WO2019037522A1 - 漏洞修复方法、漏洞修复装置及服务器 - Google Patents

漏洞修复方法、漏洞修复装置及服务器 Download PDF

Info

Publication number
WO2019037522A1
WO2019037522A1 PCT/CN2018/090865 CN2018090865W WO2019037522A1 WO 2019037522 A1 WO2019037522 A1 WO 2019037522A1 CN 2018090865 W CN2018090865 W CN 2018090865W WO 2019037522 A1 WO2019037522 A1 WO 2019037522A1
Authority
WO
WIPO (PCT)
Prior art keywords
vulnerability
patch
patch package
server
repair
Prior art date
Application number
PCT/CN2018/090865
Other languages
English (en)
French (fr)
Inventor
张建新
刘天
高永岗
程博
张成亮
徐江涛
范家鹏
田野
Original Assignee
北京奇虎科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2019037522A1 publication Critical patent/WO2019037522A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Definitions

  • the present invention relates to the field of computer technology, and in particular, to a vulnerability repair method, a vulnerability repair device, and a server.
  • the specific repair method is as follows: First, the tester and the server perform a large-scale and comprehensive detection on the system, and determine as many loopholes as possible in the system. Secondly, the tester compiles the corresponding repair according to the determined vulnerability. The solution will eventually complete the repair work on the system. It can be seen that each time a device manufacturer performs a system repair, it will consume a lot of resources.
  • the present invention is directed to the shortcomings of the prior art, and provides a vulnerability repairing method, a vulnerability repairing apparatus, and a server for performing comprehensive vulnerability repairing on the system.
  • an embodiment of the present invention provides a method for repairing a vulnerability, which includes: obtaining a patch package from a server, and mounting the patch package in a system kernel, and the patch package is based on a vulnerability to be repaired in the terminal device. Fix related information for compilation; fix the bug according to the patch package.
  • an embodiment of the present invention provides a vulnerability repair apparatus, including: at least one processor; and at least one memory communicably connected to the at least one processor; the at least one memory includes a processor An executable instruction that, when executed by the at least one processor, causes the apparatus to perform at least the following operations: obtaining a patch package from a server and mounting the patch package in a system kernel And the patch package is compiled according to the repair related information of the vulnerability to be repaired in the terminal device; the vulnerability repair is performed according to the patch package.
  • an embodiment of the present invention provides a server, including a memory and a processor, where the memory is used to store information including program instructions, and the processor is configured to control execution of the program instructions.
  • the program is executed by the processor, the first aspect is implemented. The steps of the method described.
  • an embodiment of the present invention provides a computer program comprising computer readable code, when the server runs the computer readable code, causing the method of the first aspect to be performed.
  • an embodiment of the present invention provides a computer readable medium, wherein the computer program according to the fourth aspect is stored.
  • Applying the vulnerability repairing method provided by the embodiment of the present invention obtaining a patch package corresponding to the vulnerability to be repaired in the terminal device from the server, and mounting the patch package in the system kernel, by loading the patch package in the kernel, not only in the system kernel
  • the existing vulnerabilities are fixed, and the vulnerabilities existing in the program running in the user space can be repaired, which solves the problem that the security software in the prior art cannot fix the vulnerabilities of each module in the system kernel due to the limitation of the repair permission. That is, the present invention implements a comprehensive repair of system vulnerabilities.
  • FIG. 1 is a schematic flowchart of a method for repairing a vulnerability according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of mounting a patch package in a system kernel according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of updating a service package according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart of a server compiling a patch package according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a vulnerability repairing apparatus according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a server according to an embodiment of the present disclosure.
  • FIG. 7 is a block diagram of a server for performing a method according to the present invention, according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of a storage unit for holding or carrying a program code implementing a method according to the present invention according to an embodiment of the present invention.
  • An embodiment of the present invention provides a method for detecting a vulnerability.
  • the schematic flowchart of the method is as shown in FIG. 1 , and specifically includes the following steps:
  • S101 Obtain a patch package from the server, and mount the patch package in the system kernel, and the patch package is compiled according to the repair related information of the vulnerability to be repaired in the terminal device;
  • Applying the vulnerability repairing method provided by the embodiment of the present invention obtaining a patch package corresponding to the vulnerability to be repaired in the terminal device from the server, and mounting the patch package in the system kernel, by loading the patch package in the kernel, not only in the system kernel
  • the existing vulnerabilities are fixed, and the vulnerabilities existing in the program running in the user space can be repaired, which solves the problem that the security software in the prior art cannot fix the vulnerabilities of each module in the system kernel due to the limitation of the repair permission. That is, the present invention implements a comprehensive repair of system vulnerabilities.
  • the application scenario of the embodiment of the present invention may be: a security software vendor performs vulnerability analysis on various terminal devices developed by a cooperative terminal device manufacturer, compiles patches corresponding to each vulnerability, and packages the patches into a patch package; each terminal device The corresponding patch packages are respectively mounted in the system kernel, and the vulnerability repair function is implemented in the kernel.
  • a security software vendor performs vulnerability analysis on various terminal devices developed by a cooperative terminal device manufacturer, compiles patches corresponding to each vulnerability, and packages the patches into a patch package; each terminal device The corresponding patch packages are respectively mounted in the system kernel, and the vulnerability repair function is implemented in the kernel.
  • terminal equipment vendors hand over the task of detecting vulnerabilities and fixing vulnerabilities to security software vendors, reducing the burden on terminal equipment vendors; mounting the patch packages in the kernel of the corresponding terminal device to implement the system kernel. The repair of the vulnerability.
  • S101 Obtain a patch package from the server, and mount the patch package in the system kernel, and the patch package is compiled according to the repair related information of the vulnerability to be repaired in the terminal device.
  • the terminal device manufacturer directly mounts the patch package provided by the security software vendor in the system kernel before the terminal device is launched, that is, before the user uses the terminal device, the terminal device is hung. Contained the patch package.
  • the terminal device obtains the patch package from the server, and mounts the patch package in the kernel of the system.
  • the specific implementation manner corresponding to the step may be: the terminal device sends a request for querying the corresponding patch package of the terminal device to the server, and specifically, the sending period is set, for example, setting a query request every 3 days.
  • the server determines that the patch package corresponding to the device already exists
  • the corresponding feedback information is sent to the terminal device.
  • the terminal device downloads the corresponding patch package from the server and mounts the kernel in the system. in.
  • the server package is automatically sent to the corresponding terminal device, and after receiving the patch package, the terminal device mounts the patch package in the system. In the kernel.
  • the terminal device includes a user space (User Space) and a kernel space (Kernel), and the user space may include a software development kit (SDK) and a local daemon (Native). Daemon).
  • SDK software development kit
  • Native Daemon is an executable program, for example, the init process is started at system startup, responsible for communicating with the kernel, verifying the patch package, etc.
  • the SDK is responsible for communicating with the server.
  • the server corresponding to the security software sends the compiled patch package to the server (device server) corresponding to the terminal device manufacturer.
  • the terminal device sends a request for querying the corresponding patch package of the terminal device to the server through the SDK, specifically whether the terminal exists in the query server.
  • the device server After the device server receives the request, the device server returns feedback information to the SDK. If the feedback information is to determine that a service package corresponding to the terminal device exists in the server, the SDK downloads the corresponding device from the device server according to the feedback information.
  • the patch package is sent to the Native Daemon; after receiving the patch package, the Native Daemon performs signature verification on the patch package to verify whether the sender of the patch package is a pre-agreed server (target server)
  • target server a pre-agreed server
  • the patch package is sent to the kernel, that is, the patch package is completed in the kernel.
  • S102 Perform vulnerability repair according to the patch package.
  • the system vulnerability is repaired according to the patch package in the kernel.
  • the specific repair method includes: repairing the target function through a hook function (HOOK) to complete the repair of the system kernel vulnerability.
  • the HOOK program is responsible for monitoring the pre-configured calling function in the kernel.
  • the HOOK detects the problem function (object function), hooking the problem function and promptly the target function Fix it and finally complete the bug fix of the entire system kernel.
  • the HOOK process is optimized to an atomic operation so that the system is not affected by the bug fix.
  • the method for repairing the system vulnerability includes: when detecting the abnormal file with the vulnerability, replacing the entire file corresponding to the abnormal file with the updated full file to complete the repair of the system vulnerability. Specifically, when the server detects the system, the file corresponding to the system vulnerability (abnormal file) is determined, and the abnormal file is repaired to obtain the updated full file; the updated full file is written into the patch package, and the terminal is When the device uses the patch package to repair system vulnerabilities, directly replace the entire file corresponding to the abnormal file with the updated full file. System vulnerabilities are fixed by means of full file replacement to ensure system stability.
  • the above method of replacing all files can be understood as a full file replacement within a certain memory range. If the full file corresponding to the abnormal file occupies a large memory, thus, if the complete file is replaced, a large amount of resources are inevitably consumed. Therefore, in the embodiment of the present invention, a file of a certain memory range can be intercepted as a “full file”.
  • the embodiment of the invention further includes: after the system is repaired by the kernel, the repair result is sent to the server, so that the server debugs each patch included in the patch package according to the repair result.
  • the terminal device sends the repair result to the terminal device server, and the terminal device server can filter the repair result, for example, filtering out information of some terminal devices, for example, using or purchasing the terminal.
  • the number of devices, and then the filtered repair results are sent to the security software server to ensure the security of the terminal device vendors.
  • the embodiment of the present invention provides an implementation manner for the foregoing problem.
  • the implementation manner is specifically: sending a request to the server to query the update status of the mounted patch package in the system kernel; and receiving the mounted repair package returned by the server in the server The feedback information in the update state; downloading the updated patch package from the server according to the feedback information; performing signature verification on the updated patch package, and if the verification is passed, the updated patch package is mounted in the system kernel .
  • an implementation manner of the update patch package is similar to the process of mounting the patch package in FIG. 2, and specifically includes the following steps:
  • the terminal device sends, by using an SDK, a request for querying an update status of a mounted patch package in Kemel to the server;
  • S305 Install the updated patch package by the Native Daemon, and perform signature verification on the updated patch package (S306), and specifically check whether the sender of the patch package is a target server;
  • Kemel applies the updated service package, and uses the updated service package to perform vulnerability repair (S308);
  • the server analyzes the information of the vulnerability, determines the corresponding repair method, and compiles the corresponding patch according to the repair method, and updates the mounted patch package in the system kernel.
  • the newly compiled patch is added to the patch package and the updated patch package is remounted in the system kernel.
  • the terminal device manufacturer does not need to update the patch package, and the security software vendor directly checks the system periodically, compiles the corresponding patch according to the newly discovered vulnerability, and finally mounts the patch in the system kernel. in.
  • the security software vendor can set a short repair cycle, detect and maintain the system, and send the updated patch package to the terminal device in time, so that the device can repair the vulnerability in the system in time, and the embodiment of the present invention will
  • the patch package is mounted in the system kernel and can be used to fix the bugs in each module in the system kernel.
  • the update of the patch package may be to add a new patch to the mounted patch package, or to upgrade the original patch in the mounted patch package, or to add a new function, or Some features are fixed, and so on.
  • the manner in which the patch package is revised may completely replace the mounted patch package in the system; in a preferred implementation manner, in order to save resources, only the patch that has been updated in the mounted patch package may be used. Replace, and/or add new patches.
  • the process of repairing a system vulnerability may result in an abnormal event due to the application of a certain patch, for example, a system restart.
  • the embodiment of the present invention provides an implementation manner, specifically: when an abnormal event occurs when the patch package is detected for vulnerability repair, whether the abnormal event is caused by any patch included in the patch package; if so, The patch that causes the abnormal event is uninstalled, and the abnormal event is reported to the server, so that the server repairs the patch that causes the abnormal event according to the abnormal event.
  • the abnormal event occurring in the system can be verified to verify whether the abnormal event is included in the patch package. Any patch causes, if so, Native Daemon sends a notification to Kemel informing Kemel to uninstall the patch that caused the exception, and escalating the exception to the server via the Native Daemon and SDK.
  • FIG. 3 is only an implementation manner of updating a Kemel patch package according to an embodiment of the present invention.
  • the Native Daemon obtains the updated patch package. After the updated patch package is split, the patch for each vulnerability included in the updated patch package is obtained, and the patch package is verified by signature. If the verification is passed, the patch for each vulnerability is mounted. In the system kernel.
  • the security software server and the terminal device server signature information are written in the patch package for security reasons.
  • the updated patch package is verified by the Native Daemon (S306).
  • the signature information of the security software server and the terminal device server included in the patch package is simultaneously performed by the Native Daemon. Perform verification. If both of them pass, prove that the patch package is legal, and mount the patch package in the kernel. If any signature verification fails, the mount is abandoned.
  • the Native Daemon first verifies whether the signature information contained in the patch package is the signature information of the target security server. If so, the patch package is mounted in Kemel; when the system bug is fixed by Kemel, the patch package can be verified first. Whether the signature information included in the signature information of the target terminal device server is used, and if so, the patch package is applied, and if not, the patch package can be directly uninstalled.
  • the foregoing describes the implementation of the method for compiling a patch package in a system kernel, and the method for compiling a patch package by using a patch package.
  • the method of the method is as shown in FIG. 4, and specifically includes The following steps:
  • the security software server collects vulnerability information of the target terminal device, and stores the vulnerability information into the database; the vulnerability information may be vulnerability information determined by the security device itself, or vulnerability information provided by a third party, and the vulnerability information Including: the name, type, scope of influence of the vulnerability.
  • S402 Parsing various vulnerabilities in the library (for example, parsing code or scripts) to determine a repair plan for each vulnerability.
  • S403 automatically compile the patch corresponding to each vulnerability according to the determined repairing scheme.
  • the compiling operation may be performed on the compiling platform (hot patching platform), and the vulnerabilities are automatically compiled according to the scope of the vulnerability and the vulnerability repairing scheme. Corresponding patch.
  • S404 Perform automatic detection and manual detection on the compiled patch to determine the performance of each patch.
  • S405 Collect and compile the patches into a patch package, and add the signature information of the security software server to the patch package.
  • S406 The security software server sends the patch package to the terminal device server.
  • the terminal device server reviews the service package, and the content of the specific review may include: performance of the service package, and whether the service package includes information that damages the terminal device, and the like.
  • the signature information of the terminal device server is added to the patch package.
  • the patch package may be encrypted by asymmetric encryption.
  • FIG. 4 is only one embodiment of the present invention. In the actual application, there are many implementations, which are not specifically limited in this embodiment of the present invention.
  • the security software server can compile the corresponding patch package according to the vulnerability information existing in each terminal device corresponding system, and can be compiled according to the information of the terminal device to ensure that the compiled patch package can be successfully applied to the corresponding Terminal Equipment.
  • the "fix pack" mounted in the kernel, and the codes corresponding to "SDK” and “Native Daemon” described in the embodiments of the present invention are used for the terminal device.
  • the manufacturer can be open source, that is, the terminal device server can monitor the installation of the patch package and the process of bug repair at any time.
  • an embodiment of the present invention further provides a vulnerability repairing apparatus.
  • the schematic structural diagram of the apparatus is as shown in FIG. 5, and specifically includes the following units:
  • the receiving unit 501 is configured to obtain a patch package from the server, and mount the patch package in the system kernel, and the patch package is compiled according to the repair related information of the vulnerability to be repaired in the terminal device;
  • the repairing unit 502 is configured to perform vulnerability repair according to the patch package.
  • the specific working process of the embodiment of the device is: the receiving unit 501 obtains a patch package from the server, and mounts the patch package in the system kernel, wherein the patch package is based on the repair related information of the vulnerability to be repaired in the terminal device. Compiled, and secondly, the repair unit 502 performs vulnerability repair according to the patch package.
  • Applying the vulnerability repairing device provided by the embodiment of the present invention obtaining a patch package corresponding to the vulnerability to be repaired in the terminal device from the server, and mounting the patch package in the system kernel, by loading the patch package in the kernel, not only in the system kernel
  • the existing vulnerabilities are fixed, and the vulnerabilities existing in the program running in the user space can be repaired, which solves the problem that the security software in the prior art cannot fix the vulnerabilities of each module in the system kernel due to the limitation of the repair permission. That is, the present invention implements a comprehensive repair of system vulnerabilities.
  • the device further includes:
  • a first transmitting unit a receiving unit, a downloading unit, and a verifying unit, wherein:
  • a first sending unit configured to send, to the server, a request for querying an update status of the installed patch package in the system kernel
  • a receiving unit configured to receive feedback information that the mounted patch package returned by the server is in an updated state in the server
  • a download unit configured to download the updated patch package from the server according to the feedback information
  • the verification unit is configured to perform signature verification on the updated service package. If the verification is passed, the updated service package is mounted in the system kernel.
  • Applying the implementation method has the beneficial effects that when a new vulnerability in the system is discovered, the server analyzes the information of the vulnerability, determines a corresponding repair method, and compiles the corresponding patch according to the repair method, and passes the system kernel.
  • the patch package is mounted for update, the newly compiled patch is added to the patch package, and the updated patch package is remounted in the system kernel.
  • the terminal device manufacturer does not need to update the patch package, and the security software vendor directly checks the system periodically, compiles the corresponding patch according to the newly discovered vulnerability, and finally mounts the patch in the system kernel. in.
  • the security software vendor can set a short repair cycle, detect and maintain the system, and send the updated patch package to the terminal device in time, so that the device can repair the vulnerability in the system in time, and the embodiment of the present invention will
  • the patch package is mounted in the system kernel and can be used to fix the bugs in each module in the system kernel.
  • the apparatus further includes a splitting unit, the splitting unit for:
  • the updated patch package is split based on each vulnerability, and the patch for each vulnerability included in the updated patch package is obtained;
  • the verification unit is specifically used for:
  • the apparatus further includes an unloading unit for:
  • the patch that causes the abnormal event is uninstalled, and the abnormal event is reported to the server, so that the server repairs the patch that causes the abnormal event according to the abnormal event.
  • the apparatus further includes a second sending unit, where the second sending unit is configured to:
  • the repair unit 502 After the repair unit 502 performs the vulnerability repair according to the patch package, the repair result is sent to the server, so that the server debugs each patch included in the patch package according to the repair result.
  • the repairing unit 502 performs vulnerability repair according to the patch package, including:
  • the full file corresponding to the abnormal file is replaced with the updated full file to complete the repair of the system vulnerability.
  • a server is also provided in the embodiment of the present invention.
  • the schematic structural diagram of the server is as shown in FIG. 6, and includes: a memory 601 and a processor 602.
  • the memory 601 and the processor 602 are electrically connected.
  • At least one program is stored in the memory 601.
  • At least one program for performing by processor 602 implements the following steps:
  • At least one program is used to implement:
  • At least one program is used to implement:
  • the updated patch package is split based on each vulnerability, and the patch for each vulnerability included in the updated patch package is obtained;
  • the step of mounting the updated patch package in the system kernel includes:
  • At least one program is used to implement:
  • the patch that causes the abnormal event is uninstalled, and the abnormal event is reported to the server, so that the server repairs the patch that causes the abnormal event according to the abnormal event.
  • At least one program is used to implement:
  • the repair result is sent to the server, so that the server debugs each patch included in the patch package according to the repair result.
  • the manner in which the vulnerability is repaired according to the patch package includes:
  • the full file corresponding to the abnormal file is replaced with the updated full file to complete the repair of the system vulnerability.
  • FIG. 7 shows a server (hereinafter collectively referred to as a server) that can implement the vulnerability repair according to the present invention.
  • the server conventionally includes a processor 710 and a computer program product or computer readable medium in the form of a memory 720.
  • Memory 720 can be an electronic memory such as a flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM.
  • Memory 720 has a memory space 730 for program code 731 for performing any of the method steps described above.
  • storage space 730 for program code may include various program code 731 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • Such computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG.
  • the storage unit may have a storage section or a storage space or the like arranged similarly to the memory 720 in FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit comprises program code 731' for performing the steps of the method according to the invention, ie code that can be read by a processor, such as 710, which, when run by the server, causes the server to perform the above Each step in the described method.
  • the present invention includes apparatus related to performing one or more of the operations described herein. These devices may be specially designed and manufactured for the required purposes, or may also include known devices in a general purpose computer. These devices have computer programs stored therein that are selectively activated or reconfigured.
  • Such computer programs may be stored in a device (eg, computer) readable medium or in any type of medium suitable for storing electronic instructions and coupled to a bus, respectively, including but not limited to any Types of disks (including floppy disks, hard disks, optical disks, CD-ROMs, and magneto-optical disks), ROM (Read-Only Memory), RAM (Random Access Memory), EPROM (Erasable Programmable Read-Only Memory) , EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, magnetic card or light card.
  • a readable medium includes any medium that is stored or transmitted by a device (eg, a computer) in a readable form.
  • each block of the block diagrams and/or block diagrams and/or flow diagrams and combinations of blocks in the block diagrams and/or block diagrams and/or flow diagrams can be implemented by computer program instructions. .
  • these computer program instructions can be implemented by a general purpose computer, a professional computer, or a processor of other programmable data processing methods, such that the processor is executed by a computer or other programmable data processing method.
  • steps, measures, and solutions in the various operations, methods, and processes that have been discussed in the present invention may be alternated, changed, combined, or deleted. Further, other steps, measures, and schemes of the various operations, methods, and processes that have been discussed in the present invention may be alternated, modified, rearranged, decomposed, combined, or deleted. Further, the steps, measures, and solutions in the prior art having various operations, methods, and processes disclosed in the present invention may also be alternated, modified, rearranged, decomposed, combined, or deleted.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)
  • Debugging And Monitoring (AREA)

Abstract

本发明提供了漏洞修复方法、漏洞修复装置及服务器。该方法包括：从服务器中获取补丁包，并将补丁包挂载于系统内核中，以及补丁包是根据终端设备中待修复漏洞的修复相关信息进行编译的；根据补丁包进行漏洞修复。应用本发明实施例提供的漏洞修复方法，从服务器获取终端设备中待修复漏洞对应的补丁包，并将补丁包挂载于系统内核中，通过在内核加载该补丁包，不仅可以对系统内核中存在的漏洞进行修复，而且还可以对运行在用户空间的程序中存在的漏洞进行修复，解决了现有技术中安全软件由于修复权限的局限，而无法对系统内核中各模块进行漏洞修复的问题，即本发明实现了对系统漏洞的全面修复。

Description

漏洞修复方法、漏洞修复装置及服务器 技术领域
本发明涉及计算机技术领域，具体而言，本发明涉及漏洞修复方法、漏洞修复装置及服务器。
背景技术
随着计算机技术的不断发展，很多恶意程序(例如，计算机病毒、后门程序、木马、间谍软件以及广告软件等)利用漏洞植入到目标程序中，从而导致目标程序瘫痪，给用户操作带来不便，或者导致用户私人信息泄漏，给用户的人身财产安全带来隐患，等等；因此，目前各大设备厂商十分重视对系统的实时修复。
目前，各大设备厂商会不定时地对系统进行检测，确定出系统中存在的漏洞，并根据确定出的漏洞对系统进行修复或升级。具体的修复方法为：首先，测试人员和服务器会对系统进行大量地、全面地检测，尽可能多地确定出系统中存在的漏洞，其次，测试人员根据确定出的漏洞分别编译出相应的修复方案，最终才可完成对系统的修复工作。由此可知：设备厂商每进行一次系统修复将会耗费大量的资源。
基于上述原因，大部分设备厂商不会设置较短的修复周期，可能一年内只对系统升级1～3次，这样，势必造成很多系统漏洞并不能被及时地修复。另外，虽然现有的各种安全软件帮助设备厂商解决了一部分系统修复的问题，但是通常设备厂商基于自身的安全考虑，会对系统内核上许多模块设置修复权限，使得安全软件无法对系统进行全面的检测及修复，给用户带来不便。
发明内容
本发明针对现有技术的缺点，提供了漏洞修复方法、漏洞修复装置及服务器，用于对系统进行全面的漏洞修复。
第一方面，本发明实施例提供了一种漏洞修复方法，该方法包括：从服务器中获取补丁包，并将补丁包挂载于系统内核中，以及补丁包是根据终端设备中待修复漏洞的修复相关信息进行编译的；根据补丁包进行漏洞修复。
第二方面，本发明实施例提供了一种漏洞修复装置，包括：至少一个处理器；以及，至少一个存储器，其与所述至少一个处理器可通信地连接；所述至少一个存储器包括处理器可执行的指令，当所述处理器可执行的指令由所述至少一个处理器执行时，致使所述装置执行至少以下操作：从服务器中获取补丁包，并将补丁包挂载于系统内核中，以及补丁包是根据终端设备中待修复漏洞的修复相关信息进行编译的；根据补丁包进行漏洞修复。
第三方面，本发明实施例提供一种服务器，包括存储器和处理器，存储器用于存储包括程序指令的信息，处理器用于控制程序指令的执行，程序被处理器执行时实现上述第一方面所述的方法的步骤。
第四方面，本发明实施例提供一种计算机程序，包括计算机可读代码，当服务器运行所述计算机可读代码时，导致第一方面所述的方法被执行。
第五方面，本发明实施例提供一种计算机可读介质，其中存储了如第四方面所述的计算机程序。
应用本发明实施例提供的漏洞修复方法，从服务器获取终端设备中待修复漏洞对应的补丁包，并将补丁包挂载于系统内核中，通过在内核加载该补丁包，不仅可以对系统内核中存在的漏洞进行修复，而且还可以对运行在用户空间的程序中存在的漏洞进行修复，解决了现有技术中安全软件由于修复权限的局限，而无法对系统内核中各模块进行漏洞修复的问题，即本发明实现了对系统漏洞的全面修复。
本发明附加的方面和优点将在下面的描述中部分给出，这些将从下面的描述中变得明显，或通过本发明的实践了解到。
附图说明
本发明上述的和/或附加的方面和优点从下面结合附图对实施例的描述中将变得明显和容易理解，其中：
图1为本发明实施例提供的一种漏洞修复方法的流程示意图；
图2为本发明实施例提供的一种在系统内核中挂载补丁包的示意图；
图3为本发明实施例提供的一种更新补丁包的流程示意图；
图4为本发明实施例提供的一种服务器编译补丁包的流程示意图；
图5为本发明实施例提供的一种漏洞修复装置的结构示意图；
图6为本发明实施例提供的一种服务器的结构示意图；
图7为本发明实施例提供的用于执行根据本发明的方法的服务器的框图；以及
图8为本发明实施例提供的用于保持或者携带实现根据本发明的方法的程序代码的存储单元示意图。
具体实施方式
下面详细描述本发明的实施例，所述实施例的示例在附图中示出，其中自始至终相同或类似的标号表示相同或类似的元件或具有相同或类似功能的元件。下面通过参考附图描述的实施例是示例性的，仅用于解释本发明，而不能解释为对本发明的限制。
本技术领域技术人员可以理解，除非特意声明，这里使用的单数形式“一”、“一个”、“所述”和“该”也可包括复数形式。应该进一步理解的是，本发明的说明书中使用的措辞“包括”是指存在所述特征、整数、步骤、操作、元件和/或组件，但是并不排除存在或添加一个或多个其他特征、整数、步骤、操作、元件、组件和/或它们的组。应该理解，当我们称元件被“连接”或“耦接”到另一元件时，它可以直接连接或耦接到其他元件，或者也可以存在中间元件。此外，这里使用的“连接”或“耦接”可以包括无线连接或无线耦接。这里使用的措辞“和/或”包括一个或更多个相关联的列出 项的全部或任一单元和全部组合。
本技术领域技术人员可以理解，除非另外定义，这里使用的所有术语(包括技术术语和科学术语)，具有与本发明所属领域中的普通技术人员的一般理解相同的意义。还应该理解的是，诸如通用字典中定义的那些术语，应该被理解为具有与现有技术的上下文中的意义一致的意义，并且除非像这里一样被特定定义，否则不会用理想化或过于正式的含义来解释。
本发明实施例提供了一种漏洞检测方法，该方法的流程示意图如图1所示，具体包括以下步骤：
S101：从服务器中获取补丁包，并将补丁包挂载于系统内核中，以及补丁包是根据终端设备中待修复漏洞的修复相关信息进行编译的；
S102：根据补丁包进行漏洞修复。
应用本发明实施例提供的漏洞修复方法，从服务器获取终端设备中待修复漏洞对应的补丁包，并将补丁包挂载于系统内核中，通过在内核加载该补丁包，不仅可以对系统内核中存在的漏洞进行修复，而且还可以对运行在用户空间的程序中存在的漏洞进行修复，解决了现有技术中安全软件由于修复权限的局限，而无法对系统内核中各模块进行漏洞修复的问题，即本发明实现了对系统漏洞的全面修复。
本发明实施例的应用场景可以是：安全软件厂商对合作的终端设备厂商所开发的各种终端设备进行漏洞分析，编译出各个漏洞对应的补丁，并将这些补丁打包成补丁包；各终端设备分别将各自对应的补丁包挂载在系统内核中，在内核中实现漏洞修复的功能。终端设备厂商通过与安全软件厂商合作，将检测漏洞以及修复漏洞的任务交给安全软件厂商，减轻了终端设备厂商的负担；将补丁包分别挂载在对应终端设备的内核中，实现了系统内核漏洞的修复。
以下针对以上各个步骤的具体实现做进一步的说明：
S101：从服务器中获取补丁包，并将补丁包挂载于系统内核中，以及补丁包是根据终端设备中待修复漏洞的修复相关信息进行编译的。
对于本步骤，在一种应用场景中，终端设备厂商在推出终端设备之前， 直接将安全软件厂商提供的补丁包挂载于系统内核中，即：在用户使用终端设备之前，终端设备中已挂载了补丁包。在另一种应用场景中，终端设备厂商在推出终端设备之后，终端设备从服务器中获取补丁包，并将该补丁包挂载在系统的内核。
对于第二种应用场景，本步骤对应的具体实施方式可以为：终端设备向服务器发送查询该终端设备对应补丁包的请求，具体可以设置发送周期，例如，设置每3天发送1次查询请求，当服务器确定已存在该设备对应的补丁包后，将对应的反馈信息发送至该终端设备，终端设备收到该反馈信息后，立即从服务器中下载相应的补丁包，并挂载于系统的内核中。在另一种实施方式中，当服务器确定存在该设备对应的补丁包后，主动将补丁包下发至相应的终端设备，终端设备在收到该补丁包后，将该补丁包挂载于系统的内核中。
下面通过一个实施例具体说明在内核中挂载补丁包的过程，但也只是示例性地说明，不能理解为对本发明的限定。
具体地，如图2所示，终端设备中包括用户空间(User Space)和内核空间(Kernel)，用户空间中可包括软件开发工具包(Software Development Kit，即SDK)，以及本地守护进程(Native Daemon)。其中，Native Daemon为可执行程序，例如，init进程，在系统启动时启动，负责与内核进行通讯，对补丁包进行校验等工作；SDK负责与服务器进行通讯。
下面结合图2对系统内核挂载补丁包的过程进行详细描述：
安全软件对应的服务器将编译好的补丁包发送至终端设备厂商对应的服务器(设备服务器)，终端设备通过SDK向服务器发送查询该终端设备对应补丁包的请求，具体是查询服务器中是否存在该终端设备对应的补丁包，设备服务器接收到该请求后，向该SDK返回反馈信息；若该反馈信息为确定服务器中存在终端设备对应的补丁包，该SDK根据该反馈信息，从设备服务器中下载相应的补丁包，并将该补丁包发送至Native Daemon；Native Daemon接受到该补丁包后，对该补丁包进行签名校验， 具体校验该补丁包的发送方是否是预先约定的服务器(目标服务器)，当确定发送方是目标服务器时，将该补丁包发送至内核，即在内核中完成补丁包的挂载。
S102：根据所述补丁包进行漏洞修复。在本步骤中，根据内核中的补丁包对系统漏洞进行修复，具体的修复的方式包括：通过钩子函数(HOOK)对目标函数进行修复，以完成对系统内核漏洞的修复。具体地，通过在补丁包中布置HOOK程序，该HOOK程序负责对内核中预先配置的调用函数进行监控，当HOOK监测到问题函数(目标函数)时，钩取问题函数并及时地对该目标函数进行修复，最终完成整个系统内核的漏洞修复。在一种优选的实施方式中，将HOOK过程优化为原子操作，这样，在漏洞修复时不会对系统造成影响。
对系统漏洞修复的方式还包括：当检测到存在漏洞的异常文件时，将该异常文件对应的全文件替换为更新后的全文件，以完成对系统漏洞的修复。具体地，服务器对系统进行检测时，确定系统漏洞对应的文件(异常文件)，并对该异常文件进行修复，获得更新后的全文件；将该更新后的全文件写入补丁包，当终端设备利用该补丁包对系统漏洞进行修复时，直接将异常文件对应的全文件替换为更新后的全文件。通过全文件替换的方式修复系统漏洞，保证了系统的稳定性。
上述全文件替换的方式可理解为在一定内存范围内的全文件替换，若异常文件对应的完整文件所占用的内存较大，这样，如果将该完整文件进行替换时，必然会消耗大量的资源，因此，本发明实施例中，可以截取一定内存范围的文件作为“全文件”。
本发明实施例还包括：通过内核将系统漏洞修复之后，将修复结果发送至服务器，使得服务器根据修复结果对补丁包所包含的各个补丁进行调试。在实际应用中，当系统漏洞修复之后，终端设备将修复结果先发送至终端设备服务器，终端设备服务器可以对修复结果进行过滤，例如，过滤掉一些终端设备的信息，比如，使用或购买该终端设备的人数，然后，将过滤后的修复结果发送至安全软件服务器，保证了终端设备厂商的信息安 全。
在实际应用中，系统漏洞不可能一次就全部被检测到，而是在使用或者检测的过程中不断地被检测到，因此，需要不断地针对新检测到的漏洞编译出各漏洞对应的补丁。如背景技术记载的内容，在现有技术中，终端设备厂商会周期性地对系统进行修复或升级，但由于每次系统的修复或升级会耗费大量的资源，因此，终端设备不会设置较短的修复周期，这样，导致系统漏洞不能被及时地修复。另外，随着科技的发展，终端设备的更新十分迅速，大部分终端设备厂商只在一段时间内对某款设备的系统进行修复，之后便不再修复，这时给仍在使用这款设备的用户带了不便。
本发明实施例针对上述问题，提供了一种实施方式，该实施方式具体为：向服务器发送查询系统内核中已挂载补丁包的更新状态的请求；接收服务器返回的已挂载补丁包在服务器中处于更新状态的反馈信息；根据反馈信息，从服务器中下载更新后的补丁包；对更新后的补丁包进行签名校验，若校验通过，将更新后的补丁包挂载于系统内核中。
如图3所示为一种更新补丁包的实施方式，与前述图2挂载补丁包的过程类似，具体包括以下步骤：
S301：终端设备通过SDK向服务器发送查询Kemel中已挂载补丁包的更新状态的请求；
S302：服务器接收该请求后，向SDK返回相应的反馈信息；
S303：若确定Kemel中已挂载的补丁包处于更新状态时，通过SDK下载更新后的补丁包，并通知Native Daemon补丁包下载完成(S304)；
S305：通过Native Daemon对更新后的补丁包进行安装，并对该更新后的补丁包进行签名校验(S306)，具体校验该补丁包的发送方是否是目标服务器；
S307：若校验通过，Kemel应用该更新后的补丁包，并利用该更新后的补丁包进行漏洞修复(S308)；
S309：完成漏洞修复后，通过Native Daemon将漏洞修复结果上报给SDK，并通过SDK上报给服务器(S310)。
当发现系统中的新漏洞时，服务器对该漏洞的信息进行分析，确定出相应的修复方法，并根据该修复方法编译出对应的补丁，通过对系统内核中已挂载补丁包进行更新，将新编译的补丁添加入补丁包中，并将该更新的补丁包重新挂载在系统内核中。在实际应用中，无需终端设备厂商对补丁包进行更新，直接由安全软件厂商对系统进行周期性地检测，并根据新发现的漏洞编译出相应的补丁，并最终将该补丁挂载在系统内核中。安全软件厂商可以设置较短的修复周期，对系统进行检测和维护，将更新的补丁包及时地下发给终端设备，进而使得设备可以及时地对系统中的漏洞进行修复，并且本发明实施例将补丁包挂载在系统内核中，可以实现对系统内核中的各个模块进行漏洞修复。
在实际应用中，对于补丁包的更新可以是在已挂载补丁包中增加新的补丁，或者可以对已挂载补丁包中原有的补丁进行升级，具体可以是增加新的功能，或者对已有的功能进行修正，等等。另外，对补丁包进行修订的方式可以对系统中已挂载的补丁包进行全部替换；在一种优选的实施方式在中，为了节约资源，可以只对已挂载补丁包中更新的的补丁进行替换，和/或增加新的补丁。
另外，在实际应用中，在系统漏洞的修复的过程可能会因为应用某个补丁而发生异常事件，例如，系统重启。对于该问题，本发明实施例提供一种实施方式，具体为：当检测到补丁包进行漏洞修复时发生异常事件时，校验异常事件是否由补丁包所包含的任一补丁所导致；若是，对导致异常事件的补丁进行卸载，并将异常事件上报至服务器，以使得服务器根据异常事件对导致异常事件的补丁进行修复。
沿用上述图3所示的例子，通过Native Daemon除了可以对补丁包进行签名校验之外，还可以对系统中发生的异常事件进行校验，具体校验该异常事件是否由补丁包所包含的任一补丁所导致，若是，Native Daemon向Kemel发送通知，告知Kemel对导致异常事件的补丁进行卸载，同时，通过Native Daemon以及SDK将该异常事件上报至服务器。
图3只是本发明实施例提供的一种更新Kemel补丁包的实施方式，在 实际应用中，还有很多种实施方式，例如，在一种实施方式中，Native Daemon在获得更新后的补丁包后，对该更新后补丁包进行拆分，获得更新后的补丁包所包含的针对各个漏洞的补丁，并对该补丁包进行签名校验，若校验通过，将针对各个漏洞的补丁挂载在系统内核中。
再例如，如果应用场景是安全软件厂商与终端设备厂商合作，为了安全考虑，会在补丁包中写入安全软件服务器和终端设备服务器的签名信息。例如，图3中通过Native Daemon对更新后的补丁包进行签名校验(S306)，在一种校验方式中，通过Native Daemon同时对补丁包中包含的安全软件服务器和终端设备服务器的签名信息进行校验，若二者均通过，证明该补丁包合法，并将该补丁包挂载在内核中，若任一签名校验不通过，则放弃挂载。
在另一种校验方式中，通过Native Daemon只对其中一个签名信息进行校验，而Kemel对另一个签名信息进行校验。例如，Native Daemon先验证补丁包中包含的签名信息是否是目标安全服务器的签名信息，若是，将该补丁包挂载在Kemel中；当通过Kemel对系统漏洞修复时，可以先校验该补丁包中包含的签名信息是否是目标终端设备服务器的签名信息，若是，再应用该补丁包，若否，可直接卸载该补丁包。
前述内容重点记载在系统内核中挂载补丁包，以及利用补丁包进行系统漏洞修复等实施方式，本发明实施例还提供服务器编译补丁包的方法，该方法的流程如图4所示，具体包括以下步骤：
S401：安全软件服务器收集目标终端设备的漏洞信息，并将这些漏洞信息入库；该漏洞信息可以是安全软件自行检测终端设备所确定的漏洞信息，或者可以第三方提供的漏洞信息，该漏洞信息包括：漏洞的名称、类型、影响范围等信息。
S402：解析库中各个漏洞(例如，解析代码或脚本)，确定各个漏洞的修复方案。
S403：根据确定的修复方案，自动编译各个漏洞对应的补丁，具体地，可以在编译平台(热补丁平台)上执行该编译操作，具体根据漏洞影响的 范围以及漏洞修复方案，自动编译出各个漏洞对应的补丁。
S404：对编译的补丁进行自动检测以及手动检测，确定各补丁的性能。
S405：集合编译的各补丁，打包成补丁包，并在补丁包中加入安全软件服务器的签名信息。
S406：安全软件服务器将补丁包发送给终端设备服务器。
S407：终端设备服务器对补丁包进行审核，具体审核的内容可以包括：该补丁包的性能，以及该补丁包中是否包含有损害终端设备的信息，等等。
S408：若审核通过，在补丁包中加入终端设备服务器的签名信息；为了提高安全性，这里可以采用不对称加密方式对补丁包进行加密。
图4只是本发明实施例列举的一种实施方式，在实际应用中，还有很多实施方式，本发明实施例对此不作具体限定。
在实际应用中，安全软件服务器可以根据每个终端设备对应系统中存在的漏洞信息，编译出相应的补丁包，具体可以根据终端设备的信息进行编译，保证编译的补丁包可以成功适用于相应的终端设备。另外，在实际应用中，为了保证终端设备中信息的安全性，挂载在内核中的“补丁包”，以及本发明实施例记载的“SDK”、“Native Daemon”对应的代码，对于终端设备厂商可以是开源码，即：终端设备服务器可以随时监测到补丁包的挂载以及漏洞修复的过程。
基于本发明的发明构思，本发明实施例还提供了一种漏洞修复装置，该装置的结构示意图如图5所示，具体包括以下单元：
获取单元501和修复单元502，其中：
接收单元501，用于从服务器中获取补丁包，并将补丁包挂载于系统内核中，以及补丁包是根据终端设备中待修复漏洞的修复相关信息进行编译的；
修复单元502，用于根据补丁包进行漏洞修复。
本装置实施例的具体工作流程为：接收单元501从服务器中获取补丁包，并将该补丁包挂载于系统内核中，其中，该补丁包是根据终端设备中 待修复漏洞的修复相关信息进行编译的，其次，修复单元502根据该补丁包进行漏洞修复。
应用本发明实施例提供的漏洞修复装置，从服务器获取终端设备中待修复漏洞对应的补丁包，并将补丁包挂载于系统内核中，通过在内核加载该补丁包，不仅可以对系统内核中存在的漏洞进行修复，而且还可以对运行在用户空间的程序中存在的漏洞进行修复，解决了现有技术中安全软件由于修复权限的局限，而无法对系统内核中各模块进行漏洞修复的问题，即本发明实现了对系统漏洞的全面修复。
本装置实施例实现漏洞修复的方式有很多种，例如，在第一种实施方式中，该装置还包括：
第一发送单元、接收单元、下载单元和校验单元，其中：
第一发送单元，用于向服务器发送查询系统内核中已挂载补丁包的更新状态的请求；
接收单元，用于接收服务器返回的已挂载补丁包在服务器中处于更新状态的反馈信息；
下载单元，用于根据反馈信息，从服务器中下载更新后的补丁包；
校验单元，用于对更新后的补丁包进行签名校验，若校验通过，将更新后的补丁包挂载于系统内核中。
应用该实施方式获得有益效果为：当发现系统中的新漏洞时，服务器对该漏洞的信息进行分析，确定出相应的修复方法，并根据该修复方法编译出对应的补丁，通过对系统内核中已挂载补丁包进行更新，将新编译的补丁添加入补丁包中，并将该更新的补丁包重新挂载在系统内核中。在实际应用中，无需终端设备厂商对补丁包进行更新，直接由安全软件厂商对系统进行周期性地检测，并根据新发现的漏洞编译出相应的补丁，并最终将该补丁挂载在系统内核中。安全软件厂商可以设置较短的修复周期，对系统进行检测和维护，将更新的补丁包及时地下发给终端设备，进而使得设备可以及时地对系统中的漏洞进行修复，并且本发明实施例将补丁包挂载在系统内核中，可以实现对系统内核中的各个模块进行漏洞修复。
在第二种实施方式中，该装置还包括拆分单元，拆分单元用于：
对更新后的补丁包基于各个漏洞进行拆分，获得更新后的补丁包所包含的针对各个漏洞的补丁；
其中，校验单元具体用于：
若校验通过，将针对各个漏洞的补丁挂载于系统内核中。
在第三种实施方式中，该装置还包括卸载单元，卸载单元用于：
当检测到补丁包进行漏洞修复时发生异常事件时，校验异常事件是否由补丁包所包含的任一补丁所导致；
若是，对导致异常事件的补丁进行卸载，并将异常事件上报至服务器，以使得服务器根据异常事件对导致异常事件的补丁进行修复。
在第四种实施方式中，该装置还包括第二发送单元，第二发送单元用于：
在修复单元502根据补丁包进行漏洞修复之后，将修复结果发送至服务器，以使得服务器根据修复结果对补丁包所包含的各补丁进行调试。
在第五种实施方式中，修复单元502根据补丁包进行漏洞修复的方式包括：
通过钩子函数对目标函数进行修复，以完成对系统内核漏洞的修复；和/或，
当检测到存在漏洞的异常文件时，将异常文件对应的全文件替换为更新后的全文件，以完成对系统漏洞的修复。
基于本发明的发明构思，本发明实施例中还提供了一种服务器，该服务器的结构示意图如图6所示，包括：存储器601和处理器602。
存储器601和处理器602相电连接。
存储器601中存储有至少一个程序。
至少一个程序用于被处理器602执行时实现下述步骤：
从服务器中获取补丁包，并将补丁包挂载于系统内核中，以及补丁包是根据终端设备中待修复漏洞的修复相关信息进行编译的；
根据补丁包进行漏洞修复。
优选地，至少一个程序用于实现：
向服务器发送查询系统内核中已挂载补丁包的更新状态的请求；
接收服务器返回的已挂载补丁包在服务器中处于更新状态的反馈信息；
根据反馈信息，从服务器中下载更新后的补丁包；
对更新后的补丁包进行签名校验，若校验通过，将更新后的补丁包挂载于系统内核中。
优选地，至少一个程序用于实现：
对更新后的补丁包基于各个漏洞进行拆分，获得更新后的补丁包所包含的针对各个漏洞的补丁；
其中，若校验通过，将更新后的补丁包挂载于系统内核中的步骤，具体包括：
若校验通过，将针对各个漏洞的补丁挂载于系统内核中。
优选地，至少一个程序用于实现：
当检测到补丁包进行漏洞修复时发生异常事件时，校验异常事件是否由补丁包所包含的任一补丁所导致；
若是，对导致异常事件的补丁进行卸载，并将异常事件上报至服务器，以使得服务器根据异常事件对导致异常事件的补丁进行修复。
优选地，根据补丁包进行漏洞修复的步骤之后，至少一个程序用于实现：
将修复结果发送至服务器，以使得服务器根据修复结果对补丁包所包含的各补丁进行调试。
优选地，根据补丁包进行漏洞修复的方式包括：
通过钩子函数对目标函数进行修复，以完成对系统内核漏洞的修复；和/或，
当检测到存在漏洞的异常文件时，将异常文件对应的全文件替换为更新后的全文件，以完成对系统漏洞的修复。
应用本发明实施例提供的服务器所获得的有益效果，与前述的方法实施例或装置实施例所获得的有益效果相同或类似，对此不再赘述。
图7示出了可以实现根据本发明的漏洞修复的服务器(下述统称为服务器)。该服务器传统上包括处理器710和以存储器720形式的计算机程序产品或者计算机可读介质。存储器720可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器720具有用于执行上述方法中的任何方法步骤的程序代码731的存储空间730。例如，用于程序代码的存储空间730可以包括分别用于实现上面的方法中的各种步骤的各个程序代码731。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图8所述的便携式或者固定存储单元。该存储单元可以具有与图7中的存储器720类似布置的存储段或者存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括用于执行根据本发明的方法步骤的程序代码731’，即可以由例如诸如710之类的处理器读取的代码，这些代码当由服务器运行时，导致该服务器执行上面所描述的方法中的各个步骤。
本技术领域技术人员可以理解，本发明包括涉及用于执行本申请中所述操作中的一项或多项的设备。这些设备可以为所需的目的而专门设计和制造，或者也可以包括通用计算机中的已知设备。这些设备具有存储在其内的计算机程序，这些计算机程序选择性地激活或重构。这样的计算机程序可以被存储在设备(例如，计算机)可读介质中或者存储在适于存储电子指令并分别耦联到总线的任何类型的介质中，所述计算机可读介质包括但不限于任何类型的盘(包括软盘、硬盘、光盘、CD-ROM、和磁光盘)、ROM(Read-Only Memory，只读存储器)、RAM(Random Access Memory，随即存储器)、EPROM(Erasable Programmable Read-Only Memory，可擦写可编程只读存储器)、EEPROM(Electrically Erasable Programmable Read-Only Memory，电可擦可编程只读存储器)、闪存、磁性卡片或光线 卡片。也就是，可读介质包括由设备(例如，计算机)以能够读的形式存储或传输信息的任何介质。
本技术领域技术人员可以理解，可以用计算机程序指令来实现这些结构图和/或框图和/或流图中的每个框以及这些结构图和/或框图和/或流图中的框的组合。本技术领域技术人员可以理解，可以将这些计算机程序指令提供给通用计算机、专业计算机或其他可编程数据处理方法的处理器来实现，从而通过计算机或其他可编程数据处理方法的处理器来执行本发明公开的结构图和/或框图和/或流图的框或多个框中指定的方案。
本技术领域技术人员可以理解，本发明中已经讨论过的各种操作、方法、流程中的步骤、措施、方案可以被交替、更改、组合或删除。进一步地，具有本发明中已经讨论过的各种操作、方法、流程中的其他步骤、措施、方案也可以被交替、更改、重排、分解、组合或删除。进一步地，现有技术中的具有与本发明中公开的各种操作、方法、流程中的步骤、措施、方案也可以被交替、更改、重排、分解、组合或删除。
以上所述仅是本发明的部分实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (15)

  1. 一种漏洞修复方法，包括：
    从服务器中获取补丁包，并将所述补丁包挂载于系统内核中，以及所述补丁包是根据终端设备中待修复漏洞的修复相关信息进行编译的；
    根据所述补丁包进行漏洞修复。
  2. 根据权利要求1所述的漏洞修复方法，其特征在于，所述方法还包括：
    向所述服务器发送查询所述系统内核中已挂载补丁包的更新状态的请求；
    接收所述服务器返回的所述已挂载补丁包在所述服务器中处于更新状态的反馈信息；
    根据所述反馈信息，从所述服务器中下载更新后的补丁包；
    对所述更新后的补丁包进行签名校验，若校验通过，将所述更新后的补丁包挂载于所述系统内核中。
  3. 根据权利要求2所述的漏洞修复方法，其特征在于，所述方法还包括：
    对所述更新后的补丁包基于各个漏洞进行拆分，获得所述更新后的补丁包所包含的针对各个漏洞的补丁；
    其中，若校验通过，将所述更新后的补丁包挂载于所述系统内核中的步骤，具体包括：
    若校验通过，将所述针对各个漏洞的补丁挂载于所述系统内核中。
  4. 根据权利要求1所述的漏洞修复方法，其特征在于，所述方法还包括：
    当检测到所述补丁包进行漏洞修复时发生异常事件时，校验所述异常事件是否由所述补丁包所包含的任一补丁所导致；
    若是，对导致所述异常事件的补丁进行卸载，并将所述异常事件上报至所述服务器，以使得所述服务器根据所述异常事件对导致所述异常事件 的补丁进行修复。
  5. 根据权利要求1所述的漏洞修复方法，其特征在于，根据所述补丁包进行漏洞修复的步骤之后，所述方法还包括：
    将修复结果发送至所述服务器，以使得所述服务器根据所述修复结果对所述补丁包所包含的各补丁进行调试。
  6. 根据权利要求1-5任一所述的漏洞修复方法，其特征在于，所述根据所述补丁包进行漏洞修复的方式包括：
    通过钩子函数对目标函数进行修复，以完成对系统内核漏洞的修复；和/或，
    当检测到存在漏洞的异常文件时，将所述异常文件对应的全文件替换为更新后的全文件，以完成对系统漏洞的修复。
  7. 一种漏洞修复装置，包括：
    至少一个处理器；
    以及，至少一个存储器，其与所述至少一个处理器可通信地连接；所述至少一个存储器包括处理器可执行的指令，当所述处理器可执行的指令由所述至少一个处理器执行时，致使所述装置执行至少以下操作：
    从服务器中获取补丁包，并将所述补丁包挂载于系统内核中，以及所述补丁包是根据终端设备中待修复漏洞的修复相关信息进行编译的；
    根据所述补丁包进行漏洞修复。
  8. 根据权利要求7所述的漏洞修复装置，其特征在于，所述操作还包括：
    向所述服务器发送查询所述系统内核中已挂载补丁包的更新状态的请求；
    接收所述服务器返回的所述已挂载补丁包在所述服务器中处于更新状态的反馈信息；
    根据所述反馈信息，从所述服务器中下载更新后的补丁包；
    对所述更新后的补丁包进行签名校验，若校验通过，将所述更新后的补丁包挂载于所述系统内核中。
  9. 根据权利要求8所述的漏洞修复装置，其特征在于，所述操作还包括：
    对所述更新后的补丁包基于各个漏洞进行拆分，获得所述更新后的补丁包所包含的针对各个漏洞的补丁；
    其中，若校验通过，将所述更新后的补丁包挂载于所述系统内核中的操作，具体包括：
    若校验通过，将所述针对各个漏洞的补丁挂载于所述系统内核中。
  10. 根据权利要求7所述的漏洞修复装置，其特征在于，所述操作还包括：
    当检测到所述补丁包进行漏洞修复时发生异常事件时，校验所述异常事件是否由所述补丁包所包含的任一补丁所导致；
    若是，对导致所述异常事件的补丁进行卸载，并将所述异常事件上报至所述服务器，以使得所述服务器根据所述异常事件对导致所述异常事件的补丁进行修复。
  11. 根据权利要求7所述的漏洞修复装置，其特征在于，所述根据所述补丁包进行漏洞修复的操作之后，所述操作还包括：
    将修复结果发送至所述服务器，以使得所述服务器根据所述修复结果对所述补丁包所包含的各补丁进行调试。
  12. 根据权利要求7-11任一所述的漏洞修复装置，其特征在于，所述根据所述补丁包进行漏洞修复的方式包括：
    通过钩子函数对目标函数进行修复，以完成对系统内核漏洞的修复；和/或，
    当检测到存在漏洞的异常文件时，将所述异常文件对应的全文件替换为更新后的全文件，以完成对系统漏洞的修复。
  13. 一种服务器，包括存储器和处理器，所述存储器用于存储包括程序指令的信息，所述处理器用于控制程序指令的执行，程序被所述处理器执行时实现如权利要求1-6任一所述方法的步骤。
  14. 一种计算机程序，包括计算机可读代码，当服务器运行所述计算 机可读代码时，导致权利要求1-6中的任一项权利要求所述的方法被执行。
  15. 一种计算机可读介质，其中存储了如权利要求14所述的计算机程序。
PCT/CN2018/090865 2017-08-23 2018-06-12 漏洞修复方法、漏洞修复装置及服务器 WO2019037522A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710730150.1A CN107437029A (zh) 2017-08-23 2017-08-23 漏洞修复方法、漏洞修复装置及服务器
CN201710730150.1 2017-08-23

Publications (1)

Publication Number Publication Date
WO2019037522A1 true WO2019037522A1 (zh) 2019-02-28

Family

ID=60461048

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/090865 WO2019037522A1 (zh) 2017-08-23 2018-06-12 漏洞修复方法、漏洞修复装置及服务器

Country Status (2)

Country Link
CN (1) CN107437029A (zh)
WO (1) WO2019037522A1 (zh)

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107437029A (zh) * 2017-08-23 2017-12-05 北京奇虎科技有限公司 漏洞修复方法、漏洞修复装置及服务器
CN107943544B (zh) * 2017-12-11 2021-10-08 北京奇虎科技有限公司 一种内核补丁的加载方法及装置
CN108039945A (zh) * 2017-12-11 2018-05-15 北京奇虎科技有限公司 一种补丁包的签名方法、校验方法及装置
CN107967427A (zh) * 2017-12-11 2018-04-27 北京奇虎科技有限公司 监测漏洞攻击的方法、装置及终端设备
CN108446134A (zh) * 2018-03-30 2018-08-24 努比亚技术有限公司 应用程序的漏洞修复方法、移动终端及可读存储介质
CN109409096B (zh) * 2018-11-15 2021-02-26 百度在线网络技术（北京）有限公司 内核漏洞修复方法、装置、服务器及系统
CN109492406A (zh) * 2018-11-15 2019-03-19 百度在线网络技术（北京）有限公司 监测内核漏洞攻击的方法、装置和系统
CN109976788B (zh) * 2019-03-26 2024-03-15 深圳Tcl数字技术有限公司 智能终端微型漏洞修复方法、智能终端、设备及服务器
CN110321710A (zh) * 2019-07-05 2019-10-11 深信服科技股份有限公司 一种终端漏洞修复方法、系统及相关组件
CN110300119B (zh) * 2019-07-09 2021-09-14 国家计算机网络与信息安全管理中心 一种漏洞验证的方法及电子设备
CN112395616B (zh) * 2019-08-15 2024-01-30 奇安信安全技术(珠海)有限公司 漏洞处理的方法、装置及计算机设备
CN112653655A (zh) * 2019-10-12 2021-04-13 深圳市奇虎智能科技有限公司 汽车安全通信控制方法、装置、计算机设备及存储介质
CN110727456A (zh) * 2019-10-12 2020-01-24 上海莉莉丝科技股份有限公司 应用程序补丁包的下载方法、装置、设备及系统
CN110795128B (zh) * 2019-10-30 2023-10-27 上海米哈游天命科技有限公司 一种程序漏洞修复方法、装置、存储介质及服务器
CN110990833B (zh) * 2019-10-31 2022-08-05 重庆小雨点小额贷款有限公司 一种sdk安全检测方法及相关设备
CN111125709B (zh) * 2019-11-29 2022-05-24 苏州浪潮智能科技有限公司 一种服务器安全漏洞修复方法与装置
CN111159718B (zh) * 2019-12-31 2022-10-28 青岛海尔科技有限公司 用于漏洞修复的方法及装置、家电设备
CN111614628B (zh) * 2020-04-28 2022-06-10 上海汽车集团股份有限公司 内核加固系统及其方法、云服务端、客户端、电子设备和存储介质
CN111753296B (zh) * 2020-05-28 2022-06-17 苏州浪潮智能科技有限公司 一种系统组件漏洞的修复方法及装置
CN111881456A (zh) * 2020-07-29 2020-11-03 江苏云从曦和人工智能有限公司 一种安全风险管控方法、装置、设备和介质
CN112698846B (zh) * 2020-12-30 2024-04-09 麒麟软件有限公司 一种Linux系统自动安装补丁的方法和系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106598667A (zh) * 2016-12-12 2017-04-26 百度在线网络技术（北京）有限公司 用于修复内核漏洞的方法和装置
CN106775732A (zh) * 2016-12-23 2017-05-31 上海优刻得信息科技有限公司 一种热补丁加载方法以及装置
CN106897095A (zh) * 2017-02-24 2017-06-27 网易（杭州）网络有限公司 应用程序热修复的方法、装置和可读存储介质
CN106951279A (zh) * 2017-02-27 2017-07-14 努比亚技术有限公司 应用的热修复装置及方法
CN107437029A (zh) * 2017-08-23 2017-12-05 北京奇虎科技有限公司 漏洞修复方法、漏洞修复装置及服务器

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7647637B2 (en) * 2005-08-19 2010-01-12 Sun Microsystems, Inc. Computer security technique employing patch with detection and/or characterization mechanism for exploit of patched vulnerability
CN103118036A (zh) * 2013-03-07 2013-05-22 上海电机学院 一种基于云端的智能安全防御系统和方法
CN106055979B (zh) * 2016-05-24 2019-04-09 百度在线网络技术（北京）有限公司 内核修复方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106598667A (zh) * 2016-12-12 2017-04-26 百度在线网络技术（北京）有限公司 用于修复内核漏洞的方法和装置
CN106775732A (zh) * 2016-12-23 2017-05-31 上海优刻得信息科技有限公司 一种热补丁加载方法以及装置
CN106897095A (zh) * 2017-02-24 2017-06-27 网易（杭州）网络有限公司 应用程序热修复的方法、装置和可读存储介质
CN106951279A (zh) * 2017-02-27 2017-07-14 努比亚技术有限公司 应用的热修复装置及方法
CN107437029A (zh) * 2017-08-23 2017-12-05 北京奇虎科技有限公司 漏洞修复方法、漏洞修复装置及服务器

Also Published As

Publication number Publication date
CN107437029A (zh) 2017-12-05

Similar Documents

Publication Publication Date Title
WO2019037522A1 (zh) 漏洞修复方法、漏洞修复装置及服务器
US10055576B2 (en) Detection of malicious software packages
US10055249B2 (en) Automated compliance exception approval
Mulliner et al. Patchdroid: Scalable third-party security patches for android devices
US9081967B2 (en) System and method for protecting computers from software vulnerabilities
CN112906008B (zh) 内核漏洞修复方法、装置、服务器及系统
US20140250290A1 (en) Method for Software Anti-Rollback Recovery
US20080155509A1 (en) Operating system monitoring setting information generator apparatus and operating system monitoring apparatus
CN110333868B (zh) 用于生成子应用的安装包的方法和系统
CN104573435A (zh) 用于终端权限管理的方法和终端
JP2023505844A (ja) パッケージベースリモートファームウェアアップデート
WO2016082450A1 (zh) 一种用户终端的升级方法和用户终端
US9940461B2 (en) Enabling an external operating system to access encrypted data units of a data storage system
TWI730415B (zh) 偵測系統、偵測方法、及藉由使用偵測方法所執行的更新驗證方法
US11416619B1 (en) Trusted boot-loader authentication
CN115203678A (zh) 签名启动信息文件并与主机计算系统互锁的系统和方法
CN112783532A (zh) 用于金融终端设备的程序测试系统及装置
TWI545444B (zh) 使待測裝置執行除錯的方法及運作平台、伺服器控制方法
US20200167463A1 (en) Out-of-Band Content Analysis
CN117494232B (zh) 固件的执行方法和装置、系统、存储介质及电子设备
US11928218B2 (en) (BIOS) enforced application blocklist system and method
CN117970907B (zh) 可信dcs控制器可信功能测试方法、电子设备、存储介质
WO2021184712A1 (zh) 一种软件升级方法及装置
Weiss An investigative study on android verified boot process
WO2020261340A1 (ja) 情報処理装置、制御方法及び制御プログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18848266

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 03/08/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18848266

Country of ref document: EP

Kind code of ref document: A1