CN101320415A - Control and management module and method for application program - Google Patents

Abstract

The present invention discloses an application control module and method thereof. The present invention modifies the permission data about client application and web page operation stored in the server through an input end, and exchanges and updates the permission data between the server and the client according to the permission data, so as to achieve the function of managing the application operation permission on the client.

Description

The application's control module and its methods

technical field

The present invention relates to an application program control module and its method, specifically, a module and method for limiting the operating authority of a client application program.

Background technique

Due to the development of information technology, enterprises are increasingly relying on computers to assist in the promotion of their business; however, the popularity of information technology also comes with risks, such as external attacks, such as viruses, backdoor programs, and system vulnerability attacks. Threats are also increasing day by day , so enterprise information protection becomes an important issue.

In addition to external attacks, threats to information security are more likely to come from improper internal use; quite a few surveys have found that threats to corporate information security actually come from employees’ malicious behaviors and non-malicious misoperations. Improper use and information access behaviors are actually hidden threats to information security. How to solve internal information security issues is an important security issue that enterprises must face.

At present, with regard to the internal information security management of enterprises, the server and the client constitute a management module, and the central server controls the operation behavior on the client; therefore, most of the software on the market can achieve remote management and control. The client computer is monitored in real time and functions are correspondingly restricted according to the authorization level of the client. However, the control module described so far can only be aimed at internal access to external information within the enterprise, such as restricting the behavior of browsing external web pages or downloading programs from specific URLs, and can only block program operations or web pages. access, rather than just restricting specific functional operations. For example, the current monitoring module cannot browse external web pages but limit the storage of specific web page information, clipping web pages, and other operations. Therefore, when users use internal information of the enterprise, such as when employees of the enterprise use the enterprise resource planning (ERP: Enterprise Resource Planning) system, how to effectively manage the user's operation behavior and prevent the user from malicious or improper operation, causing information security management The loopholes in the above are really problems that need to be solved urgently.

Contents of the invention

The present invention discloses a control module and method capable of restricting the operation and management of application programs and webpages on the client, and updating relevant authority data, so as to solve the above problems.

The present invention discloses a module and method for controlling client programs and web page operations. The present invention at least includes an input terminal (console), a server terminal (server) and a client terminal (client); wherein the function of the input terminal is responsible for receiving Or transmit permission change instructions; the server-side functions include: change the permission data stored in the server-side according to the instructions passed in from the input terminal, notify the client of the change permission event described in the client, and update the permission data stored in the client; Then the updated permission data can be obtained according to the notification information of the server side, and the operation permission of the client application program can be restricted accordingly. Through the above modules and methods, the present invention can achieve the purpose of limiting the operation of the client program.

The invention also discloses a module and method for centralized control and management of multiple client application software operations, so as to achieve the purpose of real-time and unified control of multiple clients. In a specific embodiment of the present invention, both the server end and the client end include a database; the database includes a set of authority data storage tables and control pointers, through the records on the authority data storage tables and the control pointers The interactive corresponding relationship between multiple clients can be managed and updated on the server side in a unified manner.

Description of drawings

Figure 1 shows the application control module related to the present invention.

FIG. 2 shows a flow chart of a method for controlling an application of the present invention.

Description of drawings:

Input 10

server side 20

Data receiving and transmitting unit 21

processing unit 22

Database unit 23

client 30

Change permissions 101

Notification Change Permission 102

Receive permission change notification 201

Notify Permissions Change 202

Obtain new permission data in the database 203

Pass back the new permission data 204

Receive permission change notification 301

Download new permission settings 302

Get new permission settings 303

New permission setting takes effect 304

Detailed ways

The present invention will be described in detail below in conjunction with its preferred embodiments and accompanying drawings. It should be understood that all preferred embodiments in the present invention are for illustration only, In addition, the present invention can also be widely applied in other embodiments. And the present invention is not limited to any embodiment, but should be determined by the scope of claims and their equivalent fields.

FIG. 1 shows a specific embodiment of the present invention. The control module includes an input terminal 10, a server terminal 20 and a client terminal 30, wherein the function of the input terminal 10 is to receive and transmit the operation authority instruction of the controlled management application program. The server end 20 can store the aforementioned authority data, transmit the data about the operation authority and update the operation authority data stored on the client terminal 30 between the input terminal 10 and the client terminal 30; The permission event information updates the operation permission data stored on the client, and limits the operation permission of the application program on the client accordingly. With the above structure, the control module can limit the operation of the application program of the client. The control module of the present invention can be applied to internal network environments such as home and office environments, but is not limited thereto; the described module can also be applied to any network environment that needs to control the operation of client application programs, such as libraries, Internet cafe and so on space.

The functions of the control module in the above embodiments can be described in more detail as follows. The input terminal 10 in the above-mentioned control module has the function of receiving and outputting instructions input by the user to notify the server-side 20 to change the authority data stored in the database; Application-specific functions and querying the project state change permission command. More specifically, in the above-mentioned permission change instruction, items related to restricting the operation functions of specific applications include: prohibiting the printing of specific information, prohibiting the copying of specific information, disabling the keyboard, disabling the ability to save new files, and disabling the mouse to drag specific information; In a specific embodiment, it also includes the function of restricting web page information access, and its items include: prohibiting printing, prohibiting copying specific information, prohibiting keyboards, prohibiting additionally saving new files and prohibiting mouse drag data, prohibiting sending web pages by email, prohibiting viewing original files .

In a specific embodiment of the present invention, the above-mentioned input end is a user interface, and the user can control the operation authority of a specific application program by clicking options on the interface. The user can click the function key of the user interface, such as disabling a specific function option, to open a window partition, and the distinguishing number field in the window includes the name, type and function option of the controlled software. The user can click the modify option at the top of the screen and enter the name of the controlled program in the window to open the permission function setting window and enter the permission function setting information. The above permission function setting window includes a plurality of pre-designed fields, and the user can check the corresponding functions of each field to enable or disable a specific function and complete the input of the input terminal.

Another specific embodiment of the present invention is about restricting and controlling the operation of webpages. In the specific embodiment, the operation interface is similar to the above-mentioned operation interface for controlling specific application programs, but the control target input by the user is a URL.

In a specific embodiment of the present invention, the server 20 includes the following functions: receiving an authority change command from the input terminal, storing, updating and transmitting the controlled application authority data about the client.

The server 20 includes a data receiving and transmitting unit 21 , a processing unit 22 and a database unit 23 . The data receiving and transmitting unit 21 can receive the change authority information from the input terminal 10, and then transmit the data to the processing unit 22, and the processing unit 22 changes the authority data in the database unit 23 according to the change authority information, and receives The communication unit 21 sends a permission change notification to notify the client 30 of the occurrence of the permission change event. After receiving the permission data download request sent back from the client 30, the server 20 will send a change permission data to the client 30 to update the application software permission data stored on the client 30. The above-mentioned server 20 also includes other components such as memory, operating system, hard disk, display unit, etc. However, those with ordinary knowledge in the field should understand that, in order to avoid obscuring the focus of the present invention, they are not described in detail. The same goes for the input terminal and the client terminal.

More specifically, in a specific embodiment of the present invention, the data receiving and transmitting unit 21 uses the TCP communication protocol to notify the client 30 to download the permission data, and use different codes to represent the application program permission data and website permission data; The UDP protocol is used to notify the client of the update of the authorization data. In another specific embodiment of the present invention, the authority data transmitted from the data receiving and transmitting unit 21 includes pointer data corresponding to the application program or web page controlled by the client, so that the client can determine the updated permissions data.

The database 23 for storing authority data includes a set of data tables and control pointers for recording and updating application authority data stored on the client. In a specific embodiment of the present invention, the above-mentioned data table includes at least two data tables: information security behavior (security_action) and information security policy (security_policy) to perform authority data operation restriction function, wherein information security behavior (security_action) is a record containing But not limited to the behavior or mode of the controlled application, command, website or webpage, etc., the information security policy (security_policy) record includes but not limited to the authority data about the specific application, command, website or webpage. The information security behavior sub-database contains at least the following fields: the identification table (id) is an index field used to associate with other work tables, and the classification table (category) is used to record the application program, instruction, website or website type, target The name (target_name) is used to record the executable file name of the controlled application or the controlled URL, and the target type (target_type) is used to record the type of the controlled target. The Security_policy table records the permission restriction data of the controlled applications or URLs. The quantification (value) column in the information security policy table is to record a pointer data, and the pointer has a corresponding relationship with the pointer data in the identification (id) field in the software action (software_action), so that the two data tables are associated; The Disabled_action column records the restricted permissions of the application or website. The field can be written with a specific value, indicating that the behavior is controlled and cannot be used.

The client module 30 at least includes the following functions: receiving information from the server, downloading authority data from the server, and setting authority data. In a specific embodiment, the client includes an authority control unit, such as an additional implanted authority control program, to implement the functions of the above client. In another embodiment, the client includes a database for storing client authority data. The above database includes a set of data tables and control pointers, wherein the data table records the application program data controlled by the client, and the data of each controlled object includes a control pointer corresponding to the control pointer of the same controlled object on the server. Therefore, after downloading the new permission data of the server, the customer service terminal can find out the corresponding controlled application permission data and update it.

In another specific embodiment of the present invention, the control module can be a plurality of combinations of the control modules in the above embodiments to complete a multi-level control module; this multi-level control module can restrict each server according to different authorization levels Modifiable permission data to achieve the purpose of hierarchical management. In the described embodiment, a central server and a plurality of peripheral servers and client computers are included. The database of the central server stores the permission data of each peripheral server, and the peripheral server not only stores the peripheral server permission data, but also stores the permission data of the application program on the client in a specific area. Under the above-mentioned multi-level structure, a central server uniformly manages the status and update of the permission data on each peripheral server, and the peripheral servers open different permission data to change permissions according to different needs and different authorization levels to manage client applications. With this control structure, a hierarchical and partitioned authorized information security management structure can be achieved to manage the operation of the application program on the client computer. In this way, in addition to rapidly updating the permissions of multiple clients, it is also possible to avoid errors that may occur when manually updating the server permission data zone by zone.

FIG. 2 shows a specific embodiment of the authority update process; the user can input change authority and change the authority data on the server through the input terminal in step 101, and send a message in subsequent step 102 to notify the server of the change authority information event. Step 201 means that the server 20 receives the above permission change information, and in the next step 202, sends a message to notify the client of the existence of the permission change event. After receiving the authority setting change information from the server in step 301, the client sends a message in subsequent step 302 to request to download the new authority setting from the server. In subsequent step 203 , the database retrieves the above-mentioned updated authority data according to the information transmitted in step 302 , and in step 204 transmits the above-mentioned updated authority data to the client. After the client obtains the new permission data transmitted from the server in step 303 , in step 304 the permission setting of the client is updated.

In another specific embodiment, the authorization update flow of the present invention can still be applied to the situation of multiple peripheral servers. In this embodiment, the update flow is similar to that shown in FIG. 2, but each peripheral server can be controlled by one Central server management, in this specific embodiment, the authority change command of the server end is downloaded by the central server end, but according to the authority open to each server or user, the authority data can also be input by the input terminal of each server. Therefore, by setting up a central server and combining multiple updating processes identical to those in FIG. 2 , hierarchical and partitioned application software operation authority management can be achieved.

The present invention is described above with preferred embodiments, but it is not intended to limit the scope of patent rights claimed by the present invention. The scope of its patent protection shall depend on the scope of the claims and their equivalent fields. Any modification or modification made by a person with ordinary knowledge in the field without departing from the spirit or scope of this patent belongs to the equivalent change or design completed under the spirit disclosed by the present invention, and should be included in the scope of the claims Inside.

Claims (10)

1. application program control module comprises at least:

One input end can be imported permissions data;

One server end, at least comprise a database and an output/input unit, wherein said database can store described permissions data and pointer data, and in order to carry out information security behavior and information security policy pattern, output/input unit can receive and transmit described permissions data;

One client comprises an authority controlling and managing unit at least, can store, receives and transmit described permissions data, and limits the operating right of the described application software on the client according to this.

2. according to right request 1 described application program control module, it is characterized in that described authority controlling and managing unit can limit the user because of certain purpose, the application software output data on described client; Wherein above-mentioned output comprises at least with the indicator device towing data, and described purpose comprises at least and is used to duplicate, prints, stores.

3. according to right request 1 described application program control module, it is characterized in that described authority controlling and managing unit can limit the user application software on the described client is used the I/O device input instruction.

4. according to right request 1 described application program control module, it is characterized in that described authority controlling and managing unit can limit the webpage source code that the user inspects client.

5. according to right request 1 described application program control module, it is characterized in that described authority controlling and managing unit can limit the user and use bitcom.

6. method with control module limits application operating right comprises at least:

Receive a change authority information at server end;

Permissions data in the database of change server end, wherein said database can store described permissions data and pointer data, in order to carry out information security behavior and information security policy pattern;

Client is downloaded described permissions data after receiving the change authority notice that described server end transmits;

Upgrade the permissions data of client.

7. according to right request 6 described methods, it is characterized in that, can limit the user because of certain purpose, from described client output data with control module limits application operating right; Wherein above-mentioned output comprises at least with the indicator device towing data, and described purpose comprises at least and is used to duplicate, prints, stores.

8. according to right request 6 described methods, it is characterized in that, can limit the user and use the I/O device input instruction with control module limits application operating right.

9. according to right request 6 described methods, it is characterized in that, can limit the user and inspect the webpage source code with control module limits application operating right.

10. according to right request 6 described methods, it is characterized in that, can limit the user and use bitcom with control module limits application operating right.

Images