CN102622550A - Safe online patch check system facing terminal computers - Google Patents

Abstract

A terminal computer-oriented patch security online inspection system, the system conducts a centralized inspection of all terminal computers online on a central computer, and all computers are connected through a network; the system includes online inspection tools, packaging modules and a central computer , the packaging module packs the online inspection tool into a CAB package and stores it on the central computer, the central computer embeds the CAB package into the IE browser, and the terminal computer downloads the CAB package from the central computer through the IE browser and automatically installs it; the central computer All the latest patch packages and patch information are stored on . The system of the present invention encapsulates the inspection tool into the form of a CAB package and embeds it in the IE browser, avoiding the defect that each terminal computer needs on-site inspection at present, and liberating manpower; all expected inspection items can be completed at one time, and finally Realize that a central computer conducts centralized online inspection on all terminal computers in the network, which improves the inspection efficiency.

Description

Patch Security Online Inspection System for Terminal Computers

technical field

The invention relates to a terminal computer-oriented patch security online inspection system, which belongs to the field of computer security technology inspection.

Background technique

A large-scale network system usually includes a large number of different network devices, such as gateways, routers, servers and clients that provide services to users and run various applications. Devices, services, applications, servers, clients, and users, and even their relationships are all objects that need to be managed. The internal complexity of this large-scale network system makes management extremely difficult and the management cycle is lengthy, and with the expansion of the system scale, the management overhead also increases exponentially.

Every large-scale worm outbreak reminds people to be prepared for danger in times of peace, to patch well, and to do a good job of prevention—patching has increasingly become an important part of security management. With the continuous change and development of hacker technology, the time left for administrators will be less and less. Installing patches in the shortest time will greatly protect the network and the secrets it carries, and at the same time, it will also save fewer users from Infested by worms. For users with many machines, complicated manual patch installation is far from being able to adapt to the management of large-scale networks, and new technical means must be relied on to realize automatic patching of the operating system. Therefore, how to use effective technical means to install computer patches in a timely, continuous, and stable manner is an urgent problem for all network security managers and information security leaders and decision-makers.

At present, the common operation is to treat each terminal as an independent object, and manually manage the patches for each terminal computer. However, when the network is relatively large and the number of computers and software is large, the management is complicated. At the same time, it is not real-time enough, which increases the risk of computer security. Even if the patch information is manually managed, the user needs certain computer expertise to use it, and the setting is cumbersome, which is not conducive to the user's operation.

Contents of the invention

The technical solution of the present invention is to overcome the deficiencies of the prior art and provide a terminal computer-oriented patch security online inspection system, which can perform centralized patch distribution to all terminal computers online in real time.

The technical solution of the present invention: a terminal computer-oriented patch security online inspection system, which conducts a centralized inspection of all terminal computers online on a central computer, and all computers are connected through a network; the system includes online inspection tools, The encapsulation module and the central computer, the encapsulation module packs the online inspection tool into the form of a CAB package and stores it on the central computer, the central computer embeds the CAB package into the IE browser, and the terminal computer downloads the CAB package from the central computer through the IE browser and Automatic installation; all the latest patch packs and patch information are stored on the central computer; the online inspection tool includes a strategy customization module, a unified data interface module, a patch analysis module, a query module and a download distribution module;

The user inputs through the IE browser on the central computer and initiates a patch security online inspection instruction for each terminal computer, and the patch security online inspection instruction includes an online update instruction, patch type and the latest version number; the CAB package on each terminal computer Initiate checks based on received online update instructions, as follows:

The unified data interface module receives the patch security online inspection instruction through the IE browser, and starts the patch analysis module; the patch analysis module analyzes the patch type and the latest version number according to the patch security online inspection instruction; and obtains the current patch category of the local computer from the policy customization module and the patch version number, compare the two, if the current patch version number of the local computer is less than the latest version number, then send the patch category to the download distribution module; the download distribution module obtains the patch package corresponding to the patch category according to the received patch category , and download and install, and feed back the installed status and results to the patch analysis module; the patch analysis module, according to the feedback result, when the installation is successful, sends the latest version number corresponding to the installed patch package to the policy customization module; if the installation fails, Then download and install again, if the installation fails within the preset number of times, the notification query module will display the failure information; the current patch category and patch version number of the local computer are stored in the strategy customization module, and the latest version number received Compare with the current patch version number, when the current patch version number is less than or equal to the latest version number, update the current patch version number with the latest version number; otherwise, call the query module to display the current patch version number greater than the latest version number.

The policy customization module also stores the current patch detection cycle of the local computer, and the terminal computer actively initiates a patch update application to the central computer through the unified data interface module according to the patch detection cycle, and the central computer sends the patch type and the latest version number to the terminal computer .

The specific implementation steps of the download distribution module are as follows:

(1) receive the patch category that needs updating sent by the patch analysis module, and send the patch category information to the central computer;

(2) the central computer obtains the connection state between the central computer and each terminal computer in the network by the Ping command;

(3) the central computer sends the network state query instruction through the IE browser, and the unified data interface module of the corresponding terminal computer obtains the instruction from the IE browser and sends it to the download distribution module, and the download distribution module obtains the connection status with other terminal computers, and Return the obtained information to the central computer through the unified data interface module;

(4) The central computer builds a collection according to the received state information, the collection takes the central computer as a starting point, traverses the states of the terminal computers connected to it, and will display the corresponding relationship between computers with good connectivity <V _i , V _j > is stored in this collection, when the response time between the central computer and the terminal computer is within 500 milliseconds, it means that the connection between the central computer and the terminal is in good condition, otherwise it means that the connection between the two is blocked, and the corresponding blocked terminal computer records is V _k ; wherein, V _i (i=1) represents the central computer, and V _j (j≠1) represents a terminal computer in good communication with the central computer;

(5) determine the corresponding relationship with a certain terminal computer V _km blocked by the central computer in the set, specifically as follows:

(5.1) Obtain the connection state information between a certain terminal computer V _km blocked by the central computer in step (4) and V _j in the set of step (4), if there is a computer with good connection state, the connection state The corresponding relationship between V _j with the shortest response time and the corresponding V _km in the information <V _j , V _km > is stored in the set; if there is no computer in V _j that is in good connection with the terminal computer V _km , go to step (5.2);

(5.2) Obtain other terminal computers _Vkn blocked with the central computer in good connection state with this terminal computer _Vkm ; < _Vkn , _Vkm > is stored in this collection, turn (5.3);

(5.3) Obtain the connection state information between the terminal computer V _kn and the V _j in the set of step (4), if there is a computer with a good connection state, then connect the V _j with the shortest response time in the connection state information to the corresponding V _kn The corresponding relationship <V _j , V _kn > is stored in the set; if there is no computer with good connection status, delete <V _kn , V _km > from the set, and store <V ₁ , V _km > in the set;

(6) process according to step (5) to all other terminal computers blocked with the central computer;

(7) The central computer sends status information and corresponding patch packages through the IE browser according to the content in the collection, and the unified data interface module of the terminal computer that is well connected with the central computer obtains the status information and patch packages from the IE browser, and judges Status information Whether the patch package needs to be forwarded to other terminal computers. If necessary, the patch package is forwarded to other terminal computers, and the corresponding patch package is installed, and the result is returned to the patch analysis module.

The advantage of the present invention compared with prior art is:

(1) The system of the present invention encapsulates the inspection tool into the form of a CAB package and embeds it in the IE browser, avoiding the defect that each terminal computer needs on-site inspection at present, and liberating manpower; all expected inspection items can be completed at one time , and finally realize a centralized online inspection of all terminal computers in the network by a central computer, which improves the inspection efficiency.

(2) The system of the present invention provides a patch automatic agent forwarding function, improves the efficiency of patch delivery, reduces the occupancy rate of network bandwidth, and saves network resources. Patches can be distributed in different ways (such as push and pull) at a specified time and within a specified network range, or the client can be uniformly controlled to download patches according to script policies. When the system detects that some clients have not been patched, patches can be pushed to the missing clients.

(2) The system of the present invention provides a patch automatic agent forwarding function, which improves the efficiency of patch distribution, reduces the occupation rate of network bandwidth, and saves network resources. According to the network connection status between each node in the current network, the patch can be pushed in the way of forwarding, and the load rate of the central computer is reduced, ensuring the efficient and orderly work of the central computer.

(3) The present invention can timely reflect the patch status of each client terminal computer, and when the status changes, the status information can be returned in time to remind the user, so that the computer is always in a safe environment.

Description of drawings

Fig. 1 is the architecture diagram of the system of the present invention;

Fig. 2 is the schematic diagram of the realization process of the unified data interface module in the system of the present invention;

Fig. 3 is a schematic diagram of the implementation process of the query module in the system of the present invention;

Fig. 4 is a schematic diagram of the implementation process of the patch analysis module in the system of the present invention;

Fig. 5 is a schematic diagram of the implementation process of the download distribution module.

Detailed ways

The present invention is described in detail below in conjunction with accompanying drawing

As shown in Figure 1, all terminal computers are checked online on a central computer, and all computers are connected through a network; the system includes an online inspection tool, an encapsulation module and a central computer, and the encapsulation module will be checked online The tool is packaged into a CAB package and stored on the central computer. The central computer embeds the CAB package into the IE browser (com technology can be used to realize the embedding), and the terminal computer downloads the CAB package from the central computer through the IE browser and automatically installs it; All the latest patch packs and patch information are stored on the computer; the online inspection tool includes a strategy customization module, a unified data interface module, a patch parsing module, a query module and a download distribution module;

When patch inspection and distribution are performed on each terminal computer in a centralized manner, the user initiates a patch safety online inspection instruction for each terminal computer through the IE browser input on the central computer, and the described patch safety online inspection instruction includes an online update instruction, patch type and the latest version number; the CAB package on each terminal computer starts checking according to the received online update command, as follows:

The unified data interface module receives the patch security online inspection instruction through the IE browser, and starts the patch analysis module;

The patch analysis module analyzes the patch type and the latest version number according to the patch security online inspection instruction; and obtains the current patch category and patch version number of the local computer from the policy customization module, and compares the two. If the current patch version number of the local computer is less than The latest version number, then send the patch category to the download distribution module;

The download and distribution module obtains the patch package corresponding to the patch category according to the received patch category, downloads and installs it, and feeds back the status and results after installation to the patch analysis module; the patch analysis module will, according to the feedback result, send the installed patch The latest version number corresponding to the package is passed to the strategy customization module; if the installation fails, download and install again; if the installation fails within the preset number of times, the query module will be notified to display the failure information;

The current patch category and patch version number of the local computer are stored in the policy customization module, and the latest version number received is compared with the current patch version number. When the current patch version number is less than or equal to the latest version number, the current patch version number is updated with the latest version number. Patch version number; otherwise, call the query module to display the current patch version number greater than the latest version number.

When the terminal computer needs active patch update, the current patch detection cycle of the local computer can be stored in the policy customization module, and the terminal computer actively initiates a patch update application to the central computer through the unified data interface module according to the patch detection cycle, and the central computer applies the patch The type and the latest version number are sent to the terminal computer in the form of instructions, and the patch analysis module and other modules of the terminal computer perform patch updates according to the above-mentioned centralized inspection method.

The central computer can also send a patch query instruction through the IE browser, and the unified data interface module of the corresponding terminal computer obtains the instruction from the IE browser and sends it to the query module, and the query module obtains the corresponding information stored in the strategy customization module from the strategy customization module , and the acquired information is returned to the central computer through the unified data interface module, and displayed by the central computer.

The implementation process of each module is described in detail below.

(1) Download the distribution module

In order to improve the efficiency of downloading and distributing patches, reduce the occupation rate of network bandwidth and save network resources, the specific steps of the method are shown in Figure 5:

(1) receive the patch category that needs updating sent by the patch analysis module, and send the patch category information to the central computer;

(2) The central computer sends a Ping command to each terminal computer through the application program interface API. After the terminal computer receives the Ping command, the operating system returns a received message to the central computer. The central computer sends the command to the time when the message is received interval to determine the network connection status between the central computer and each terminal computer.

(3) the central computer sends the network state query instruction through the IE browser, and the unified data interface module of the corresponding terminal computer obtains the instruction from the IE browser and sends it to the download distribution module, and the download distribution module obtains the connection status with other terminal computers, and Return the obtained information to the central computer through the unified data interface module.

Assuming that a terminal computer is recorded as computer A obtains a network status query command from the IE browser, computer A sends a Ping command to all terminal computers connected to computer A through the application program interface API according to the network status query command, and computer A sends out a Ping command according to the command The time interval from ordering to receiving information determines the network connection status of A computer and all terminal computers connected to it, and the download distribution module on A computer sends the above-mentioned status information to the central computer through the unified data interface module;

(4) The central computer builds a collection according to the received state information, the collection takes the central computer as a starting point, traverses the states of the terminal computers connected to it, and will display the corresponding relationship between computers with good connectivity <V _i , V _j > is stored in this set. Generally, when the response time (that is, status information) between the central computer and the terminal computer is within 500 milliseconds, it means that the connection between the central computer and the terminal is in good condition. Otherwise, it means that the connection between the two is blocked, and the corresponding The blocked terminal computer is denoted as V _k ; wherein, V _i (i=1) represents the central computer, and V _j (j≠1) represents a terminal computer in good communication with the central computer;

(5) determine the corresponding relationship with a certain terminal computer V _km blocked by the central computer in the set, specifically as follows:

(5.1) Obtain the connection state information between a certain terminal computer V _km blocked by the central computer in step (4) and V _j in the set of step (4), if there is a computer with good connection state, the connection state The corresponding relationship between V _j with the shortest response time and the corresponding V _km in the information <V _j , V _km > is stored in the set; if there is no computer in V _j that is in good connection with the terminal computer V _km , go to step (5.2);

(5.2) Obtain other terminal computers _Vkn blocked with the central computer in good connection state with this terminal computer _Vkm ; < _Vkn , _Vkm > is stored in this collection, turn (5.3);

(5.3) Obtain the connection state information between the terminal computer V _kn and the V _j in the set of step (4), if there is a computer with a good connection state, then connect the V _j with the shortest response time in the connection state information to the corresponding V _kn The corresponding relationship <V _j , V _kn > is stored in the set; if there is no computer with good connection status, delete <V _kn , V _km > from the set, and store <V ₁ , V _km > in the set;

(6) process according to step (5) to all other terminal computers blocked with the central computer;

(7) The central computer sends status information and corresponding patch packages through the IE browser according to the content in the collection, and the unified data interface module of the terminal computer that is well connected with the central computer obtains the status information and patch packages from the IE browser, and judges Status information Whether the patch package needs to be forwarded to other terminal computers. If necessary, the patch package is forwarded to other terminal computers, and the corresponding patch package is installed, and the result is returned to the patch analysis module.

For example: the contents of the collection

<V ₁ , V ₂ >

<V ₁ , V ₃ >

<V ₁ , V ₅ >

<V ₁ , V ₇ >

 …

<V ₂ , V ₄ >

<V ₃ , V ₆ >

 …

Then, the central computer needs to send the status information and the corresponding patch package through the IE browser, and the terminal computers V ₂ and V ₃ will forward the received patch package to V ₄ and V ₆ blocked by the central computer according to the status information.

(8) The central computer judges whether the installation of each terminal is completed according to the information returned by each terminal.

(2) Patch analysis module

The implementation process of this module is shown in Figure 4.

(1) The patch analysis module analyzes the patch type and the latest version number according to the patch security online inspection instruction;

(2) Obtain the current patch category and the patch version number of the local computer from the strategy customization module, compare the two, if the current patch version number of the local computer is less than the latest version number, then send the patch category to the download distribution module, and turn to the step (3); otherwise, do not process and end the process;

(3) Receive the installation status and results returned by the download and distribution module. When the results show that the installation is successful, pass the latest version number and installation time corresponding to the installed patch package to the strategy customization module; when the results show that the installation fails, start the download and distribution The module is re-downloaded and installed. If the installation fails within the preset number of times, the notification query module will display the failure information and prompt to restart the computer. The preset number of times mentioned above is generally 2 times, and may also be multiple times.

(3) Strategy customization module

The content stored in the policy customization module can include patch category (for example, system patch, IE patch, application program patch, etc.), patch version number, patch installation time, patch detection cycle, operating system type, etc., and its content can be customized according to actual requirements. The extension can be in the form of a table or an INI file.

For example in INI form:

[Patch version]

Version=v1.6.0.8

[Patch Category]

Category 1 = System Patches

Category 2 = IE Patches

[Patch detection cycle]

Time=10 (default unit is day)

[operating system]

operating systems = Windows XP

...

(4) Query module

The implementation process of this module is shown in Figure 3.

(1) Receive the incoming patch query instruction, analyze the query conditions represented by the instruction, such as: patch type, patch version number, patch installation time, etc., and call the unified data interface module to obtain such information from the policy customization module according to these conditions.

(2) Create a linked list, store the queried information into the linked list, and record the total amount of information. If the queried patch does not exist, return the query condition does not exist or the patch does not exist.

(5) Unified data interface module

The unified data interface module is shown in Figure 2. It is mainly used to receive data transmitted by the central computer or other modules of the terminal computer, encode the data according to the rules, and send the data to the corresponding end according to the IP address. For example, IP address: 192.168.0.119 wait.

The unified data interface module implements a unified data interface by using mature JSON technology.

(6) Encapsulation module

The packaging module packs the online inspection tool into a CAB package. The specific steps are as follows:

(1) Use makecert.exe to make a digital signature

◆Enter the system doc interface, enter the directory of the command cd makecert.exe, and press the Enter key. For example: cd C:/makeCab

◆Enter the command, the command format is as follows: makecert -sv-n-ss-r-b-e. For example: makecert

-sv dsoframer.pvk -n "CN=XXXX" -ss My-r -b 01/01/1900 -e01/01/9999

-sv dsoframer.pvk means to generate a private key file dsoframer.pvk

-n "CN=XXXX" where "XXXX" is the name of the owner of the certificate displayed in the signature.

-ss My specifies that the generated certificate is stored in the personal certificate

-r means that the certificate is issued to itself.

-b 01/01/2009 Specifies the valid start date of the certificate in the format of month/day/year, with a minimum of 1900

-e 01/01/2018 specifies the expiry date of the validity period of the certificate, in the same format as above.

◆Open the "Internet Options" of IE, switch to the "Content" tab, click the "Certificate" button" and select "XXXX" to be the generated certificate, and "export" it as dsoframer.cer,

(2) Create an inf file, run IEXPRESS.EXE, select "create a new self-extracting command file", go to the next step, select "only create compressed files (ActiveX installation)", go to the next step to include the program used The DLL to be called (if any) is added into the list, and after pressing the configuration option, click "Next" continuously to generate dsoframer.CAB.

(3) Run signcode.exe, select dsoframer.CAB, select "Custom (C)" in "Signature Type" in "Signature Options", and then "select from the file" the certificate file dsoframer exported in the first step above .cer, then select the dsoframer.pvk file generated in the first step for the private key in the next step, and then enter the description, note that "description (optional)" in the figure: write the corresponding description sentence in the input box below as needed , click "Next" until the signature is completed.

(4) Embed the completed CAB package into the web page.

Application example: The software and method of the present invention have been successfully applied to the computer online security inspection process of a certain aerospace institute, and successfully completed the online security inspection task of up to 1,000 computers at the same time. It is proved that the software has the advantages of short development cycle, good maintainability, flexible open interface, perfect debugging function and easy to use and manage.

Parts not described in detail in the present invention belong to the well-known technologies in the art.

Claims (3)

1. the patch safety On line inspection system of terminaloriented computing machine is characterized in that: online on a central computer all terminal computers are concentrated inspection, connect through network between all computing machines; Described system is included in ray examination instrument, package module and central computer; Package module is packaged into the form of CAB bag with the On line inspection instrument and is stored on the central computer; Central computer embeds the IE browser with the CAB bag, and terminal computer is downloaded this CAB through the IE browser from central computer and wrapped and install automatically; All up-to-date service packs and patch informations of storage on the central computer; Said On line inspection instrument comprises tactful customized module, uniform data interface module, patch parsing module, enquiry module and download distribution module;

The user initiates the instruction of patch safety On line inspection through the input of the IE browser on the central computer to every station terminal computing machine, and described patch safety On line inspection instruction comprises online update instruction, patch type and latest edition this shop; CAB bag on every station terminal computing machine starts inspection according to the online updating instruction that receives, and is specific as follows:

The uniform data interface module receives the instruction of patch safety On line inspection through the IE browser, starts the patch parsing module; Instruction parses patch type and latest edition this shop to the patch parsing module according to patch safety On line inspection; And from tactful customized module, obtain the current patch classification of local computer and patch release number, the two is compared, if the current patch release of local computer number less than latest edition this shop, then is sent to the download distribution module with the patch classification; The download distribution module is obtained the corresponding service packs of this patch classification according to the patch classification that receives, and downloads and installs, and state and result after installing are fed back to the patch parsing module; The patch parsing module is according to feedback result, and when installing successfully, the latest edition this shop that the service packs of installing is corresponding passes to tactful customized module; If failure is installed, then download and install again, if in preset number of times restriction, failure is installed always, then notify enquiry module that failure information is shown; Current patch classification and the patch release of storage local computer number in the strategy customized module; And the latest edition this shop that receives and current patch release number compared; When current patch release during number smaller or equal to latest edition this shop, upgrade current patch release number with latest edition this shop; Otherwise, call enquiry module current patch release number shown greater than latest edition this shop.

2. the patch safety On line inspection system of terminaloriented computing machine according to claim 1; It is characterized in that: described tactful customized module is also stored the current patch sense cycle of local computer; Terminal computer is initiatively initiated the patch renewal through the uniform data interface module according to the patch sense cycle and is applied for that to central computer central computer is sent to this terminal computer with this patch type and latest edition this shop.

3. the patch safety On line inspection system of terminaloriented computing machine according to claim 1, it is characterized in that: the concrete performing step of described download distribution module is following:

(1) the patch classification of the needs renewal of reception patch parsing module transmission is sent to central computer with this patch classification information;

(2) central computer obtains the connected state between the central computer and each terminal computer in the network through Ping order;

(3) central computer sends the network state query statement through the IE browser; The uniform data interface module of corresponding terminal computing machine is obtained this instruction from the IE browser and is sent to the download distribution module; The download distribution module is obtained the connection status with other terminal computer, and the information of obtaining is back to central computer through the uniform data interface module;

(4) central computer is set up a set according to the status information that receives, and as starting point, the state of the terminal computer that traversal is attached thereto is with the corresponding relation that shows between the good computing machine of connected state with central computer in this set<v _i, V _j>Depositing in this set, is in 500 milliseconds the time when the response time of central computer and terminal computer, good connection between expression central computer and the terminal, on the contrary represent that the two connection status for blocking, blocks terminal computer accordingly and be designated as V _kWherein, V _i(i=1) represent central computer, V _j(j ≠ 1) representative and the good terminal computer of central computer connected state;

(5) definite a certain station terminal computing machine V that blocks with central computer in set _KmCorresponding relation, specific as follows:

(5.1) a certain station terminal computing machine V that blocks with central computer in the obtaining step (4) _KmWith the V in step (4) set _jBetween connection state information, if there is the computing machine of good connection, then with the shortest V of response time in the connection state information _jWith corresponding V _KmCorresponding relation<v _j, V _Km>Deposit in the set; If V _jIn do not exist and this station terminal computing machine V _KmThe computing machine of good connection then changes step (5.2);

(5.2) obtain and this station terminal computing machine V _KmThe terminal computer V that other of good connection and central computer block _KnWill<v _Kn, V _Km>Deposit this set in, change (5.3);

(5.3) obtain terminal computer V _KnWith the V in step (4) set _jBetween connection state information, if there is the computing machine of good connection, then with the shortest V of response time in the connection state information _jWith corresponding V _KnCorresponding relation<v _j, V _Kn>Deposit in the set; If there is not the computing machine of good connection, then deletion from set<v _Kn, V _Km>, will<v ₁, V _Km>Deposit in the set;

(6) terminal computer that all and central computer block to other is handled according to step (5);

(7) central computer is according to the content in the set; Through IE browser send state information and corresponding service packs; The uniform data interface module that is connected good terminal computer with central computer is obtained status information and service packs from the IE browser, judges whether status information need be forwarded to this service packs other terminal computer.If need, then service packs is forwarded to other terminal computer, and corresponding service packs is installed, return results is given the patch parsing module.

Images