TW583585B - A module of safe execution program under Windows operating system and method thereof - Google Patents

Abstract

The invention relates to module of safe execution program under Windows operating system (OS) and method thereof are adapted to secure user's program execution under Windows OS that won't cause the protected file system, networking system and registry tree from being changed or devastated as a result of exceptional event and are characterized by executing the safe execution module of the invention under the Windows OS to ensure correct operation of user's program under the Windows OS.

Description

583585 V. Description of the invention (1) [Field of the invention] The present invention relates to a module and method for safely executing programs under a Windows operating system, and is suitable for ensuring that user programs are executed under a Windows operating system, so as not to be caused by exceptional events. The protected file system, network related system, and registration tree are changed or destroyed, which is characterized in that the windows operating system is implemented to install the security execution module of the present invention to control the user program to correctly operate in the windows operating system. Performed without error. [Background of the Invention] The present invention relates to a module and method for safely executing programs under a Windows operating system, and is suitable for ensuring that a user program runs under a Windows operating system without causing a protected file system due to exceptional events. The road-related system and the registration tree have been changed or destroyed, which is characterized in that the security operating module of the present invention is executed under the window operating system to control the user program to execute correctly under the window operating system without errors. U.S. Patent No. 6,36,96,96, published on April 2, 2002, a method and system for automatically executing a program π, whose main function is to detect a medium that stores a program When put into the drive, the method and system will automatically execute the stored program. The main principle is that the operating system periodically inquires and asks the drive about the current state of the drive, and the operating system is responsible for determining whether the current state of the drive has changed. If the current state of the drive has changed, the operating system broadcasts a message that the current state of the drive has changed. Once the shell (s h e 1 1) receives a message from the operating system, the

Page 4 583585 V. Description of the invention Xun Si should not take the drive. The current state of the drive has been placed in the beta drive. The volume has been placed on the disk media. The file program is automatically executed. The knowledge type is automatically executed. The current state has changed. After the changed event, if the drive is currently in the state machine, the shell will search for a shell and then perform a predetermined operation. Therefore, the method does not require any user action, and the shell layer will determine that the magnetic indicates that a storage medium has been changed to show that the storage medium is defined in the storage in advance, and that the system will participate in any action that the system will store .

What is She 1 (She 1 1)? She 1 (She 1 1) 's role in the operating system is: as a tool of instruction interpreter and programming language. The operating system arranges that the user talks to the shell at the beginning of each computer job. During this work, the user can repeatedly talk to the shell and issue commands to the shell to instruct the system to work for the user. In fact, anything the user does to the operating system is through the shell, so the shell can be thought of as a command interpreter that surrounds the kernel. The characteristics of the shell are as follows: 1. Parental command processing: The communication between the user and the operating system is conducted through the shell 1 for a conversation. 2 Background work processing.

3. Re-input-output orientation: The order for the purpose can be changed from wheel-in / turn-out (<, >, < <, > >) conveniently. 4 · Pipeline processing (pipe): Several simple instructions can be connected together to become a more complex task. 5 · This pair of generalized identifiers (?, *): Through a simple set of strings, one or more files can be selected at a time for processing, avoiding repetition

583585 V. Description of the invention (3) The trouble of inputting instructions. 6. Shell script (Shell script) ·· Shell commands are typed in a file, and the file will be read out sequentially from the file and executed one by one, such as the same batch operation. 7. Shell variable: By storing data in the variable, the shell can freely access the variable and increase the space for the shell program. U.S. Patent No. 6,3 6 6,9 6 6 can automatically load the specified file for execution, but U.S. Patent No. 6, 3 6 6, 9 6 6 cannot provide the required file system, network Related systems, and registration trees, give due protection. Please refer to Fig. 1 (a) for the software execution environment of the window operating system before the safe execution program module of the present invention is added. The window operating system 1 1 in FIG. 1 (a) can directly process and process the direct call request from the user program 120. In contrast, the window operating system 1 1 0 Incoming calls require errors, and the chances of system confusion and disorder increase. [Summary of the Invention] The main purpose of the present invention is to provide a module and method for safe execution under the Windows operating system to provide and ensure that the user program runs under the Windows operating system. Furthermore, the present invention can ensure that Designated protected file systems, network related systems, and registration trees, so as not to cause unauthorized changes or destruction due to accidents. Third, it can effectively reduce the user program's security hotspot under the Windows operating system. The amount of the master's record.

Page 6 583585

[Detailed description of the invention] ^ The present invention uses a secure execution module, which is executed in a computer running a Windows operating system, so as to isolate and process a new execution program for this window operation. System call, (ca 11) 'Ensure the computer's file system module, network system module, and registration tree module. Not affected by the results of the execution of the newly added program. The Windows operating system of Microsoft Corporation is used as an illustration. Figure 1 (b) is the system architecture diagram of Windows 2000 / χρ itself. Service procedures and applications are available. Subsystem dynamic link libraries (subsystein DLLs) 17 (^ System exchange data. The role of the subsystem dynamic link libraries (subsystem DUd 1 70) is to convert filed functions (public use interface) into the appropriate Windows 2 0 0 0 / χρ internal system use, this conversion may or may not be requested to the environmental subsystem 1 800, which is providing services to the user's application 160, and Figure 1 (c) shows the basis of this The software operating environment diagram 'c (c)' s window operating system 1 1 0 formed by the invention may not be able to directly process the direct call request from the user program 120. If the safe execution program mode of the present invention is activated, In the case of group 130, the user's call request selected in advance will be intercepted by the security execution program module of the present invention, and will be delivered to the window after it is recognized as harmless. Industry system π 〇. Therefore, the chance of system chaos and disorder is also greatly reduced.-Figure (d) is a system architecture diagram of the Microsoft Windows 2000 / X P to execute the safe execution program module of the present invention, the service program , Not monitored

583585 5. Description of the invention (5) The application programs 183 and the monitored applications 185 can exchange data with the system through the subsystem DLLs 1 70. The new execution program includes an execution file placed in a special directory. In this embodiment, the special directory is "C: \ Lmz", because the application program placed in the special directory C.XLmz 'will be automatically loaded. It can also be called a fork monitoring application. The monitored application is an execution slot. The extension file format of the execution file can be .COM, or, '.ΕΧΕΠ.

In Figure 1 (d), the function of the security execution program module of the present invention must be turned on. At this time, the call request issued by the monitored application program 18.5 will first dynamically link the subsystem DLLs through the subsystems. ) 1 70 ', and then through the security execution program module 130 of the present invention, first filter improper call requests to prevent system confusion and disorder. After filtering, call requests can be exchanged with the system.

If the function of the security execution program module of the present invention is turned off, the call request issued by the monitored application 1 8 5 at this time will follow the path as the unmonitored application 1 8 3, which can be dynamically transmitted through the subsystem. Subsystem DLLs 1 70 exchange data directly with the system. It has no protection function and is more likely to cause system chaos and disorder. The above-mentioned sub-system dynamic link library (s u b s y s t e m D L L s) is a specific example of an application programming interface (API). Figure 2 'shows a more detailed and detailed architecture diagram of the security execution granular module and related modules of the present invention. In FIG. 2, the window operating system 11 0, the present invention safely executes the program main program 1 3 5, and the monitored application program 1 8 5, and the interaction place is all in the memory 2 1 0, in which the installation of this

Page 8 5853585 V. Description of the invention (6) When the safe execution program module 130 is invented, it will be installed in the Windows operating system 1 10, and the additional file system protection drive module 2 2 1 and the network system protection drive module Group 2 2 3, and the registration tree (R egistry) protect the driving module 2 2 5. The file system protection driver module 2 2 1 is mainly used to intercept, isolate, and process the newly-added execution program to the Windows operating system's application programming interface (API) and write file (open). Application Programming Interface (API), Application Programming Interface (API) for deleting files. The network system protection driver module 2 2 3 is mainly used to intercept, isolate and process the newly-added program to the Windows operating system regarding the Transmission Control Protocol (TCP) Transmission Control Protocol application programming interface user data element agreement UDP (User Datagram Protocol) application programming interface, and the Net Basic Input / Output System (NetBIOS) application programming interface. Registration tree (Registry) protection driver module 2 2 5, mainly used to intercept, isolate and process the newly-added program to the Windows operating system regarding the Regjnte application programming interface and registration deletion. (Reg-Delete ) Application programming interface. One person made the female full execution program module 130 of the present invention work. You must first go through the installation steps. After installation, the file system protection driver module 221, the network system protection driver module 2 23, the registration tree (Regi stry) protection driver module 2 2 5 and the secure execution program module i 3 〇 The main program will be added in Windows Explorer 1 10 in File Explorer. The detailed installation steps are as follows in this article: first obtain a secure execution process

Page 9 583585 V. Description of the invention (7) The compression tank nSafeRun020403 " of the type module 130 is shown in Figure 3 (a). The compressed file ′ ′ S a f e R u η 0 2 0 4 0 3 π is opened π, as shown in FIG. 3 (b). Since “nSafeRun020403” is a compression building, the daytime surface of the winzip decompression program will naturally float, as shown in Figure 3 (c). The Wiz nz decompression program will open the compressed file n Saf εΓίιη0 2 04 0 3 '^ All The file is included, and the screen is shown in Fig. 3 (d). At this time, please select the compressed file "Safe Run 0 2 0 4 0 3", all the eaves cases are included, and the daytime surface is shown in Fig. 3 (e). The W inzip decompression program will ask you to extract the selected contained files to that directory. In this embodiment, select the “n sample” directory, as shown in Figure 3 (f). The “n sample” directory The subdirectory "Disk Γ" will generate all the decompressed files, as shown in Figure 3 (g). In the subdirectory " Diskr will generate all the decompressed contained files, select the " set up " file and prepare for installation as shown in Figure 3 (h). The initial process of installation is shown in Figure 3 (i). The welcome surface during the initial installation is shown in Figure 3 () ·). During installation, you will be asked to install under the destination folder, as shown in Figure 3 (k). The security execution program module of the present invention is installed under the destination folder, and its proportion reaches 57%, as shown in FIG. 3 (丨). The safe execution program module of the present invention is installed under the destination folder, and its proportion reaches 98%, as shown in FIG. 3 (m). After installation, the shortcut of the safe execution program module of the present invention automatically appears on the desktop. Small image π shortcut: Safe R u ηπ, as shown in Figure 4 (a). Check whether the application to be monitored is placed under the sub-directory nC: / Lmz, as shown in Figure 4 (b). Group, floating image appears

Page 10 583585 V. Description of the invention (8) n Saf e T u ηπ, as shown in Fig. 4 (c), shows that the safe execution program module function of the present invention is turned on. You can check all the monitored applications 1 8 5 as shown in Figure 4 (d). At this time, the brick-breaking program n F 1 ash N Gπ is automatically loaded and executed, as shown in Figure 4 (e). The file system, network system, and registration tree (Reg is try) of the window operating system 1 1 0. It is protected by the safe execution program module of the present invention. When the monitored application 1 8 5 ends, the monitored application 1 8 5 will be automatically removed from the memory 2 1 0. To end (disable) the safe execution program module 1 3 0, simply select π to end the execution of the safe execution program module 1 3 0. FIG. 5 is a flowchart of the method of the present invention, illustrating the execution flow of the secure execution module 130 of the present invention. First of all, it is necessary to determine whether the safe execution program module 5 1 0 of the present invention is installed. If it is not installed, 5 2 0 must be installed. The detailed steps are shown in Figure 3 (a), (b), (c), (d), ( e), (f), (g), (h), (i), (j), (k), (1), and (m). If it is installed, then check whether the sub-directory n C: / Lmzn has placed files 5 3 0, which are the applications to be monitored. If it is, execute the safe execution program module of the present invention 540, and then automatically execute the monitored application program 550. After the execution of the monitored application program is finished, the safe execution program module of the present invention may be terminated. group. Although the preferred embodiments have been used to describe the present invention, those skilled in the art need to understand that the above embodiments can be modified and changed without departing from the spirit and viewpoints of the present invention. The above description is only the preferred specifics of the present invention. In the examples, all equivalent changes and modifications made in accordance with the scope of patent application of the present invention are

583585 V. Description of invention (9) It should be covered by the patent application for this invention. Page 12 583585 Schematic description [Schematic description] Figure 1 (a) is a diagram of a conventional system architecture. Figure 1 (b) is a system architecture diagram of the conventional Windows 2000 / XP. FIG. 1 (c) is a system architecture diagram related to the present invention. Figure 1 (d) is a system architecture diagram of findOWS 2000 / XP for executing the safe execution program module of the present invention. Figure 2 is a more detailed architecture diagram of the security execution program module and related modules of the present invention. Figure 3 (a) shows the obtained compressed file "SafeRιln020403". Figure 3 (b) shows the open compressed file Saf eRun0 2040 3 ,. Figure 3 (c) shows the screen of winzi p decompression program. Figure 3 (d) shows the W inzip decompression program will open the compressed file " SafeRun0 2 040 3 ”all contained files. Figure 3 (e) shows all the files contained in the selected compressed file "Saf eRun0 2 040 3,". * Figure 3 (f) shows the directory containing the extracted files, extracted to the sample " directory. Figure 3 ( g) Display the subdirectory "nDi ski" to generate all decompressed files. Figure 3 (h) shows the "setup" file selected and ready for installation. Figure 3 (i) shows the initial installation process. Figure 3 (j) shows the welcome screen during the initial installation process. Figure 3 (k) shows the query Installed in that destination folder.

Page 13 583585 Brief description of the drawings Figure 3 (1) shows that the proportion of installing the safe execution program module of the present invention reaches 5 7%. Figure 3 (m) shows that the proportion of installing the safe execution program module of the present invention reaches 98%. Figure 4 (a) shows the shortcut small image n shortcut of the present invention: S a i e R u η ′ ′. Figure 4 (b) shows checking whether the sub-directory π C: / 1 ^ 2 "has placed the application to be monitored. Figure 4 (c) shows floating movable images" Safe Tunπ. Figure 4 (d) shows that all monitored applications can be checked. Figure 4 (e) shows the automatic loading and execution of the brick-breaking program "F 1 ash N G ". Figure 5 is a flowchart of the safe execution program module of the present invention. [Illustration of drawing number] 11 0 Windows operating system 12 0 use User program 130 Safe execution program module 135 Safe execution program main program of the present invention 160 Application program 170 Subsystem dynamic link library 180 Environment subsystem 183 Unmonitored application program

Page 14 583585 Schematic description of 185 application program under monitoring 210 memory 221 file system protection drive module group 223 network system protection drive module group 225 registration tree (Regis s 丨 t r y) protection drive module

Page 15

Claims (1)

583585 ^ IrTTu 6. Scope of patent application 1. A security enforcement 4 is implemented in a lever hybrid core / and includes a security execution protection module, _. Executed in the computer of the core 111 operating system, used to intercept and block ^ A control application calls to the Windows operating system to ensure that Lei Cong τa. ^ ^ ^ The details of the execution of the new execution program should be damaged, and the An Lingbo 4 I / Wen Wang The subscription security module includes: & Case system protection driver module, which is used to intercept, isolate, and process the application of the control system privately to the Windows operating system about performing an open file (if file) / ( Write) call, delete (delete) file call; ◊ > Network system protection driver module, which is used to intercept, isolate and process the article monitoring application to the Windows operating system regarding the Transmission Control Protocol TCP (Transmission Control Protocol) Call, User Datagram Protocol (UDP) call, and NetBIOS input / output system (NetBIOS) call; a registration tree (Reg is try) protects the driver module, which is used to intercept , Isolate and process the monitored application's Reg-Write call and Reg-Delete call to the Windows operating system. 2 · The secure execution program module described in item 1 of the scope of patent application, wherein the call is an application program interface API (Application Program Interface) 0 3 · The secure execution program described in item 1 of the scope of patent application The module further includes a uniform enable / disable switch module, which is executed in the computer to enable the function of the secure execution protection module or to close the secure execution 583585, this review VI. Patent application scope Protection module function. 4. The secure execution program module according to item 1 of the scope of patent application, wherein the Windows operating system is a Microsoft Windows operating system. 5. The secure execution program module as described in item 1 of the scope of patent application, wherein the monitored application program includes an execution file placed in a special directory. 6. The secure execution program module as described in item 5 of the scope of patent application, wherein the format of the extension name of the execution file may be 'COMπ. 7. The safe execution program module as described in item 5 of the scope of the patent application, wherein the format of the extension name of the execution file may be 'EXE'. 8. A method for safely executing the program, which is applicable to an execution window operation The computer of the system ensures that the computer is not damaged by the execution result of a monitored application. The method includes: coding (coding) a security execution protection module, wherein the security execution protection module includes: a file system The protection driving module is used for intercepting, isolating and processing the monitored application to execute an open call, a write call, and a delete slot call to the window operating system; a network The system protection driver module is used to intercept, isolate and process the monitored application program. Page 17 583585 6. The scope of patent application is determined by TCP (Transmission Control Protocol) call, User Datagram Protocol (UDP) call, and network basic input / output system (Net BI 0 S) call; a registration tree (Reg is try) protection driver module, which is used to intercept, isolate and process the monitored application program's Reg-Write call and Reg_Delete call to the Windows operating system; execute the security execution protection Module on the computer. 9. The method for safely executing a program as described in item 8 of the scope of patent application, wherein the call is an Application Program Interface (API). 10 · The method for safely executing a program as described in item 8 of the scope of the patent application 'further includes: ^ Writing a consistent / disabled switch module to enable the function of the secure execution protection module or to disable the security Execute the function of the protection module; execute the enable / disable switch module on the computer. 11 · The method for safely executing a program as described in item 8 of the scope of patent application, wherein the window operating system is a window operating system of a micro-soft company. 1 2 · The method for safely executing a program as described in item 8 of Shenyan's patent scope, wherein the monitored application program includes an execution program placed in a special directory 583585 rj ^ r /, ^; r \ Ψ! ≫ η ^ ^; :: Ί 6. Application for Patent Scope 1 3. The method for safely executing a program as described in Item 12 of the Patent Scope, where the execution file The extension file format can be " .COM ". 1 4. The method for safely executing a program as described in Item 12 of the scope of patent application, wherein the file name format of the executable file can be π. ΕΕΕ ". I like 1 Q hundred