TWI801856B - Method of application control for child-program execution - Google Patents

Abstract

A system of application control for child-program execution includes specifying an application control unit as a whitelist program; executing the application control unit to generate child-programs. Based on the inheritance relationship between the child-programs and the application control unit, the solved child-programs are whitelist programs. And, the parent program of the child-programs is checked. If the parent program is the application control unit, then the child-programs are executed.

Description

Application Control Method Based on Subroutine Execution

The present invention relates to the technical field of application program control, in particular to an application program control method based on subroutine execution.

With the development of informatization, a large number of application programs (APP) have emerged. Multiple applications can be provided by the same vendor. Even different applications, especially multiple applications provided by the same vendor, may have similar functions. In order to adapt to technological development or business needs, it is often necessary to upgrade or replace the application program. For example, the release frequency of a new version of the application program may be greater than once per week. When an error occurs in the released new version of the application or the business fails, the user-side application needs to return to the specified version of the application in an emergency to meet the basic needs of the user.

Existing application programs usually limit the computer devices that can legally use it to prevent the application program from being copied to other computer devices that are not legally authorized. To achieve this goal, there is currently a protection mechanism for binding hardware information. In this mechanism, once the application is started, it will first read and verify the hardware information in the computer device where it is installed, such as the CPU code, hard disk serial number, etc., and only allow the computer to The device executes it normally. Although this mechanism can bind the application program to a legitimate computer device that can execute it normally, it is vulnerable to damage due to the lack of dynamic changes in hardware information. untie.

In addition, with the popularity of the Internet, connections to the Internet are usually established in enterprises to obtain various applications. However, various information or application programs retrieved from the Internet may also receive malicious programs. Once the malicious program enters the information processing device, it will destroy the software or steal the information therein, causing great harm to the information security in the enterprise.

On the other hand, for enterprises, while enjoying the convenience of the Internet, they should also eliminate the threats of these possible malicious programs as much as possible. Restrictions related to the implementation of applications have traditionally been implemented using blacklist controls. Because there are too many programs in the world, the blacklist control method is no longer suitable for use.

Recently, hackers often use the original programs on the machine as attack programs instead of using programs written by hackers themselves. This will cause a problem. For example, the built-in programs on Windows are programs that are often used by users, but they are also favorite programs for hackers; so, whether these built-in programs can be set as application control is also a big problem problem lies in.

Furthermore, the application program control has a strong protection force, which drives the present invention to provide a novel application program control method.

The purpose of the present invention is to provide an application program control method based on subroutine execution.

The application program control method based on subroutine execution of the present invention can greatly reduce the time cost of detection and improve the detection efficiency of information security.

The application program control method based on subprogram execution of the present invention includes: specifying an application program control unit as a whitelist program; executing the application program control unit to generate a subroutine program, based on the subroutine program and The inheritance relationship of the application control unit, the sub-routine program solved by it is a whitelist program; and, the parent process of the sub-routine program is checked, and if the parent process is an application control unit, the sub-routine program is executed.

Designating an application program control unit as a white list program is executed through a designated unit.

The parent process of checking the child process program is executed through a checking unit. To check the parent process of the sub-program is to check whether the control unit of the application program has checked the sub-program inheritance item.

Among them, the checking unit has the function of checking whether the child stroke inherits the parent stroke, and the function of checking what the parent stroke is.

The application program control method based on subprogram execution of the present invention includes: specifying an installation program as a whitelist program; executing the installation program to generate a subroutine program, based on the inheritance relationship between the subroutine program and the installation program, The sub-routine program that it solves is a white list program; and, check the parent process of the sub-routine program, if the parent process is an installation program, then execute the sub-routine program.

Wherein, specifying an installation program as a white list program is executed through a specified unit. Wherein, checking the parent process of the sub-program is to check whether the installer has checked the sub-program inheritance item.

110:ProcExp.Exe

120:ProcExp64.Exe

130,220: Check what is the parent process of the child process

200: Install program

210: Subroutine

[The first figure] is a schematic diagram showing that the application control unit of the present invention executes its sub-routine and checks the parent process of the sub-routine program.

[The second figure] shows the schematic diagram of the installation program of the present invention executing its sub-routine and checking the parent process of the sub-routine program.

Herein, the present invention will be described in detail with respect to specific embodiments of the invention and its viewpoints. Such descriptions are for explaining the structure or step flow of the present invention, and are for illustration rather than limiting the patent scope of the present invention. Therefore, except for the specific embodiments and preferred embodiments in the description, the present invention can also be widely implemented in other different embodiments. The implementation of the present invention is described below through specific specific examples, and those who are familiar with this technology can easily understand the principles of the present invention through the contents disclosed in this specification. Efficacy and its advantages. Moreover, the present invention can also be used and implemented through other specific embodiments, and various details described in this specification can also be applied based on different needs, and various modifications or changes can be made without departing from the spirit of the present invention.

The present invention proposes an application program control method based on the execution of sub-programs, in which the parent process (Parent Process) is designated as the application program control unit (program). In computing, a parent journey is one that has created one or more child journeys. When the parent process program is executed, some small programs will be generated to perform some functions, and its child processes inherit most of the attributes of the parent process, such as file descriptors.

In the present invention, when executing a sub-journey, the system will automatically check who is the parent of the sub-journey. If the checked parent process has a definition or checks the child process (program) inheritance, based on the parent process (program) as the application control unit, the child process (program) has an inheritance relationship, so it will automatically become the application control unit. pipe unit. That is, if the child process is executed by the trusted parent process, the child process also becomes the trusted execution program. Subroutines in the whitelist can inherit the whitelist. If the parent itinerary is whitelisted, the inherited child itinerary is also whitelisted.

The present invention uses a white list as a control solution to replace the traditional black list control method. The powerful white list function is enough to block most hacker attacks. In terms of actual operation, we can use the user's behavior to judge whether the programs to be executed are normal programs or hacker programs. If the program is in normal use, it is the white list controlled by the application, otherwise it is the black list.

The first figure depicts a schematic diagram of the sub-routine executed by the application control unit of the present invention. The application control unit is implemented in a server, computer or computer device. Firstly, an application program control unit is designated through a designated unit of the server, which is a specific white list program. Then, execute the application control unit to generate a sub-routine program. Based on the inheritance relationship between the sub-routine program and the application program control unit, the sub-routine program is a whitelist program. Afterwards, a check unit is used to check the parent process of the child process program, and if the parent process is an application program control unit, the child process program is executed. For example, the application control unit in this embodiment is ProcExp.Exe 110 , which is the parent process of ProcExp64.Exe 120 . That is, ProcExp.Exe 110 will execute ProcExp64.Exe 120 under Win64, and ProcExp64.Exe 120 becomes a child process of ProcExp.Exe 110 . When the sub-routine ProcExp64.Exe 120 is executed, the system will execute step 130 to automatically check the parent process of the sub-routine ProcExp64.Exe 120 . Since the parent process ProcExp.Exe 110 is defined or the child process (program) inheritance is checked, the child process ProcExp64.Exe 120 solved by the parent process ProcExp.Exe 110 can inherit most of the properties of the parent process ProcExp.Exe 110 . Since the parent process ProcExp.Exe 110 is an application control unit, the child process ProcExp64.Exe 120 also automatically becomes an application control unit. That is, after the trusted parent process ProcExp.Exe 110 executes the child process ProcExp64.Exe 120 program, the child process ProcExp64.Exe 120 also becomes a trusted execution program. In other words, the child process ProcExp64.Exe 120 of the white list of the parent process ProcExp.Exe 110 can inherit the white list. The parent process ProcExp.Exe 110 is on the white list, and the inherited child process ProcExp64.Exe 120 is also on the white list because of the relationship of inheritance. Under Win64, the system will execute the sub-process ProcExp64.Exe 120 to replace the original ProcExp.Exe.

ProcExp.Exe is a powerful process manager that can be used to manage programs conveniently program, and can execute or force close any program. In addition, ProcExp.Exe can also display computer information in detail: central processing unit (CPU), memory usage, dynamic link library (Dynamic-link library: DLL), control code, view process parent-child relationship, End the specified process, .. etc.

Referring to the first figure, in another example, if the system executes the ProcExp64.Exe 120 program independently, but lacks a program for confirming who the parent process of ProcExp64.Exe 120 is, the system will not be able to determine whether ProcExp64.Exe 120 is a certain parent A child itinerary of a itinerary, and also lacks a check to see if the parent is whitelisted. Therefore, the system cannot determine whether ProcExp64.Exe 120 is in the whitelist, and regards it as not in the whitelist.

As an example, the child process ProcExp64.Exe 120 checks its parent process through a check unit. That is, the parent process ProcExp.Exe 110 is determined to be the parent process of the child process ProcExp64.Exe 120 after being inspected by the checking unit. For example, the checking unit has the function or option of checking that the child process inherits the parent process, and the function of checking what the parent process is. When an application program or package software is checked by the inspection unit to check sub-routine inheritance, after executing its sub-routine, the sub-routine it solves will have the whitelist function. Certainly, when executing the sub-routine, the checking unit will also perform the function of checking 130 what is the parent of the sub-routine.

As can be seen from the above, if the parent process program has been confirmed as an application program control program, then the child process program executed by the parent process program is also an application program control program; in addition, if the child process program executed by the child process program is also The application program control program can be deduced down to N generations. Conversely, if the sub-routine program is only executed independently, it is not controlled by the application program.

In addition, the present invention can designate a specific whitelist program through a designation unit, and the subroutines executed by the whitelist program are directly recognized as application program control programs.

The second figure depicts a schematic diagram of the application control unit executing its sub-routines in another embodiment of the present invention. In this embodiment, the application control unit is an installation program 200 of a computer or a computer device. In the second figure, the application control unit is the installation program 200, which is designated as a whitelist program through a designation unit. When the installer 200 is installed, it also executes the installer subroutine 210 ; and the installer 200 becomes the parent program of its subroutine 210 . Similarly, when the subroutine 210 is executed, the system will execute step 220 to automatically check what the parent program of the subroutine 210 is. Since the parent process installation program 200 has a definition or checks the child process (program) inheritance, the child program 210 solved by the parent process installation program 200 can inherit most of the properties of the parent process installation program 200 . Since the parent process installer 200 is an application control unit, the subprogram 210 also automatically becomes an application control unit. That is, after the trusted parent process installation program 200 executes the sub-program 210, the sub-program 210 also becomes a trusted execution program. In other words, the child programs 210 of the white list of the parent process installation program 200 can inherit the white list. The parent process installation program 200 is on the white list, and the inherited child program 210 is also on the white list because of the inheritance relationship.

The present invention can designate a specific program to have inherited attributes, so that its subprograms become a white list. Compared with the conventional blacklist control method, the present invention proposes an application program control method based on subroutine execution, using a designated application program control unit to determine the executable white list, which greatly improves the detection efficiency of information security be enhanced.

Variations may be made to the above method of subroutine execution-dependent application control without departing from the scope of this document. It is therefore to be noted that all matter contained in the above description and shown in the accompanying drawings shall be interpreted in an illustrative rather than a restrictive sense. The following claims are intended to cover all general and specific features described herein, as well as all statements of the scope of the present invention's method of controlling applications executed by subroutines, which language may be said to fall therebetween .

110:ProcExp.Exe

120:ProcExp64.Exe

130: Check what is the parent process of the child process

Claims (10)

An application control method based on subprogram execution, including: using a server to designate an application control unit as a whitelist program; executing the application control unit to generate a subprogram, based on the The inheritance relationship between the sub-program and the application control unit, the sub-program is a whitelist program; and the server is used to check the parent program of the sub-program, if the parent program is For the application control unit, the sub-routine program executed by the parent program is also the application control unit, and if the sub-routine program is only executed independently, it is not the application control unit. The application control method based on subprogram execution as described in claim 1, wherein the designation of an application control unit as a whitelist program is executed through a designation unit. The application program control method based on subprogram execution as described in Claim 1, wherein the checking of the parent routine of the subprogram is executed through a checking unit. The application program control method based on sub-program execution as described in claim 3, wherein the checking unit has the function of checking whether the sub-program inherits from the parent program, and the function of checking what the parent program is. The application program control method based on subprogram execution as described in claim 1, wherein the checking of the parent program of the subprogram is to check whether the application control unit has checked the subprogram inheritance item. An application control method based on subprogram execution, comprising: using a server to designate an application control unit as a whitelist program, and the application control unit is an installation program; executing the installation program to Generate a sub-routine program, based on the inheritance relationship between the sub-routine program and the installation program, the sub-routine program that it solves is a whitelist program; and use the server to check the parent program of the sub-routine program, if the If the parent program is the control unit of the application, the child program executed by the parent program is also the control unit of the application. If the child program is only executed independently, it is not the control unit of the application. The application control method based on subprogram execution as described in claim 6, wherein the designation of an application control unit as a whitelist program is executed through a designation unit. The method for controlling an application program based on subprogram execution as described in Claim 6, wherein the checking of the parent routine of the subprogram is executed through a checking unit. The application program control method based on subprogram execution as described in Claim 8, wherein the checking unit has the function of checking whether the subprogram inherits from the parent procedure, and the function of checking what the parent procedure is. The application program control method based on subprogram execution as described in request item 6, wherein the checking of the parent program of the subprogram is to check whether the installation program has checked the subprogram inheritance item head.

Images