TWI796683B - Method of client-side application control - Google Patents

Abstract

A method of client-side application control includes the following steps: using a specified unit to specify a whitelist listing and a blacklist listing, wherein each whitelist can be executed in the client, and each blacklist cannot be executed in the client; providing a graylist that is not specified by the specified unit, where the graylist cannot be executed in the client; in addition, the client can decide whether the graylist will become whitelist in the next execution.

Description

Application Control Method Executed on Client Side

The present invention relates to the technical field of application program control, in particular to an application program control method executed on a client end.

With the development of informatization, a large number of application programs (APP) have appeared. Multiple applications can be provided by the same vendor. Even different applications, especially multiple applications provided by the same vendor, may have similar functions. In order to adapt to technological development or business needs, it is often necessary to upgrade or replace the application program. For example, the release frequency of a new version of the application program may be greater than once per week. When an error occurs in the released new version of the application or the business fails, the user-side application needs to return to the specified version of the application in an emergency to meet the basic needs of the user.

Existing application programs usually limit the computer devices that can legally use it to prevent the application program from being copied to other computer devices that are not legally authorized. To achieve this goal, there is currently a protection mechanism for binding hardware information. In this mechanism, once the application is started, it will first read and verify the hardware information in the computer device where it is installed, such as the CPU code, hard disk serial number, etc., and only allow the computer to The device executes it normally. Although this mechanism can apply the The formula is bound to a legitimate computer device that can execute it normally, but because the hardware information lacks dynamic changes, it is easy to be cracked.

In addition, with the popularity of the Internet, connections to the Internet are usually established in enterprises to obtain various applications. However, various information or application programs retrieved from the Internet may also receive malicious programs. Once the malicious program enters the information processing device, it will destroy the software or steal the information therein, causing great harm to the information security in the enterprise.

On the other hand, for enterprises, while enjoying the convenience of the Internet, they should also eliminate the threat of these possible malicious programs as much as possible. Restrictions related to the implementation of applications have traditionally been implemented using blacklist controls. Because there are too many programs in the world, the blacklist control method is no longer suitable for use.

Recently, hackers often use the original programs on the machine as attack programs instead of using programs written by hackers themselves. This will cause a problem. For example, the built-in programs on Windows are programs that are often used by users, but they are also favorite programs for hackers; so, whether these built-in programs can be set as application control is also a big problem problem lies in.

Furthermore, application control has strong protection, but users in the enterprise often fail because of the following three situations: (1) Windows Update; (2) users themselves install known and safe new programs (such as: AutoCAD) ;(3) Programs that are updated every day (for example: Teams, Chrome often update the background New), resulting in the dilemma of not being able to execute the program. This will not only affect the work efficiency of enterprise employees, but also increase the workload of information technology (IT: Information Technology) personnel.

In view of the above shortcomings, in order to reduce the burden of IT personnel, the present invention provides a novel application program control method to solve the above shortcomings.

The purpose of the present invention is to provide an application program control method executed on a client terminal.

The application program control method executed on the client side of the present invention can greatly reduce the burden on IT-side personnel and improve the work efficiency of enterprise employees.

The application program control method executed on the client terminal of the present invention includes: using a specifying unit to specify a whitelist list and a blacklist list, wherein each whitelist can be executed on the client terminal, and each blacklist cannot be executed on the client terminal execution; provide a gray list that has not been specified by the specifying unit, wherein the gray list cannot be executed in the user terminal; and, based on the user terminal, decide whether to prohibit the execution of the gray list to become a white list in the next execution.

The greylist and each blacklist upload record to a folder or a storage path.

The application program control method executed on the client terminal of the present invention includes: using a specifying unit to specify a whitelist list and a blacklist list, wherein each whitelist can be executed in the first client terminal, and each blacklist cannot be executed in the first client terminal. Execute in the first client; provide a gray list that has not been specified by the specifying unit, wherein the gray list cannot be executed in the first client; and, based on the second client, decide whether to prohibit the execution of the gray list in the following Becomes a whitelist when executed once.

The application program control method executed on the client terminal of the present invention includes: using a specifying unit to specify a whitelist list and a blacklist list, wherein each whitelist can be executed on the client terminal, and each blacklist cannot be executed on the client terminal execute in the specified unit; provide a gray list that is not specified by the specified unit, wherein the gray list cannot be executed in the client; and, with the permission of the server, scan the application based on the client to allow the prohibited gray list The list becomes a whitelist.

The application program control method executed on the client terminal of the present invention includes: using a specifying unit to specify a whitelist list and a blacklist list, wherein each whitelist can be executed on the client terminal, and each blacklist cannot be executed on the client terminal implementation; provide a gray list that is not specified by the specified unit, wherein the gray list cannot be executed in the client; and, with the permission of the server, the client closes the current application control so that execution is prohibited The greylist and blacklist list can be implemented in the client.

The above method further includes installing a set of software on the client end, re-scanning all the application programs on the client end, and defining a new application program control mode after starting the application program control mode.

102: client

104: Specified unit

106:Word white list

108:Excel blacklist

110:AutoCAD Greylist

112: Client staff

114: AutoCAD white list

120:Second client supervisor

140: Client staff

150: Apps

202, 204, 206, 208, 210: steps

[The first figure] shows the first embodiment of the present invention, a schematic diagram of the application program control method executed on the client side.

[The second figure] shows the second embodiment of the present invention, a schematic diagram of the application program control method executed on the client side.

[The third figure] shows the third embodiment of the present invention, a schematic diagram of the application program control method executed on the client side.

[Fourth Figure] Shows the fourth embodiment of the present invention, a schematic diagram of an application program control method executed on a client terminal.

[FIG.5] shows the process of defining new application program control by the client staff of the present invention.

Herein, the present invention will be described in detail with respect to specific embodiments of the invention and its viewpoints. Such descriptions are for explaining the structure or step flow of the present invention, which are for the purpose of illustration rather than limiting the patent scope of the present invention. Therefore, except for the specific embodiments and preferred embodiments in the description, the present invention can also be widely implemented in other different embodiments. The implementation of the present invention is described below through specific specific examples, and those who are familiar with this technology can easily understand the present invention through the contents disclosed in this specification. Ming's efficacy and its advantages. Moreover, the present invention can also be used and implemented through other specific embodiments, and various details described in this specification can also be applied based on different needs, and various modifications or changes can be made without departing from the spirit of the present invention.

The present invention proposes an application control method executed on a client terminal. Among them, the white list is used as the control scheme to replace the traditional black list control method. In terms of actual operation, the white list, black list, and gray list controlled by the application program can be defined according to the following steps. First, the client (personal computer, tablet computer, or various computer devices) installs a series of Files, programs or software, such as Word, Excel, AutoCAD; then, through a specified unit, specify a certain type, a certain file, program or software as a whitelist or blacklist, such as specifying and defining Word as a whitelist and Excel as a blacklist List, but AutoCAD that is not specified or defined, because it is neither a white list nor a black list, it will automatically become a gray list. Among them, the Word whitelist can be executed in the local machine, and the Excel blacklist cannot be executed in the local machine, but the records can be uploaded to a certain folder or a certain storage path. Unless the user permits, AutoCAD gray list cannot be executed in the local machine, but the record can be uploaded to a folder or a storage path. In the present invention, when a newly downloaded or installed application program is not whitelisted and cannot be executed, it is not necessary to bother the IT side, but the user's staff or supervisor is used to determine whether the application program becomes whitelisted and executable.

The present invention provides three methods to change the gray list into a white list, as follows: (A) the user decides a new white list; (B) re-scans the white list; (C) closes/opens the application control. For example, when encountering a single gray list, there are two situations, (1.1) permanently turn this single gray list into a white list: the above method (A) or (B) can be used; (1.2) temporarily implement this single gray list list: available To use (C) method (disable/enable application control). In another example, if there are multiple gray lists (for example: installing Microsoft Office, hundreds of new programs are gray lists), there are also two cases, (2.1) permanently change the multiple gray lists to White list: You can use (C) method (close application control), (B) method, (C) method (open application control); (2.2) temporarily execute this multiple gray list: you can use (C ) method (Close Application Control). The following will describe in detail the application program control method executed on the client end of the present invention, which can achieve the results of the three methods provided above.

The first figure depicts the first embodiment of the present invention, a schematic diagram of an application control method executed on a client terminal. Usually only the user knows which programs or software must be installed or temporarily installed due to their own work. Information technology (IT) personnel may not necessarily understand the work needs of every employee in every enterprise and the programs or software that need to be installed. Also, there are usually a large number of employees in the enterprise, so the workload of deciding whether to change the gray list to the white list can take up a lot of time. Therefore, in this embodiment, the solution of employee arbitration at the user end is used to reduce the burden on the IT end. As shown in the first figure, firstly, a client terminal 102 (personal computer, tablet computer, or various computer devices) is provided, and a specifying unit 104 at the IT terminal is used to specify or define Word as a whitelist and Excel as a blacklist, respectively marked as Word whitelist 106 and Excel blacklist 108. The AutoCAD not specified or defined by the specifying unit 104 is automatically turned into a gray list and marked as the AutoCAD gray list 110 because it is neither a white list nor a black list. As an example, after the files are scanned by the console, Word existing in the client 102 is marked as the Word whitelist 106 , and Excel is marked as the Excel blacklist 108 . The Word whitelist 106 can be executed in the client 102 locally. The Excel blacklist 108 cannot be executed locally in the client 102, but the blocking record can be uploaded to a folder or a storage path on the IT side. In addition, the AutoCAD gray list 110 cannot be executed in the client 102 locally, but Blocking records can be uploaded to a folder or a storage path on the IT side. That is to say, the AutoCAD gray list 110 is for blocking execution this time. Then, for the AutoCAD gray list 110 , based on the solution that the user-side staff 112 decides on their own, the user-side staff 112 can decide whether the AutoCAD gray list 110 that blocks execution this time will become the AutoCAD white list 114 in the next execution. Therefore, in this embodiment, based on trusting the employees of the enterprise, the employees can decide whether the AutoCAD gray list becomes the AutoCAD white list, so as to reduce the burden on the IT side. This embodiment can permanently change a single gray list into a white list.

It can be seen from the above that if the IT end grants the employee permission, the employee can convert the gray list to the white list; of course, this new white list is only valid for this employee; in this way, there is no need to bother IT every time there is a new program End to set the white list.

Referring to the second figure, it shows a schematic diagram of an application program control method executed on the client terminal according to the second embodiment of the present invention. In this embodiment, the solution of supervisory arbitration is used to reduce the burden on the IT side. In situations where the employee cannot be trusted, or if the employee's own decision is not desired, a supervisory adjudication option may be used. As shown in the second figure, the difference from the first figure is that the party responsible for determining the whitelist is the client administrator 120 . That is, the second client supervisor 120 decides that the AutoCAD gray list 110 is prohibited (blocked) from executing this time. Then, for the AutoCAD gray list 110, based on the solution determined by the second client supervisor 120, the second client supervisor 120 can determine whether the AutoCAD gray list 110 that blocks execution this time will become the AutoCAD white list 114 during the next execution. . Therefore, in the present embodiment, do not let the first user end employee 112 have the right to decide that the AutoCAD gray list becomes the AutoCAD white list, but It is based on the second client supervisor 120 to decide whether the AutoCAD gray list becomes the AutoCAD white list, so as to reduce the burden on the IT side. This embodiment can permanently change a single gray list into a white list.

As an example, in the above two solutions, no matter based on the decision of the second client manager 120 or the decision of the first client employee 112, only a single graylist program can be converted into a whitelist at a time. However, since it does not need to be processed by the IT side, the burden on the IT side can be reduced.

The third figure shows the third embodiment of the present invention, a schematic diagram of an application program control method executed on the client terminal. In this embodiment, with the permission of the server (IT), the client staff 112 can activate the rescanning application by itself, so as to reduce the burden on the server (IT). The server side (IT side) opens the function of the scanning application to a specific client side. For example, the server end (IT end) can authorize some client employees 112 to enable the authorized client to have the function of scanning the application, so that the rescan application can be started by itself. That is, after the user-side employee 112 allowed by the IT side re-scans the application program, the AutoCAD greylist 110 that is currently blocked from executing will be changed into the AutoCAD whitelist 114 . Therefore, all the application programs (Word, Excel, AutoCAD) in the client terminal 102 are all whitelisted. Of course, this embodiment can also permanently change the single gray list into a white list.

Referring to FIG. 4 , it shows a schematic diagram of a method for controlling an application program executed on a client terminal according to a fourth embodiment of the present invention. In this embodiment, with the permission of the server side (IT side), the client staff 140 can close the application program control to reduce the burden on the server side (IT side). The server side (IT side) opens and closes the function of application program control to a specific client side. For example, server-side (IT side) can authorize certain user-side employees 140 to enable the authorized user-side to have the function of closing the application program control, so that it can first close the current application program control, and then define a new application program control Tube. As shown in the fourth figure, the authorized client staff 140 can close the current application control. After closing the application program control, the application program 150 including the Excel recorded in the blacklist and the AutoCAD recorded in the gray list can all be used and executed in the local machine. Turn off/on application control to temporarily enforce single greylisting. Turning off application controls can temporarily enforce multiple greylists.

As shown in FIG. 5 , it shows the flow of the above-mentioned client worker 140 defining a new application program control. First, in step 202, the client staff closes the application control. For example, after being authorized by the server side (IT side), the employee at the client side can activate a shutdown unit to control the running application program to execute the shutdown action in the execution program of the computer. The closing unit is an information link application program control unit. Then, in step 204, a software package is installed on the user terminal. For example, packaged software includes, but is not limited to, Microsoft Office (such as including Word, Excel, and PowerPoint), AutoCad, Line... and other software. Next, in step 206, re-scan all the application programs in the client computer. Afterwards, in step 208, the application control method is activated. In step 210, after the application control method is activated, a new application control is defined. This new application control can execute all the applications in the machine, that is, after being defined, all the applications in the machine are whitelisted for execution. This embodiment can permanently change multiple gray lists into white lists.

Compared with the conventional blacklist control method, the present invention proposes an application program control method executed on the client end. The above four solutions are all for known and safe new programs, allowing users to Workers or user-side supervisors can update the application control list by themselves, thereby reducing the burden on the IT side, and greatly improving the detection efficiency of information security.

Changes may be made to the above-described method of managing applications executed on the client side without departing from the scope of this document. It is therefore to be noted that all matter contained in the above description and shown in the accompanying drawings shall be interpreted in an illustrative rather than a restrictive sense. The following claims are intended to cover all general and specific features described herein, as well as all statements of the scope of the present invention's client-executed application control method, which language may be said to fall therebetween.

102: client

104: Specified unit

106:Word white list

108:Excel blacklist

110:AutoCAD Greylist

112: Client staff

114: AutoCAD white list

Claims (10)

A control method for application programs executed on a client end, comprising: using a designated unit on a server end to designate a first type of file, program or software already installed in the client end as a white list and installed on the client end The second type of file, program or software in the system is a blacklist, wherein each whitelist can be executed in the client, and each blacklist cannot be executed in the client; providing the specified unit without passing the server To specify the gray list, where the gray list is the third type of file, program or software installed in the client, the gray list cannot be executed in the client; and based on the client to decide to prohibit execution Whether the gray list will become white list in the next execution. The application program control method executed on the client side as described in claim 1, wherein each blacklist is uploaded to a certain folder or a certain storage path. The application program control method executed on the client end as described in claim 1, wherein the gray list is uploaded to a certain folder or a certain storage path. A control method for application programs executed on a client end, comprising: using a designated unit on a server end to designate a first type of file, program or software already installed in the client end as a white list and installed on the client end The second type of file, program or software in is a blacklist, wherein each whitelist is executable in the first client, and each blacklist is not executable in the first client; Provide a gray list that has not been specified by the specified unit on the server, where the gray list is a third-type file, program or software that has been installed in the client, and the gray list cannot be used in the first client Execution; and whether the gray list that is forbidden to execute based on the second user terminal's own decision will become the white list in the next execution. The application program control method executed on the client side as described in claim item 4, wherein the greylist is uploaded to a certain folder or a certain storage path. The application program control method executed on the client side as described in claim 4, wherein each blacklist is uploaded to a certain folder or a certain storage path. A control method for application programs executed on a client end, comprising: using a designated unit on a server end to designate a first type of file, program or software already installed in the client end as a white list and installed on the client end The second type of file, program or software in the system is a blacklist, wherein each whitelist can be executed in the client, and each blacklist cannot be executed in the client; providing the specified unit without passing the server With the specified gray list, where the gray list is a third-class file, program or software installed in the client, the gray list cannot be executed in the client; and with the permission of the server, based on The client scans applications to turn the gray list into a white list of forbidden executions. The application program control method executed on the client side as described in claim item 7, wherein the gray list and each black list upload record to a certain folder or a certain storage path. A control method for application programs executed on a client end, comprising: using a designated unit on a server end to designate a first type of file, program or software already installed in the client end as a white list and installed on the client end The second type of file, program or software in the system is a blacklist, wherein each whitelist can be executed in the client, and each blacklist cannot be executed in the client; providing the specified unit without passing the server To specify the gray list, where the gray list is the third type of file, program or software installed in the client, the gray list cannot be executed in the client; and with the permission of the server, the The client end closes the current application program control, so that the greylist and the blacklist that are forbidden to be executed can be executed in the client end. The application program control method executed on the client terminal as described in request item 9 further includes installing a software package on the client terminal, re-scanning all application programs on the client terminal, and defining the application program control method after starting New app controls.

Images