file received from the patch management and installation operating system unit, and transmit the patch information to the patch management and installation operating system unit; Analyze the patch information to provide an installation list and the installation order to install the patch in the shortest path, to monitor the information about the process and the library in real time to generate a patch installation command at a safe time point, Intelligent patch management including; a plurality of client computers having a patch management and installation application for receiving and installing patch files from a patch management and installation operating system unit and transmitting the results to the patch management and installation operating system unit. Installation system. The system of claim 7, wherein the patch management and installation operating system unit: A patch for supplying the patch definition file to the client computer through the communication network, and receives and stores the system information, patch information and operation information for the patch installation from the client computer, and receives and stores the patch installation results Management server; And And a distribution server analyzing the patch definition file according to a request of the client computer and supplying a patch file suitable for the client computer. 9. The method of claim 7 or 8, wherein the patch management and installation application is: Receiving the patch definition file generates and collects patch information analyzing system information, patch information, and operation state necessary for patch installation of the client computer, transmits the patch information to the patch management server, and analyzes the patch information to be the shortest. A patch management device unit providing an installation list and an installation order for installing a patch by a path, and real-time monitoring of information on processes and libraries to generate a patch installation command at a safe time point; And Intelligent patch management, comprising: a patch installation device unit for receiving a patch file from the distribution server by the patch installation command received from the patch management device unit, and installs in accordance with the installation list and the installation order; Installation system. The apparatus of claim 9, wherein the patch management device comprises: A patch inspecting unit which receives the patch definition file from the patch management server, analyzes information on whether the patch is applied to the client computer, and analyzes patch information to generate and collect patch information, and transmits the patch information to the patch management server; And And a patch command unit generating a list capable of installing a patch in the shortest path according to the correlation between the patches and the patch information, and instructing an installation command to the patch installation device unit. The method of claim 10, wherein the patch installation device unit: Intelligent patch management and installation system comprising ;; patch monitoring unit for monitoring in real time whether the system startup and shutdown, process use, library use, binary use. 10. The method of claim 9, wherein the patch file is: Intelligent patch management and installation system for transmitting a patch to be installed based on the information in the patch definition file. 8. The method of claim 7, wherein the patch information is: System information corresponding to a precondition for the patch to install, information on the installation conditions, the correlation information of the patch, patch installation information related to the patch installation, monitoring information, command information about the installation includes Intelligent patch management and installation system. 8. The method of claim 7, wherein the patch definition file is: Consists of patch definition files for individual patches, An intelligent patch management and installation system, comprising information on the correlation between patches, information for patch checking, and information required for installation between a software product and a patch.

Images