1328179 \ 九、發明說明： 【發明所屬之技術領域】 ^ 本發明為一種關於控制應用程式之模組與方法，更特 疋5之’為—種關於限制客戶端應用程式操作權限之模组 • 與方法。 … 【先前技術】 因為資訊科技的發展’各企業均日漸依賴電腦協助其 ^ Λ的推展但貧訊科技的普及同時也伴隨著風險，來自 亦例如病毒、後門程式、系統漏洞攻擊等威脅 θ，因此企業之資訊防護即成為重要課題。 ㈣全的威脅除了來自外部的攻擊，更可能來 威脅源其實來自：1相：f 5周查發現對於企業資訊安全的 因此企掌内部關二：：思的行為與非惡意的失誤操作， 實為暗藏資安威脅之處，如何解決内吏取行為， 企業所=須面臨的重要安全課題。^貝訊女王問題，是 端構成丄内:全管理’多以伺服端與客户 為加以控管；是故市面上軟:服二對於客戶端上之操作行 制，對多台客戶端電腦加_ ‘二達料地管理與控 級，為相對應限制之功能日2: ’、根據客戶端授權層 對企業内部對於外部資訊的存取^亥種控管糢組，只能針 或自特定網址下载程式之蚵如對瀏覽外部網頁， 絕程式操作或網頁的存取 以限制，而且僅能做到阻 取，而不能僅是限制特定功能操 5 1328179 ί网修止替齡^ 作’例如目前監控模組尚不能作到可劉覽外部網頁但對於 特定網頁資訊之儲存，剪貼網頁等操作加以限制的功能。、 因此如何在使用者在近用企業内部資訊時，例如企業 =用企業資源規畫（細erprise Re繼rce piannmg，ERp)系 3 =率管理使用者操作行為，防止使用者惡意操作 知作，造成資訊安全管理上之漏洞，實為急待解決1328179 \ IX, invention description: [Technical field of the invention] ^ The present invention is a module and method for controlling an application program, and more specifically as a module for restricting the operation authority of a client application. And method. ... [Prior Art] Because of the development of information technology, companies are increasingly relying on computers to help them promote their popularity. However, the popularity of poor technology is also accompanied by risks, such as threats such as viruses, backdoors, and system exploits. Therefore, information protection of enterprises has become an important issue. (4) All threats In addition to attacks from outside, it is more likely that the threat source comes from: 1 phase: f 5 weeks found that for corporate information security, therefore, the internal control of the two:: thinking behavior and non-malicious mistakes, real In order to hide the threat of security, how to solve the problem of internal exploitation, enterprises must face important security issues. ^Beixun Queen's problem is the end of the composition: the whole management 'more control by the server and the customer; is the market soft: service two for the operation of the client system, for multiple client computers _ 'Two-level management and control level, for the corresponding limited function day 2: ', according to the client authorization layer to the internal access to the external information of the enterprise ^ Hai type control module, can only be needle or self-specific The URL downloading program is limited to accessing external web pages, extreme program operations or webpage access, and can only be blocked, and can only be used to restrict specific functions. 5 1328179 ί At present, the monitoring module is not able to perform the function of restricting the operation of the specific webpage information, the scrapbooking webpage, and the like. Therefore, how to manage the user's operation behavior when the user is using the internal information of the enterprise, for example, the enterprise=using the enterprise resource planning (fine erprise Re following rce piannmg, ERp), to prevent the user from maliciously operating the knowledge, The loopholes in information security management are urgently needed to be resolved.
是故本發明揭露一種可 操作與管理與更新相關權限 決上述問題。 【發明内容】 限制客戶端上應用程式與網頁 貧料之控制模組與方法，以解 2月揭露一種關於控制客戶端程式與網頁操作之模 端且方法’本發明至少包含一輸入端—。le)、一伺服哭Therefore, the present invention discloses an operability and management and update related authority to solve the above problems. SUMMARY OF THE INVENTION A control module and method for restricting applications and webpages on a client is disclosed in order to disclose a method for controlling client program and webpage operations in February. The present invention includes at least one input terminal. Le), a server crying
客戶端（ciient);其中輸入端之功能為負‘ =遞變更權限指令;飼服器端之功能則包含:根據輪入 斤傳入之指令變更伺服器端所儲存之權限資料、 =變更權限事件’與更新儲存於客戶端之權 ^戶^可根據伺服器端之通知訊息取得更新之權限資 方：以：：客戶端應用程式的操作權限。藉由上述模 、、。= ’本發明即可達到限制客戶端程式操作之目的。 本發明尚揭露一種隼φ松& > 作之模组盘方半 集中控Η旻數客戶端應用軟體操 之，與方法，以達到即時與統一控制 本發明之―具體實施财，伺 = 均包含-資料庫;上述資料庫包含以一組權限資料= 6 1328179 (ft兑細修正 與控制指標’藉由權限資料儲存表上之記錄與該控制指標 間之互動對應關係，即可於伺服器端統一管理與更新複數 客戶端關於應用程式操作之權限資料。 【實施方式】 本發明將配合其較佳實施例與隨附之圖示詳述於 下，應理解者為本發明中所有之較佳實施例僅為例示之 用，因此除說明書中所述之較佳實施例與參考圖示外，本 發明亦可廣泛地應用在其他實施例中。且本發明並不受限 於任何實施例，應以隨附之申請專利範圍及其同等領 定。 第一圖為顯示關於本發明之一具體實施例，該控制模 组包含一輸入端100、一伺服器端2〇〇與一客戶端3〇〇，其 中輸入端100功能為接收與傳輸受控管應用程式操作權限 指令；伺服器端200則可儲存前述權限資料、於輸入端1〇〇 與客戶端300間傳遞關於操作權限之資料與更新客戶端 # 300 ±儲存之操作權限資料；客戶端3〇〇則可根據飼服器 所傳來的變更權限事件訊息，更新客戶端上儲存之操作權 限資料，並據以限制客戶端上應用程式之操作權限。以上 述架構，控制模組即可限制客戶端之應用程式之操作。關 於=發明之控制模組可適用於家庭、辦公室環境等内部網 路衣i兄中，但並不限於此；該模組尚可以應用於任何有杵 制客戶端應用程式操作需要之網路環境，例如圖書館 路咖啡廳等等空間。 關於上述實施例中控制模組之功能可以更詳述如下。 7 1328179 料抑㈣修止替換頁 lk_ _ _ |_ ^述控制模組中輸人端_，減為接收與輪出使用者所 輸入指令’以通知飼服器端200變更資料庫中儲存之權阳 資料；上述之輸入指令包含新增、修改、删除關於限㈣ 開放受控管應用程式特定功能與查詢該項目狀態Client (ciient); the function of the input terminal is negative '=delivery change permission command; the function of the feed server includes: changing the permission data stored on the server end according to the instruction of the incoming charge, = change permission The event 'and the update stored in the client's right ^ can be updated according to the notification message on the server side: to:: the operating rights of the client application. With the above model, . = 'The invention can achieve the purpose of limiting the operation of the client program. The invention still discloses a method for the application of the soft-sports in the semi-centralized control client of the module, and the method for realizing the unified and unified control of the present invention. All include - database; the above database contains a set of permission data = 6 1328179 (ft and fine correction and control indicators' by the interaction between the records on the permission data storage table and the control indicators, you can use the servo The device end uniformly manages and updates the rights information of the plurality of clients regarding the operation of the application. [Embodiment] The present invention will be described in conjunction with the preferred embodiments and the accompanying drawings, which should be understood as all of the present invention. The preferred embodiments are merely illustrative, and thus the present invention may be applied to other embodiments in addition to the preferred embodiments described in the specification and the reference drawings, and the invention is not limited to any implementation. For example, the present invention should be based on the scope of the accompanying patent application and its equivalent. The first figure shows an embodiment of the present invention. The control module includes an input terminal 100, a server terminal 2 and a server. The client terminal 3, wherein the input terminal 100 functions to receive and transmit the controlled pipe application operation permission command; the server terminal 200 can store the foregoing permission data, and transfer the operation permission between the input terminal 1 and the client terminal 300. The data and update client # 300 ± stored operating authority data; the client 3〇〇 can update the operating authority data stored on the client according to the change permission event message sent by the feeding device, and thereby limit the customer The operation permission of the application on the side. With the above structure, the control module can limit the operation of the application of the client. The control module of the invention can be applied to the internal network, such as the home and office environment, but The module is not limited to this; the module can be applied to any network environment that requires the operation of the client application, such as a library road cafe, etc. The function of the control module in the above embodiment can be more detailed. As described below. 7 1328179 Material (4) Repair replacement page lk_ _ _ |_ ^ The input module in the control module _, reduced to the input and the user input instructions Servo end 200 of the right to change the store information database sun; above the input command contains add, modify, delete (iv) limit on open by the Control Manager application-specific functions and query the status of the project
=令。更特定言之，上述變更權限指令中，關於限制Ξ &應用程式操作功能之項目包括：禁止料特定資H 定Γ'禁用鍵盤、禁用另存新檔與禁用滑鼠： 3特…專功能；於另一具體實施例中，尚包括限制網 頁貧訊存取功㉟，其項目包括：禁止列印、s用複製特定資 訊、禁用鍵盤、禁用另存新檔與禁用滑鼠拖戈資料 以郵件傳送網頁、禁止檢視原始檔。 丁 關於本發明之-具體實施例中，上述輸入端為一使用 )丨面，使用者可藉由點選介面上之選項，控管特定應用 :呈：之操作權限。使用者可點選使用者介面之功能鍵厂例 二用特定功能選項，即可開啟—視窗分區，該視窗㈣ 刀數攔位包含該受控管軟體名稱、類型與功能選項。使用 者可點選畫面上方之修改選項於視窗中輸人受控管之程式 ，稱，即:開啟權限功能設定視窗，輸人權限功能設定^ Λ上述權限功能設定視窗包含複數個預先設計之攔位， 2者可根據各攔位對應之功能加以勾選，即可開啟或關 閉特定功能，完成輸入端的輸入。 關於本發明之另一具體實施例為關於限制控制 操作’於該具體實施例中，操作介面與上述控管特定應用 程式之操作介面相似，但使用者所輸入之控制標的為一網 8 ^28179 月修正替換頁 址〇 -—— 於本發明之具體實施例中，伺服器端2〇〇包含以下功 能：接收輸入端輸入之變更權限指令，儲存、更新與傳= 關於客戶端之受控管應用程式權限資料。 ^ ' π〇伺服器200包含一資料接收與傳遞單元201、—處理 .單元202與-資料庫單元2〇3。資料接收與傳遞單元处2〇1 可接收來自輸入端100之變更權限資訊，之後將資料傳遞 予處理單元202,處理單元202根據該變更權限資訊，除 更，貝料庫早疋203中之權限資料，並透過資料接收 遞單tl 201發出變更權限通知，通知客戶端3〇〇該權限變 更事件的發生。伺服器端200則於接收到客戶端3〇〇 7權限資料下載請求後，即會傳送—變更權限資料予客戶 端300 ’以更新客戶端3〇〇上儲存之應用軟體權限資料。 上，之伺服器200亦包含如記憶體、作業系統、硬碟、顯 不早兀等之其他構件，然熟知該項技藝者應得以理解，為 鲁避免模糊^明之焦點，故不贅述。輸人端與客戶端亦同 ^更特定言之，於關於本發明之一具體實施例中，上述 =料接收與傳遞單元2〇1係利用Tcp通訊協定，通知客戶 2 300下載權限資料，並係以不同代號代表應用程式權限 貝料與網址權限貢，料；而通知客戶端權p艮資料更新之事件 係使用UDP協定。於關於本發明之另一具體實施例中，自 上述資料接收與傳遞單元201所傳送之權限資料包含對應 於客戶端欠控官之應用程式或網頁之指標資料，以使客户 端得以確定所要更新之權限資料。 9 1328179 ‘換頁 上述用於儲存權限資料之資料庫203包含一組資料 表與控制指標，用以紀錄與更新關於客戶端上儲存之應用 程式權限資料。於關於本發明之一具體實施例中，上述資 料表至少包含兩資料表：資安行為（security—acti〇n)與資安 策略（securityjolicy)執行權限資料操作限制功能，其中資 安行為（security一action)為紀錄包含但不限於受控管之應、 用程式、指令、網址或網頁等之行為或模式，資安策略 (security一policy)紀錄包含但不限於關於特定應用程式、指 令、網址或網頁之權限資料。資安行為子資料庫中至少包 含以下攔位：辨識表（id)為一指標襴位’用於與其他工作^ 產生關聯、分類表（categ〇ry)用於紀錄應用程式、指令、網 址或網址之類型、標的名稱（target一name)用於紀錄受控管 應用程式執行檔名或受控管網址、標的類型 用於紀錄文控官標的類型。Security_p〇licy表則是紀錄受 控管應用程式或網址之權限限制資料。資安策略表中量化 參（value)攔為紀錄一指標資料，該指標與軟體行為 action)中辨識（〖d)攔位中指標資料具相對應關係，以使兩資 料表產生關聯關係；解除行為（Disabled 一扣如…攔則是紀 錄該應用程式或網址所要被限制之權限，該襴位可寫入特 疋數值，表示該行為被管控，不能使用。 一客戶端模組3〇〇則至少包含以下功能：自伺服器端接 叉讯息、自伺服器端下載權限資料與設定權限資料。於— 具體實施例中’客戶端包含一權限控制單元，例如一另外 植入之權限控制程式，以實施上述客戶端之功能。於另— 1328179 .奸糊_正替換頁 ::實施例中，客戶端包含一資料庫用於儲存客戶端權限 ^己盡^資料庫包括—組資料表與控制指標，其中資料 戶端受控管之應用程式資料，且各受控制標的之 貝科包卜控㈣標與舰H端上相同受㈣標的之控制 相對應_，因此客服端方可於下載伺服器新權限 貝料後’找出相對應之受控制應用程式權限資料並加 新。 —關於本發明之另-具體實施例中，控制模組可為上述 貧施例之中控制模組之複數組合，以完成—多層次之控制 模組，此多層次之控制模組可根據不同授權層級，限制各 飼服器可更動之權限資料，以達到分級管理之目的。於該 具體實施财’包含—中央飼服器與複數台周邊飼服器以 及=端電腦。中油服器之資料庫儲存各周邊飼服器權 限;貝料周邊伺服器除儲存該周邊伺服器權限資料，尚儲 存$定區域内客戶端上應用程式之權限資料。在上述多階 層茱構下’由一中央伺服器統一管理各周邊伺服器上權限 資料之狀態與更新，周邊飼服器則根據不同需求，不同授 權層級，開放不同之權限資料變更權限，以管理客戶端= 應用程式，以此一控管架構即可達成分級，分區授權之資 讯女全官理架構，管理客戶端電腦上應用程式之操作。如 此除可迅速更新複數台客戶#之權p艮外，&可避免需手動 逐區更新伺服器權限資料時，所可能發生之錯誤。 第二圖為顯示關於權限更新流程之具體實施例；使用 者可透過輸入端於步驟S101輸入變更權限並更改伺服器 11 今月Ο^ι修正替換買 端之權限資料，並於後1^^·^ 端該變更權限資訊事件。步驟S2〇 =通^伺服器 到上述變更權限資％廿认 表不伺服器端200收 通知客戶端兮…〜 驟S202中，發出訊息 中收刭仞服哭#扁十 在客戶端於步驟S301 驟S3(J發^ 息後’即於後續步 ;牛：發Μ息要求自飼服器端下載新權限設定。於後 =驟S203中，資料庫根據由步驟幻 自 ^上述更新後之權限資料，並於步驟隨將上if新 =權限資料傳送給客戶端。客戶端於㈣咖中^ 服心所傳送來之新權限資料後，於步驟s3〇 何客戶端之權限設定。 =;具體實施财1於本發明之㈣更新 用於多部週邊飼服器之情形，在此實施例中，其更新流:、 圖所顯示之流程類似，但各周邊伺服器可由-中央 词月艮益官理，於太g Λ-t. t » 、本-體實施例中，伺服器端之變更權限指 2由=央伺服器端下載，但根據對各伺服器或使用者所 汗从之權限’也可由各伺服器之輸入端輸入權限資料。是 文2由中央伺服器之設置，將複數個與第二圖相同之更 Ί «•轾互相組合，即可達到分層、分區之應用軟體 限管理。 隹 ^本發明以較佳實施例說明如上，然其並非用以限定本 =^月所主張之專利權利範圍。其專利保護範圍當視後附之 申請專利範圍及其等同領域而定。凡熟悉此領域之技藝 者’在不脫離本專利精神或範圍内，所作之更動或潤飾， 12 ,μΛ'ΜΤΤΓ- 一 ::::發明所揭示精莽下所完成之等= order. More specifically, in the above-mentioned change permission command, the items related to the restriction Ξ & application operation function include: prohibiting the specific resource H Γ 'disable the keyboard, disable the save new file and disable the mouse: 3 special... special function; In another embodiment, the method further includes limiting webpage accessibility access 35, the items of which include: prohibiting printing, copying specific information, disabling the keyboard, disabling the saving of new files, and disabling the mouse dragging data for mail transmission. Webpage, it is forbidden to view the original file. In the specific embodiment of the present invention, the input terminal is a user interface, and the user can control the specific application by using an option on the interface: The user can click on the function key of the user interface. The second function can be opened by using the specific function option. The window partition (4) The tool number block contains the name, type and function options of the controlled pipe software. The user can click the modification option at the top of the screen to enter the controlled control program in the window, that is, open the permission function setting window, the input permission function setting ^ Λ the above permission function setting window includes a plurality of pre-designed blocks Bits, 2 can be selected according to the function corresponding to each block, can open or close specific functions, complete the input of the input. Another embodiment of the present invention relates to a limit control operation. In the specific embodiment, the operation interface is similar to the operation interface of the control specific application, but the control target input by the user is a network 8 ^ 28179 Monthly Correction Replacement Page 〇-- In the specific embodiment of the present invention, the server terminal 2〇〇 includes the following functions: receiving the change permission command input input, storing, updating and transmitting = about the controlled tube of the client Application permission data. ^ 'π〇 server 200 includes a data receiving and transmitting unit 201, a processing unit 202 and a database unit 2〇3. The data receiving and transmitting unit 2〇1 can receive the change authority information from the input terminal 100, and then transfer the data to the processing unit 202, and the processing unit 202 according to the changed authority information, in addition to the rights of the shell library 203 The data is sent through the data receiving receipt tl 201 to notify the client 3 of the occurrence of the permission change event. After receiving the client 3〇〇 permission data download request, the server terminal 200 transmits the change permission data to the client 300 ’ to update the application software permission data stored on the client 3〇〇. In addition, the server 200 also includes other components such as a memory, an operating system, a hard disk, and a display device. However, those skilled in the art should understand that it is not necessary to clarify the focus of the disclosure. The input terminal and the client are also specifically described. In a specific embodiment of the present invention, the above-mentioned receiving and transmitting unit 2〇1 uses the Tcp communication protocol to notify the client 2 300 to download the permission data, and The system code is used to represent the application permissions and the URL permissions. The event that informs the client that the data is updated is the UDP protocol. In another embodiment of the present invention, the authority data transmitted from the data receiving and transmitting unit 201 includes index data corresponding to an application or webpage of the client controller to enable the client to determine the required update. Permission information. 9 1328179 ‘Forming Pages The above database 203 for storing permission data contains a set of data sheets and control indicators for recording and updating information about the application permissions stored on the client. In a specific embodiment of the present invention, the above data table includes at least two data tables: security-acti〇n and securityjolicy execution authority data operation restriction function, wherein security behavior (security) An action is a record or a mode that includes, but is not limited to, a controlled application, a program, an instruction, a web address, or a web page. The security-policy record includes, but is not limited to, a specific application, instruction, or URL. Or the permission information of the webpage. The Guardian Behavior sub-database contains at least the following blocks: the identification table (id) is an indicator ' ' used to associate with other jobs ^, the category table (categ〇ry) is used to record applications, instructions, URLs or The type of the URL and the name of the target (target-name) are used to record the controlled file application executable file name or the controlled pipe URL, and the type of the target is used to record the type of the official document. The Security_p〇licy table is a permission limit for recording a managed application or web address. The quantitative parameter in the security policy table is recorded as an indicator data, and the indicator is associated with the indicator data in the software behavior) (d), so that the two data tables have an association relationship; Behavior (Disabled is a button that records the permissions of the application or web site to be restricted. This field can be written to a special value, indicating that the behavior is controlled and cannot be used. A client module is 3 At least the following functions are included: the server terminates the message, downloads the permission data from the server, and sets the permission data. In the specific embodiment, the client includes a permission control unit, such as an additional permission control program. In order to implement the above-mentioned functions of the client. In another - 1328179. In the embodiment, the client includes a database for storing client permissions. ^Complete data library includes - group data table and control Indicators, in which the application data of the data terminal controlled by the data, and the control of the subject of the Beco package control (four) mark and the ship's H end are subject to the same control of the (four) target _, so the guest The terminal can find out the corresponding controlled application permission data and add new after downloading the server new permission. - In another embodiment of the present invention, the control module can be the above-mentioned poor example The plurality of control modules are combined to complete the multi-level control module. The multi-level control module can limit the permission data of each feeding device according to different authorization levels to achieve the purpose of hierarchical management. The specific implementation of the 'contains the central feeding device and the plurality of peripheral feeding devices and the = terminal computer. The database of the medium oil service device stores the permissions of each peripheral feeding device; the peripheral server of the beryllium material stores the permission information of the surrounding server The privilege data of the application on the client in the fixed area is stored. Under the above multi-layer structure, the status and update of the privilege data on each peripheral server are uniformly managed by a central server, and the peripheral feeding device is different. Requirements, different authorization levels, open different permissions data change permissions, to manage the client = application, as a control structure can achieve the classification, partition authorization The information management system is used to manage the operation of the application on the client computer. In addition to quickly updating the number of clients #, it is possible to avoid manually updating the server permission data by region. The second figure is a specific embodiment for displaying the permission update process; the user can input the change permission through the input terminal in step S101 and change the server 11 to correct the permission information of the purchase terminal this month, and then 1^^·^ Ends the change permission information event. Step S2〇=Through the server to the above-mentioned change authority%% recognition table does not send the server end 200 to notify the client 兮...~ In step S202, the message is received.仞服哭# The flat ten is in the client at step S301, step S3 (after the J is issued), that is, in the subsequent step; the cow: the suffocation request to download the new permission setting from the self-feeding device. In the following step = step S203, the database is transmitted to the client according to the rights information of the above-mentioned update by the step and the step is followed by the if new = permission data. After the client has sent the new permission data in the (4) coffee service, the user's permission setting is set in step s3. The specific implementation of the invention is based on (4) updating the case for a plurality of peripheral feeding devices. In this embodiment, the update flow: the flow shown in the figure is similar, but the peripheral servers can be - central words月艮益官理,于太g Λ-t. t » , in the body-body embodiment, the server-side change authority refers to 2 downloaded by the central server, but according to the sweat of each server or user The permission from ' can also be entered from the input of each server. The text 2 is set by the central server, and a plurality of the same as the second picture Ί «•轾 are combined with each other to achieve layered and partitioned application software management. The invention is described above by way of a preferred embodiment, but it is not intended to limit the scope of patent rights claimed herein. The scope of patent protection is subject to the scope of the patent application and its equivalent. Anyone who is familiar with the field's changes or refinements without departing from the spirit or scope of this patent, 12, μΛ'ΜΤΤΓ-一 ::::
應包含在下述之申請專利範圍内。 隻U 【圖式簡單說明】 第一圖為顯示關於本發明之應用程式控管模組。 圖 第二圖為顯示關於本發明之控管應用程式的二法流程 【主要元件符號說明】 輸入端 1 00 伺服器端200 資料接收與傳遞單元2 0 1 處理單元202 資料庫單元203 客戶端 300 S1(H、S102、S2(H、S202、S203、S204、S301、S302、 S303、S304 步驟It should be included in the scope of the patent application below. U only [Simplified description of the drawing] The first figure shows the application control module relating to the present invention. The second figure shows the two-process flow of the control application of the present invention. [Main component symbol description] Input terminal 100 Server terminal 200 Data receiving and transmitting unit 2 0 1 Processing unit 202 Database unit 203 Client 300 S1 (H, S102, S2 (H, S202, S203, S204, S301, S302, S303, S304 steps)
1313