CN110502888B - A mobile office method based on trusted metrics-based mobile software whitelist mechanism - Google Patents
A mobile office method based on trusted metrics-based mobile software whitelist mechanism Download PDFInfo
- Publication number
- CN110502888B CN110502888B CN201910652971.7A CN201910652971A CN110502888B CN 110502888 B CN110502888 B CN 110502888B CN 201910652971 A CN201910652971 A CN 201910652971A CN 110502888 B CN110502888 B CN 110502888B
- Authority
- CN
- China
- Prior art keywords
- software
- client
- white list
- local server
- database
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/44—Program or device authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- General Health & Medical Sciences (AREA)
- Bioethics (AREA)
- Health & Medical Sciences (AREA)
- Databases & Information Systems (AREA)
- Power Engineering (AREA)
- Storage Device Security (AREA)
Abstract
一种基于可信度量的移动软件白名单机制的移动办公方法属于移动办公领域，尤其涉及可随机检索、可扩展的移动白名单软件的移动办公技术。其特征在于：综合了检索创新、查新评估、身份认证和移动办公于一体的方法，是在由云端服务器、本地服务器和客户端共同组成的网络系统中实现的。本发明借助于客户端的最小检索信息集合RM到本地服务器的最小原始属性集合PM再到存储于云端的APP的最小属性集合PMS前后相邻两个映射表所建立起来的静态白名单软件树，实现了检索创新服务。再用一个待建可信软件的最小原始属性集合WC，代替RM后，便可实现待建可信软件的查新评估，保证了建成后可执行模块的唯一性和可信性。
A mobile office method based on a credible metric-based mobile software whitelist mechanism belongs to the field of mobile office, and in particular relates to a mobile office technology with random retrieval and scalable mobile whitelist software. It is characterized in that the method integrating retrieval innovation, novelty retrieval evaluation, identity authentication and mobile office is realized in a network system composed of a cloud server, a local server and a client. In the present invention, the static whitelist software tree established by two adjacent mapping tables before and after the minimum retrieval information set RM of the client to the minimum original attribute set PM of the local server, and then to the minimum attribute set PMS of the APP stored in the cloud, realizes the realization of Search for innovative services. After replacing the RM with the minimum original attribute set WC of the trusted software to be built, the novelty search and evaluation of the trusted software to be built can be realized, which ensures the uniqueness and reliability of the executable module after completion.
Description
Technical Field
The invention relates to the field of mobile office, in particular to a mobile office method of a mobile software white list mechanism based on credibility measurement.
Background
For general enterprises, the commonly used software is closely related to the working property. And certain enterprises and public institutions only allow employees to use certain software for safety and confidentiality, so that unified management is facilitated. The traditional way of controlling software operation is to prohibit employees from installing some software that does not have any relation to work. However, in practice, the employee downloads some software which is not related to the work, such as chat software, stock-frying software, etc. These software are "illegal" and insecure for the managers of the enterprise. For a mobile security office system, office software used by employees needs to be managed uniformly, and it is important to allow the employees to run some specific software only, which puts a high requirement on software control.
Chinese patent No. ZL201410842891.5 discloses a mobile security office method based on WMI software white list mechanism. The method is based on Windows Management technology, and solves the problem of how to realize mobile safe office by industry white list software in the industry through WMI (Windows Management Instrumentation, Windows Management specification). The technology has three disadvantages: the first point is that the method only comprises a method for constructing a software white list, but not a method for using the software white list; secondly, the method only generates the software white list database once, but cannot expand the existing software white list database; thirdly, the method can respond to the network request of anyone and can not verify the identity information of the request initiator.
The invention discloses a method for guiding a terminal equipment operating system based on a USB controller based on a patent number ZL201510315487.7, and discloses a mobile office method of a mobile software white list mechanism based on credibility measurement on the basis of client credible starting. The mobile safe office method is realized in a network system which is composed of a cloud server, a local server and a client, and integrates retrieval innovation, novelty retrieval evaluation, identity authentication and mobile office into a whole. After the client side initiates a request, the local server verifies the identity information of a request initiator, and after the verification is passed, three request types of the client side are identified: innovation retrieval, novelty retrieval evaluation and mobile office. Aiming at the retrieval innovation request, a user can retrieve a desired APP from the cloud server through keywords; aiming at the new evaluation request, the user can contribute a new APP to the cloud server and expand the existing software white list database; aiming at the mobile office request, the uniqueness and the credibility of the executable software module operated by the user in the office process are ensured.
Disclosure of Invention
The invention aims to: a mobile office method of a mobile software white list mechanism based on credibility measurement is provided.
The invention is characterized in that: the method is realized in a network system based on a static software white list mechanism according to the following steps in sequence:
step (1), system construction:
the system comprises: on-line service software white list database, to-be-built trusted software white list database, department and personnel coding management dataThe system comprises a library, a local server and a client, wherein an online service software white list database, a to-be-built trusted software white list database and a department and personnel code management database are collectively called an online database group, and the local server is called a server for shortWherein, in the database group:
the white list database of the online service software is a trusted software database of the online service, which is called an executable software module database for short, provides a minimum original attribute set PM for industry software used for the online service and transformed into trusted software, and is at least expressed as: the software comprises a program package and/or an executable program, the software type comprises software, a static link module, a dynamic link module and a kernel driving module, the software input data sequence is a constraint condition of software operation, the software output data sequence is an operation result of the software, the software abstract value is obtained by calculating data formed by different combination modes of common splicing of the software input data sequence and the software output data sequence by a quotient according to a cryptographic algorithm SM3,
the white list database of the trusted software to be built is a database of the trusted measurement software to be built, and the minimum original attribute set of the trusted measurement software is as follows: WC ═ provider name, department, post, computer software copyright number, software type, software version, software keyword >,
the minimum original attribute set of the department and personnel code management database is as follows: < department type, personnel name, post, white list software usage rights and corresponding access priority >,
the original attribute refers to original parameter information applicable to binary number expression,
the local server is provided with: storage module, customer end wireless communication module, local server wireless communication module and server CPU, wherein:
a storage module provided with:
mapping table of a client minimal retrieval information set RM to a minimal original property set PM of software of an online service, wherein: the minimum retrieval information set RM of the client at least comprises the name of the client user, the type of department, the post, the software use permission of a white list and the corresponding access priority, the type of software and the keywords of the software,
a mapping table of a minimum raw attribute set (PM) of online server software to a minimum attribute set (PMS) of a mobile APP of a trusted metric stored in a cloud, the PMS comprising: < software digest value, resource module, software input data sequence, software output data sequence, occupied memory range >,
the server CPU is respectively interconnected with the client wireless communication module and the local server wireless communication module,
high in the clouds server is equipped with: cloud CPU, the removal APP database and the high in clouds wireless communication module of the credible measurement in high in the clouds, wherein:
the cloud CPU inputs PM, outputs a software abstract value in the PM to a mobile APP database of cloud credibility measurement, searches corresponding software input data sequences and software output data sequences from the mobile APP database of cloud credibility measurement, forms leaf nodes by the software input data sequences and the software output data sequences, further generates a software white list tree, returns the software white list tree to a cloud wireless communication module, further returns the software white list tree to a local server,
the mobile APP database of the cloud credibility measurement stores white list software obtained through credibility calculation, the minimum attribute set of the white list software is PMS, and a cloud CPU works according to the following sequence: (1) obtaining input PM from a cloud wireless communication module, (2) searching the same software abstract value from a mobile APP database of cloud credibility measurement according to the software abstract value in the PM to obtain a corresponding software input data sequence and a corresponding software output data sequence, forming a minimum attribute set of white list software into the PMS and returning the PMS to a cloud CPU,
the client side is provided with: a cache module, a client minimum retrieval information set, a minimum original attribute set of a to-be-built/under-built trusted software white list, a client CPU and a USB controller, wherein the client CPU is respectively interconnected with the rest components,
and (2) the system sequentially realizes the mobile office method of the mobile software white list mechanism based on the credibility measurement according to the following steps:
step (2.1), the client network requests to initiate personal identification,
step (2.1.1), the local server loads the 128-bit identification code in the USB controller from the filter starting program, recognizes 64-bit role code and 64-bit user code,
step (2.1.2), the local server adopts the digital envelope technology as the security technology when the connection is established, and the steps are as follows:
step (2.1.2.1), the client splices the identification code stored in the USB controller and the timestamp of the current time to form plaintext data which is sent for the first time; the plaintext data is digitally signed through a signature certificate stored by a USB controller, so that the authenticity of the data is ensured; encrypting the data through an encryption certificate stored by the USB controller to form ciphertext data sent for the first time, and ensuring the confidentiality of the data; the ciphertext data is transmitted to a local server,
step (2.1.2.2), after receiving the ciphertext data sent in step (2.1.2.1), the local server processes the ciphertext data through a public/private key corresponding to the USB controller of the sending end to generate plaintext data sent by the client for the first time,
step (2.1.2.3), the local server judges whether the time of the time stamp of the plaintext data is too long, such as 30 minutes, if the time exceeds the specified time, the received ciphertext data is judged to be replay data, and the subsequent judging process is terminated; if the specified time is not exceeded, the data is determined to be an actual client request, the process of step (2.1.2.4) is executed,
step (2.1.2.4), after the role code and the user code are separated by the local server, if corresponding information is not found from the client request, the identity authentication of the initiator of the client network request fails, and the operation is terminated; if the corresponding information is found, the identity authentication of the client network request initiator is completed, step (2.1.3) is executed,
step (2.1.3), the server and the client negotiate a session key based on SM4 symmetric cryptographic algorithm through digital envelope technology, until the subsequent communication between the local server and the client uses the session key and no longer uses the digital envelope technology,
step (2.2), identifying the client requirement:
step (2.2.1), the local server sets the following three types of demand marks according to different requirements proposed by the client in the network initiation request:
the first category is the search innovation request flag for white list software, represented by the binary number "00",
the second type is a new evaluation request flag of new white list software, represented by binary number "01",
the third type is an office sign for transferring the client into official business, which is represented by a binary number of 10,
step (2.2.2), the server judges the actual demand of the user client:
if: for the first requirement, the step (2.2.3) is carried out,
if: for the second requirement, the step (2.2.4) is carried out,
if: for the third requirement, the step (2.2.5) is carried out,
step (2.2.3), realizing the retrieval innovation service of the credible software in the form of the white list according to the following steps:
a step (2.2.3.1) of retrieving, according to the RM to PM mapping table, at least one executable software module for the online retrieval service by software type and software key,
a step (2.2.3.2) of finding at least one credible mobile white list software from the mobile APP database of the cloud credibility measurement according to the PM-to-PMS mapping table by the software abstract value corresponding to each executable software module retrieved in the step (2.2.3.1), and expressing the at least one credible mobile white list software by the software input data sequence and the software output data sequence,
step (2.2.3.3), obtaining a credible white list software tree for the client to search service according to the results from the step (2.2.3.1) to the step (2.2.3.2), wherein the root node is a software keyword in the RM, the middle node is a software abstract value in the PM corresponding to the software keyword in the RM, the leaf node is a software input data sequence A in the PMS corresponding to the software abstract value in the PM, the software output data sequence O is sent to the local server through the cloud wireless communication module,
step (2.2.3.4), the server sends the trusted white list software tree of step (2.2.3.3) to the client,
step (2.2.3.5), the client selects at least one credible white list software as an executable software module based on the software abstract value of the executable software module and the expected software input data sequence A, and the software output data sequence O preferentially selects the executable software module, and proposes a retrieval innovation request to the server;
step (2.2.4), in the stage of updating and evaluating, the client side puts forward a request for carrying out credibility measurement on the software module which has obtained the copyright number of the computer software according to the following steps:
step (2.2.4.1), the client sends out the minimal raw set of attributes WC of the to-be-trusted measurement software to the local server,
step (2.2.4.2), the local server performs the white list software updating evaluation according to the steps (2.2.3.1) to (2.2.3.4), wherein the RM replaces by WC and sends the obtained credible white list software tree to the client self-updating and/or self-evaluating,
step (2.2.4.3), if the client end has uniqueness in self-checking and self-evaluating results, the client end is transmitted to the mobile APP database of the cloud end credibility measurement through the local server for record, and simultaneously transmitted to the local server executable software module database for use, otherwise, the application of the new credibility measurement static white list software is withdrawn,
and (2.2.5), the client side realizes office service according to the following steps:
and step (2.2.5.1), the local server sends the latest trusted white list software tree to the client terminal according to the request of the user, ensures the consistency of the trusted white list software trees of the client terminal and the server,
and (2.2.5.2) the client runs the software to be detected in the office process, if the software to be detected exists in the trusted white list software tree, the software is allowed to run, otherwise, the software is blocked from running.
Drawings
Fig. 1 is a block diagram of the logical structure and connection of a cloud server, a local server, and a client;
FIG. 2 is a schematic diagram of a white list software tree;
FIG. 3 is a block flow diagram of the process of the present invention;
FIG. 4 is a block diagram showing the connection of software modules in the storage module of the USB controller;
note that: the shaded portion in the figure is the data stored encrypted.
Detailed Description
The Chinese patent with the patent number ZL201410842891.5 and the name WMI software white list mechanism-based mobile security office method discloses a white list software-based mobile terminal security office method, which solves the problem of how to realize mobile security office by means of industry white list software in the industry, but does not relate to how to safely search, utilize and innovate scientific and technological information by using a white list software information base with high specialty, industriality and high reliability for an industry user, and how to adopt the white list software information base in the industry for scientific and technological innovation achievements to search, evaluate and analyze, and also relates to the technical problem of identity authentication of a network request initiator.
The invention aims to provide an industrial mobile safe office method which integrates retrieval innovation, novelty retrieval evaluation, identity authentication and mobile office based on the existing white list software information base in the industry. The objects of the invention are as follows:
one of the objects of the present invention is: in the innovative state of retrieval, the retrieval range is expanded as much as possible, the specific technical problems and the constraint conditions of the retrieval subject to be solved are better ensured, the concealment and the fuzziness of the retrieval target are ensured, and the retrieval subject is endowed with greater flexibility.
The second purpose of the invention is that: in the state of updating and evaluating, the provider should adopt a self-updating and self-evaluating mode to avoid the scientific and technological information of the unit being revealed in the updating and evaluating process, and the updating range should be expanded as much as possible to ensure the possibility of the result to the maximum extent.
The third purpose of the invention is: firstly, private communication is carried out between the local server and the client by using digital communication technology based on a digital envelope and a session key based on an SM4 symmetric cryptographic algorithm. Secondly, the local server utilizes an identification code (role code, user code) mapping table which is sent by the client and stored in the USB controller to identify the real identity of a network request initiator of the client, so as to prevent the attack of external hackers and the intrusion of persons in irrelevant departments in the industry and ensure the safety of mobile office.
The present invention proposes a concept for solving the above-mentioned specific technical problems, and the following is specifically set forth:
the first step is as follows: defining software listed in a software white list as trusted software, wherein the trusted software is a set consisting of a series of executable software modules, resource modules, software input data sequences, occupied memory ranges and software output data sequences:
(1) executable software module
And each executable software module comprises a plurality of attributes, only key attributes are selected for credibility measurement in static measurement, and the minimum set of key attributes comprises copyright, abstract values, types, digital signatures, code segments and data segments. Thus, a definition of a set of properties of an executable software module may be given.
A collection of attributes carried by the executable software module at release time. Each set of minimum attributes PC of executable software modules may be represented by a six-tuple:
PC＝{cv,av,type,sv,cseg,dseg,…}
wherein cv represents copyright information of the executable software module for identifying the identity of the issuer; av represents the abstract value of the executable software module, and the local server is generated by calculation through a China commercial password SM 3; the type represents the type of the current executable software module and comprises software, a static link module, a dynamic link module and a kernel driving module; sv represents a digital signature when an executable software module is released, which may not necessarily exist or be null; cseg represents a code segment of an executable software module, and comprises key information such as an instruction set, an import table and an export table; dseg represents a data segment of an executable software module. In addition to the above six-tuple, an Original Entry Point (OEP) or the like may be added for describing metadata of the executable software module. The more items of the property set PC, the more uniqueness can be made to the executable software module.
(2) Resource module
In addition to the set of executable software modules, there is also a set of resources in the software APP. Is a collection of profile, graphics, audio, etc. data. Similar to the executable software module, the resource module is also composed of a plurality of attributes and has the same execution module, but different from the executable software module, the resource module does not have a digital signature and a code segment, and only has related data.
A collection of attributes carried by the resource at the time of publication. The minimum set of attributes PR for a resource module may be represented by a quadruple:
PR＝<cv,av,type,data,…〉
wherein the data represents binary data in the resource file. It should be noted that, through analysis of various software, there are cases where a resource file set is encapsulated into a dynamic link module, i.e., an executable software module contains a resource module. For this case, only the executable software module needs to be analyzed for static metrology, and no longer PR. Since the key property PC of the executable software module is generated on the basis of PR.
(3) Software input data sequence
The software input data sequence A is the operation behavior of scheduling software during the operation of the software, different software input data sequences can enable the software to generate different software behaviors, the software does not have the effect in the static measurement stage, and the dynamic measurement of the software input data sequence is involved only after the software is operated.
(4) Memory range
After the software is loaded into the memory space, the os will default to allocate a memory range mr (memory range) of a certain size. For example, the range addressable by the software itself is 4GB for 32 bits. However, for the operating system, the memory usage of the software is dynamically managed.
(5) Software output data sequence
The software output data sequence is denoted by O. The outcome of a module's output needs to be predictable regardless of how complex, resource dependent, and memory space needed it is designed for.
The second step is that: three databases for online retrieval innovation service request, new search evaluation and identity authentication, a mobile APP database stored by a cloud server, and a corresponding attribute information set are constructed:
at the local server:
1. the minimum original attribute set PM of the online retrieval innovation service at least comprises the following components: < software type, software input data sequence, software output data sequence, software digest value, software keyword >. The software type is from the type of an executable software module in the minimum attribute set of the executable software module when a static software white list mechanism is established; the software abstract value is obtained by calculating data formed by different combination modes of jointly splicing the software input data sequence and the software output data sequence by using a commercial cryptographic algorithm SM 3; the software keywords are professional terms used for searching the trusted software.
2. And in the online retrieval evaluation state, the minimum original attribute set WC of the credibility measurement software to be built is equal to < provider name, department, post, computer software copyright number, software type, software version and software keyword >.
3. The minimum set of original attributes for department and personnel coded data management is: < department type, personnel name, post, white list software usage rights and corresponding access priority >.
At a client:
the minimum search information set RM is < client user name, department type, post, white list software usage right and corresponding access priority, software type, software keyword >.
At a cloud server side:
establishing a minimum attribute set PMS of the mobile APP with credibility measurement, wherein the minimum attribute set PMS is a software abstract value, a resource module, a software input data sequence, a software output data sequence, an occupied memory range > and a corresponding mobile APP database with cloud credibility measurement.
The third step: in the innovative state of online retrieval:
and establishing a RM-to-PM mapping table, comparing two parameters of software types and software keywords in the RM and the PM by the client, and obtaining a software abstract value under the condition that the two parameters are all the same, so that the client can search a plurality of pieces of white list software which can be referred to in the same or similar technical fields under the condition that specific technical problems to be solved locally are not disclosed and the software keywords are the same.
The mapping table from PM to PMS is established, as long as software abstract values in PM and PMS are the same, the local server can obtain a plurality of white list software with the same or similar software input data sequence or/and software output data sequence by comparing the software abstract value sets of PM and PMS with the same software abstract value set, but the software of the client is disclosed by the abstract value which is obtained by calculation according to the software input data sequence and the software output data sequence of the project and is not disclosed. Moreover, only by adopting the SM4 algorithm for the software input data sequence and the software output data sequence respectively, then forming a combined sequence which is continuously connected in series, and then performing third calculation by using the SM4 algorithm, the result which is relatively close to the actual result can be obtained, and the security degree is also the best.
The fourth step: in an online updating evaluation state: the RM is replaced by the minimum attribute set WC of the credible measurement software, so that the provider can check and evaluate the science and technology information of the provider himself or herself automatically, and the scientific and technological information of the provider, the unit or the industry is prevented from being leaked during checking.
The fifth step: the local server finally sends a white list software tree which takes the software key word as a root node, the software abstract value as an intermediate node, and the combination of the software input data sequence and the software output data sequence of the white list software as leaf nodes to the client for use in retrieval innovation and new searching evaluation.
Claims (1)
1. A mobile office method of a mobile software white list mechanism based on credibility measurement is characterized in that the method is sequentially realized in a network system based on a static software white list mechanism, called a system for short, according to the following steps, wherein static refers to a minimum attribute set before software runs:
step (1), system construction:
the system comprises: the system comprises an online service software white list database, a to-be-built trusted software white list database, a department and personnel code management database, a local server and a client, wherein the online service software white list database, the to-be-built trusted software white list database, the department and personnel code management database are collectively called an online database group, the local server is called a server for short, and the server is characterized in that:
the white list database of the online service software is a trusted software database of the online service, which is called an executable software module database for short, provides a minimum original attribute set PM for industry software used for the online service and transformed into trusted software, and is at least expressed as: the software comprises a program package and/or an executable program, the software type comprises software, a static link module, a dynamic link module and a kernel driving module, the software input data sequence is a constraint condition of software operation, the software output data sequence is an operation result of the software, the software abstract value is obtained by calculating data formed by different combination modes of common splicing of the software input data sequence and the software output data sequence by a quotient according to a cryptographic algorithm SM3,
the white list database of the trusted software to be built is a database of the trusted measurement software to be built, and the minimum original attribute set of the trusted measurement software is as follows: WC ═ provider name, department, post, computer software copyright number, software type, software version, software keyword >,
the minimum original attribute set of the department and personnel code management database is as follows: < department type, personnel name, post, white list software usage rights and corresponding access priority >,
the original attribute refers to original parameter information applicable to binary number expression,
the local server is provided with: storage module, customer end wireless communication module, local server wireless communication module and server CPU, wherein:
a storage module provided with:
mapping table of a client minimal retrieval information set RM to a minimal original property set PM of software of an online service, wherein: the minimum retrieval information set RM of the client at least comprises the name of the client user, the type of department, the post, the software use permission of a white list and the corresponding access priority, the type of software and the keywords of the software,
a mapping table of a minimum raw attribute set (PM) of online server software to a minimum attribute set (PMS) of a mobile APP of a trusted metric stored in a cloud, the PMS comprising: < software digest value, resource module, software input data sequence, software output data sequence, occupied memory range >,
the server CPU is respectively interconnected with the client wireless communication module and the local server wireless communication module,
high in the clouds server is equipped with: cloud CPU, the removal APP database and the high in clouds wireless communication module of the credible measurement in high in the clouds, wherein:
the cloud CPU inputs PM, outputs a software abstract value in the PM to a mobile APP database of cloud credibility measurement, searches corresponding software input data sequences and software output data sequences from the mobile APP database of cloud credibility measurement, forms leaf nodes by the software input data sequences and the software output data sequences, further generates a software white list tree, returns the software white list tree to a cloud wireless communication module, further returns the software white list tree to a local server,
the mobile APP database of the cloud credibility measurement stores white list software obtained through credibility calculation, the minimum attribute set of the white list software is PMS, and a cloud CPU works according to the following sequence: (1) obtaining input PM from a cloud wireless communication module, (2) searching the same software abstract value from a mobile APP database of cloud credibility measurement according to the software abstract value in the PM to obtain a corresponding software input data sequence and a corresponding software output data sequence, forming a minimum attribute set of white list software into the PMS and returning the PMS to a cloud CPU,
the client side is provided with: a cache module, a client minimum retrieval information set, a minimum original attribute set of a to-be-built/under-built trusted software white list, a client CPU and a USB controller, wherein the client CPU is respectively interconnected with the rest components,
and (2) the system sequentially realizes the mobile office method of the mobile software white list mechanism based on the credibility measurement according to the following steps:
step (2.1), the client network requests to initiate personal identification,
step (2.1.1), the local server loads the 128-bit identification code in the USB controller from the filter starting program, recognizes 64-bit role code and 64-bit user code,
step (2.1.2), the local server adopts the digital envelope technology as the security technology when the connection is established, and the steps are as follows:
step (2.1.2.1), the client splices the identification code stored in the USB controller and the timestamp of the current time to form plaintext data which is sent for the first time; the plaintext data is digitally signed through a signature certificate stored by a USB controller, so that the authenticity of the data is ensured; encrypting the data through an encryption certificate stored by the USB controller to form ciphertext data sent for the first time, and ensuring the confidentiality of the data; the ciphertext data is transmitted to a local server,
step (2.1.2.2), after receiving the ciphertext data sent in step (2.1.2.1), the local server processes the ciphertext data through a public/private key corresponding to the USB controller of the sending end to generate plaintext data sent by the client for the first time,
step (2.1.2.3), the local server judges whether the time stamp of the plaintext data is too long, if the time is longer than the specified time, the received ciphertext data is judged as replay data, and the subsequent judging process is terminated; if the specified time is not exceeded, the data is determined to be an actual client request, the process of step (2.1.2.4) is executed,
step (2.1.2.4), after the role code and the user code are separated by the local server, if corresponding information is not found from the client request, the identity authentication of the initiator of the client network request fails, and the operation is terminated; if the corresponding information is found, the identity authentication of the client network request initiator is completed, step (2.1.3) is executed,
step (2.1.3), the server and the client negotiate a session key based on SM4 symmetric cryptographic algorithm through digital envelope technology, until the subsequent communication between the local server and the client uses the session key and no longer uses the digital envelope technology,
step (2.2), identifying the client requirement:
step (2.2.1), the local server sets the following three types of demand marks according to different requirements proposed by the client in the network initiation request:
the first category is the search innovation request flag for white list software, represented by the binary number "00",
the second type is a new evaluation request flag of new white list software, represented by binary number "01",
the third type is an office sign for transferring the client into official business, which is represented by a binary number of 10, and in step (2.2.2), the server judges the actual requirements of the user client:
if: for the first requirement, the step (2.2.3) is carried out,
if: for the second requirement, the step (2.2.4) is carried out,
if: for the third requirement, the step (2.2.5) is carried out,
step (2.2.3), realizing the retrieval innovation service of the credible software in the form of the white list according to the following steps:
a step (2.2.3.1) of retrieving, according to the RM to PM mapping table, at least one executable software module for the online retrieval service by software type and software key,
a step (2.2.3.2) of finding at least one credible mobile white list software from the mobile APP database of the cloud credibility measurement according to the PM-to-PMS mapping table by the software abstract value corresponding to each executable software module retrieved in the step (2.2.3.1), and expressing the at least one credible mobile white list software by the software input data sequence and the software output data sequence,
step (2.2.3.3), obtaining a credible white list software tree for the client to search service according to the results from the step (2.2.3.1) to the step (2.2.3.2), wherein the root node is a software keyword in the RM, the middle node is a software abstract value in the PM corresponding to the software keyword in the RM, the leaf node is a software input data sequence A in the PMS corresponding to the software abstract value in the PM, the software output data sequence O is sent to the local server through the cloud wireless communication module,
step (2.2.3.4), the server sends the trusted white list software tree of step (2.2.3.3) to the client,
step (2.2.3.5), the client selects at least one credible white list software as an executable software module based on the software abstract value of the executable software module and the expected software input data sequence A, and the software output data sequence O preferentially selects the executable software module, and proposes a retrieval innovation request to the server;
step (2.2.4), in the stage of updating and evaluating, the client side puts forward a request for carrying out credibility measurement on the software module which has obtained the copyright number of the computer software according to the following steps:
step (2.2.4.1), the client sends out the minimal raw set of attributes WC of the to-be-trusted measurement software to the local server,
step (2.2.4.2), the local server performs the white list software updating evaluation according to the steps (2.2.3.1) to (2.2.3.4), wherein the RM replaces by WC and sends the obtained credible white list software tree to the client self-updating and/or self-evaluating,
step (2.2.4.3), if the client end has uniqueness in self-checking and self-evaluating results, the client end is transmitted to the mobile APP database of the cloud end credibility measurement through the local server for record, and simultaneously transmitted to the local server executable software module database for use, otherwise, the application of the new credibility measurement static white list software is withdrawn,
and (2.2.5), the client side realizes office service according to the following steps:
and step (2.2.5.1), the local server sends the latest trusted white list software tree to the client terminal according to the request of the user, ensures the consistency of the trusted white list software trees of the client terminal and the server,
and (2.2.5.2) the client runs the software to be detected in the office process, if the software to be detected exists in the trusted white list software tree, the software is allowed to run, otherwise, the software is blocked from running.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910652971.7A CN110502888B (en) | 2019-07-19 | 2019-07-19 | A mobile office method based on trusted metrics-based mobile software whitelist mechanism |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910652971.7A CN110502888B (en) | 2019-07-19 | 2019-07-19 | A mobile office method based on trusted metrics-based mobile software whitelist mechanism |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110502888A CN110502888A (en) | 2019-11-26 |
| CN110502888B true CN110502888B (en) | 2021-07-20 |
Family
ID=68586665
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910652971.7A Active CN110502888B (en) | 2019-07-19 | 2019-07-19 | A mobile office method based on trusted metrics-based mobile software whitelist mechanism |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110502888B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111274620B (en) * | 2020-01-16 | 2023-05-05 | 四川效率源科技有限责任公司 | USB device management and control method based on Windows operating system |
| CN112613302B (en) * | 2020-12-31 | 2023-08-18 | 天津南大通用数据技术股份有限公司 | Dynamic credibility judging method for clauses of select statement based on database |
| CN119337361B (en) * | 2024-12-18 | 2025-05-27 | 山东乾云启创信息科技股份有限公司 | Program blocking method and system in dual-system trusted measurement structure in cloud environment |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104580185A (en) * | 2014-12-30 | 2015-04-29 | 北京工业大学 | Method and system for network access control |
| CN104573494A (en) * | 2014-12-30 | 2015-04-29 | 北京工业大学 | Safety mobile office method based on WMI software whitelist mechanism |
| CN104618333A (en) * | 2014-12-30 | 2015-05-13 | 北京工业大学 | Mobile terminal safety office system |
| CN104951701A (en) * | 2015-06-10 | 2015-09-30 | 北京工业大学 | Method for guiding terminal equipment operation system based on USB controller |
| CN105721301A (en) * | 2016-02-25 | 2016-06-29 | 清华大学 | Routing computation method supporting credibility classification |
| CN109309690A (en) * | 2018-12-28 | 2019-02-05 | 中国人民解放军国防科技大学 | Software white list control method based on message authentication code |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9589129B2 (en) * | 2012-06-05 | 2017-03-07 | Lookout, Inc. | Determining source of side-loaded software |
| CA2982463C (en) * | 2015-05-01 | 2019-03-05 | Lookout, Inc. | Determining source of side-loaded software |
-
2019
- 2019-07-19 CN CN201910652971.7A patent/CN110502888B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104580185A (en) * | 2014-12-30 | 2015-04-29 | 北京工业大学 | Method and system for network access control |
| CN104573494A (en) * | 2014-12-30 | 2015-04-29 | 北京工业大学 | Safety mobile office method based on WMI software whitelist mechanism |
| CN104618333A (en) * | 2014-12-30 | 2015-05-13 | 北京工业大学 | Mobile terminal safety office system |
| CN104951701A (en) * | 2015-06-10 | 2015-09-30 | 北京工业大学 | Method for guiding terminal equipment operation system based on USB controller |
| CN105721301A (en) * | 2016-02-25 | 2016-06-29 | 清华大学 | Routing computation method supporting credibility classification |
| CN109309690A (en) * | 2018-12-28 | 2019-02-05 | 中国人民解放军国防科技大学 | Software white list control method based on message authentication code |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110502888A (en) | 2019-11-26 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11531766B2 (en) | Systems and methods for attributing security vulnerabilities to a configuration of a client device | |
| US10002152B2 (en) | Client computer for updating a database stored on a server via a network | |
| US20190288847A1 (en) | Industrial data verification using secure, distributed ledger | |
| CN109493017B (en) | Trusted outsourcing storage method based on block chain | |
| US11240228B2 (en) | Data security utilizing historical password data | |
| CN110502888B (en) | A mobile office method based on trusted metrics-based mobile software whitelist mechanism | |
| US20190199689A1 (en) | Securing data objects through blockchain computer programs | |
| Kuzminykh et al. | Comparative analysis of cryptographic key management systems | |
| EP4357883A1 (en) | Data verification method and apparatus, device and storage medium | |
| US20200267240A1 (en) | Robust computing device identification framework | |
| CN111339193A (en) | Category coding method and device | |
| CN111984631A (en) | Production data migration method, device, computer equipment and storage medium | |
| Liu et al. | A blockchain-based verification for sharing data securely | |
| CN114036068A (en) | Update detection method, device, equipment and storage medium based on privacy security | |
| CN112020058A (en) | Device fingerprint-based verification method, medium, server and system | |
| Silvério et al. | Efficient data integrity checking for untrusted database systems | |
| US11775478B2 (en) | Generating hexadecimal trees to compare file sets | |
| Gupta | Integrity auditing with attribute based ECMRSA algorithm for cloud data outsourcing | |
| HK40084180A (en) | Data processing method, device, computer equipment and storage medium | |
| Alsayed et al. | Realizing Macro Based Technique for Behavioral Attestation on Remote Platform | |
| CN120321108A (en) | Log management method, device, system, electronic equipment and storage medium | |
| JP2017068758A (en) | Retrieval control program, retrieval control method, and retrieval server device | |
| Mast et al. | Cryptographic solutions for security and privacy issues in the cloud | |
| WO2022146926A1 (en) | Private data reporting using blockchain agreements | |
| HK40024722A (en) | Coding method for category and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |