High-security software distribution system
By using hash value comparison, encryption and decryption and signature verification in the software distribution system, the security of the software distribution process is ensured, and the problem of uncontrolled software sources is solved, and the software security and reliability on the terminal device is realized. Protection of information security.
Patent Information
- Application Number
- CN202411284291.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-13
- Publication Date
- 2024-12-24
AI Technical Summary
In the prior art, the source of the software is uncontrollable during the software distribution process and is easily tampered with and forged, resulting in various vulnerabilities and threats on the terminal equipment, and the security and confidentiality of the software cannot be effectively guaranteed.
Design a high-security software distribution system, and use multiple security such as hash value comparison, encryption and decryption, and signature verification by deploying the headquarters software warehouse services and branch servers. Protective measures to ensure the source security and transmission security of the software, and deploy terminal management software clients on terminal devices for real-time monitoring and management.
It realizes full-link security protection from the source of the software to the terminal equipment, ensures that there is no tampering during the installation and operation of the software, reduces security risks, and improves the protection ability of security and confidentiality.
Smart Images
Figure CN119180007A_ABST
Abstract
Description
Technical Field
[0001] The invention belongs to the technical field of software distribution security protection, and in particular relates to a high-security software distribution system. Background Art
[0002] In the information age, software has become the main way to record information. This way of recording information has been widely used in the fields of finance, military and culture. If the software used in these fields contains various loopholes or backdoors, it may lead to the loss of information and interruption of important business, or even lead to the leakage of important information to illegal elements, making the unit shrouded in huge threats and risks at any time. The insecurity of software has become the main source of loss to the unit. Software security protection requires the coordination of multiple links, among which software distribution security is an important link.
[0003] There are two main ways of traditional software distribution: one is to build a software warehouse, where users download software to their local computer through the Internet or the local area network established by the unit for installation; the other is for users to collect and install software manually.
[0004] Currently, the basic platform for information and file exchange is basically the Internet, so it is common to obtain and distribute software by building a software warehouse, especially for some larger units with scattered office locations, a wide variety of software, frequent software upgrades, and a large number of terminal devices. This software distribution method generally records the software md5 value in the software warehouse, calculates the software md5 value after the user downloads the software, and compares the md5 value with the md5 value recorded in the software warehouse. If they are the same, the downloaded software is considered to be software in the software warehouse, that is, it is considered to be software that has not been tampered with.
[0005] The user is responsible for collecting software by himself, which requires the user to collect the required software from the software warehouse or the Internet, download it to the terminal device for installation. This method is generally used in industries or units that do not have particularly high requirements for security and confidentiality.
[0006] In recent years, with the continuous development of computer technology, technologies such as software cracking and reverse analysis have emerged one after another. Some malicious crackers and pirated software products can install viruses or Trojans in the software, tamper with the software during the installation process, deceive users, and achieve illegal purposes. For software of great value, it usually faces high-intensity attacks that are organized, planned, targeted, and continuous by humans.
[0007] The method of distributing software by building a software warehouse and using the md5 value comparison strategy has a certain degree of protection capability, but the protection capability is limited. In fact, the md5 value of the software is easy to be forged. Some illegal personnel forge a software by intercepting network packets or illegally build a software warehouse to induce users to download. This method of software distribution is increasingly unsuitable for units with high security requirements, and software distribution security has also begun to receive attention and attention from these units.
[0008] The way that users collect software by themselves does not have any protection capabilities. A terminal device needs to install dozens of software at least, and hundreds of software at most. The entire unit is composed of thousands of terminal devices. Each user collects software by himself, resulting in the inability to control the source of software, complex software version control, and maintenance personnel simply repeating work and low work efficiency. There may even be problems such as copyright infringement, leading to economic and legal consequences, and bringing unpredictable risks to the development of the unit.
[0009] Both of the above methods will deploy software from uncontrolled sources on terminal devices, which inevitably contain various defects and vulnerabilities. The openness and sharing of computer networks, especially the Internet, make it a breeding ground for various threats and attacks. Currently, no patent has proposed a complete high-security software distribution system to address the above problems. Summary of the invention
[0010] 1. Technical issues to be resolved
[0011] The technical problem to be solved by the present invention is how to provide a high-security software distribution system to solve the problem that the prior art deploys software from uncontrolled sources on terminal devices, which inevitably hides various defects and loopholes.
[0012] (II) Technical solution
[0013] In order to solve the above technical problems, the present invention proposes a high-security software distribution system, which deploys software at the headquarters and each branch, specifically including:
[0014] The headquarters software warehouse service is deployed on the headquarters server. The headquarters software warehouse service is used to ensure the source security and transmission security of the software. That is, the software installed on all terminal devices has a unique hash value calculated by the headquarters and signed by a designated machine. The software issued by the headquarters software warehouse is encrypted.
[0015] The branch software warehouse service and the terminal management and control software server are deployed on the branch server. The branch software warehouse service receives the software distribution and deletion operations from the headquarters software warehouse service, verifies whether the signature of the received software is legal, compares the hash value of the software calculated by itself with the hash value of the distributed software, and decrypts the software when the terminal device requests to download the software; the terminal management and control software server compares the hash value again when the terminal installs the software, and monitors and displays the detailed status of the software on all terminal devices managed by this branch;
[0016] Deploy the terminal management and control software client on the terminal device to monitor the installation and uninstallation process of the terminal software, and regularly collect the software details on the terminal device and report them to the terminal management and control software server, so that the computer administrator can control the software security of the terminal device.
[0017] (III) Beneficial effects
[0018] The present invention proposes a high-security software distribution system. The present invention designs a high-security software distribution system, which is suitable for fields or industries with relatively high requirements for security and confidentiality. The present invention proposes a high-security software distribution system with a full link from the source, network transmission to the terminal device, to ensure the security and reliability of the software on the terminal device and reduce the security risks of the unit caused by software distribution.
[0019] The present invention provides a high-security software distribution system. Compared with the prior art, the present invention has the following beneficial effects:
[0020] (1) The solution proposed by the present invention solves the problem of unsafe and unreliable software distribution process, and provides security protection throughout the entire process from software source, network transmission to terminal device installation;
[0021] (2) The solution provided by the present invention can monitor the software status of the terminal device, monitor the installation and uninstallation process, monitor the programs running on the terminal device in real time, protect the security of the software running on the terminal device, and further protect the information security of the unit. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] Figure 1 is the network topology diagram;
[0023] Figure 2 It is a schematic diagram of software deployment of the present invention;
[0024] Figure 3 This is the functional module diagram of the safety protection card;
[0025] Figure 4 This is a schematic diagram of the main flow of the software;
[0026] Figure 5 It is the flow chart for software storage;
[0027] Figure 6 It is a state synchronization flow chart;
[0028] Figure 7 Flowchart of software installation for terminal devices. DETAILED DESCRIPTION
[0029] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.
[0030] In order to ensure the security of software distribution, the present invention proposes a high-security software distribution system. The main features of this method are that it can ensure that the software source is trustworthy, the transmission process is safe and reliable, and the terminal device status can be monitored.
[0031] The present invention specifically solves the following three problems.
[0032] (1) The offices of the units are scattered and the business software is updated frequently
[0033] At present, many large units adopt the mode of multi-site collaborative office. If this office mode adopts software distribution on the Internet, there may be risks such as theft by competitors, especially some important business software. Once stolen by criminals, they will be reverse analyzed by means such as decompilation, which will expose the design logic of the software and even some important parameters and indicators. If the manual update method is adopted, each update requires a lot of manpower costs and is inefficient. The present invention proposes a high-security software distribution system, which adopts the network transmission method, can distribute software to each unit at any time, and the terminal device can download the software for installation at any time. It is suitable for units with multiple office locations and high business software update frequency.
[0034] (2) The unit’s business has extremely high requirements for security and confidentiality
[0035] Such unit businesses often need to ensure that the security of software is foolproof and always face external network security threats. Only management means cannot fully guarantee the security of software distribution, and it is necessary to deal with possible network threats from a technical perspective. The present invention proposes a high-security software distribution system that uses multiple security protection measures such as hash value verification, encryption and decryption, and signature verification to ensure that the software source is credible, the software transmission process is safe and reliable, and the received software package is complete.
[0036] (3) It is difficult to manage the status of terminal equipment in the unit
[0037] Large group units generally have many connected terminal devices. The traditional way to supervise terminal devices is usually through personnel spot checks or self-checks by responsible persons. This method consumes a lot of manpower, and problems such as the installation of illegal software on terminal devices cannot be immediately controlled. The present invention proposes a high-security software distribution system that can monitor the installation and uninstallation process of each connected terminal device in real time, monitor the current software running status of the terminal device in real time, and regularly collect software installation status.
[0038] There are many software distribution methods on the market. The most common one is to build a software warehouse. The software in the software warehouse is uniquely identified by the md5 value. When using the software, the user downloads it from the software warehouse through the Internet or local area network to the local computer and installs it. This way of managing software has problems such as the source being easily disguised, the software transmitted over the network being easily stolen, and the software ecology of the terminal device being unregulated. In order to solve the above problems, the present invention proposes a high-security software distribution system, which provides security protection for the entire software distribution process, and is suitable for units and organizations with high requirements for security and confidentiality.
[0039] The unit network topology diagram targeted by the present invention is shown in the attached figure. Figure 1 As shown. The unit is generally a two-level organizational structure with a headquarters and multiple branches. The headquarters and branches are connected through the Internet or a dedicated network. The network has the risk of being attacked, and the network within each branch is generally physically isolated from the Internet. The headquarters generally does not manage terminal devices, but only manages global business such as the storage and outbound storage of software for the entire unit, and the addition and deletion of each branch; each branch can manage a number of terminal devices, which are used to handle the daily business of the unit.
[0040] To ensure the security of software distribution, the software needs to be deployed in the headquarters and each branch. Figure 2 shown.
[0041] (1) Deploy the "Headquarters Software Warehouse Service" on the headquarters server. The headquarters software warehouse service is used to ensure the source security and transmission security of the software. That is, the software installed on all terminal devices has a unique hash value calculated by the headquarters and signed by a designated machine. The software issued by the headquarters software warehouse is encrypted.
[0042] (2) Deploy the "branch software warehouse service" and "terminal management and control software server" on the branch server. The branch software warehouse service receives software distribution and deletion operations from the headquarters software warehouse service, verifies whether the signature of the received software is legal, compares the hash value of the software calculated by itself to see if it is consistent with the hash value of the software distributed, and decrypts the software when the terminal device requests to download the software. The terminal management and control software server compares the hash value again when the terminal installs the software, and monitors and displays the detailed status of the software on all terminal devices managed by this branch.
[0043] (3) Deploy a "terminal management and control software client" on the terminal device to monitor the installation and uninstallation of the terminal software, as well as regularly collect software details on the terminal device and report them to the terminal management and control software server, so that computer administrators can control the software security of the terminal device.
[0044] A headquarters software warehouse is built on the headquarters server as the only source of software. The source of software installed on all terminal devices must come from the headquarters software warehouse of the headquarters server to prevent the occurrence of scattered sources of terminal device software and unclear sources. The software is signed when entering the headquarters software warehouse. After the software is sent to the branch software warehouse, the signature is verified. This measure ensures the security of the software source, that is, the software received by the terminal device must be sent from the headquarters server. At the same time, when the software is put into the warehouse, the hash value is calculated using a security protection card. There is a risk of theft and forgery when the software is transmitted on the Internet. The software is encrypted on the headquarters server and decrypted when the branch server downloads the software to the terminal device. Through encryption and decryption measures, it is ensured that even if the software is illegally stolen, the key information cannot be cracked; when the software is installed on the terminal device, the terminal control software server of the branch server calculates the hash value of the software and compares it with the hash value sent by the headquarters server. If the software hash value is tampered with, it is prohibited to install it on the terminal device. Deploy the terminal management and control software client on the terminal device to monitor the software ecology on the terminal device in real time, to ensure that an alarm is issued when the software that should be installed on the terminal device is not installed, and an alarm is also issued when the software that should not be installed is installed.
[0045] The security protection card used in the present invention needs to be installed on the headquarters server and the branch server. The main functions of the security protection card in the present invention are: hash value calculation, encryption and decryption, and signature verification. Hash value calculation and comparison measures ensure that the software is very difficult to forge during transmission, even after being hijacked on the network. Encryption and decryption ensure that even if the software is stolen, the key information of the software cannot be cracked without a security protection card. Signature verification ensures that the machine that issues the software is a dedicated machine at the headquarters, not any other machine. The security protection card generates a pair of secret keys, namely a public key and a private key. The private key is used when signing on the headquarters server, and the public key is provided to the branch server for signature verification. The functional modules of the security protection card are as shown in the attached. Figure 3 shown.
[0046] The main process of the present invention includes software status update, software installation and uninstallation, and terminal device software management. The main process diagram of the present invention is shown in the attached figure. Figure 4 shown.
[0047] (1) Software status update
[0048] 1) Software entry process: To ensure the consistency of software versions throughout the entire unit, a headquarters software warehouse service is set up on the headquarters server, and a dedicated person at the headquarters uploads the software installation package to the headquarters software warehouse. This process is called software entry. When the software enters the headquarters software warehouse, a series of security protection measures are performed. First, the software installation package hash value is calculated using a security protection card. Then the software is encrypted to form an encrypted software installation package. Finally, the private key is used to sign the software installation package to generate a signature file. The software installation package hash value, encrypted software installation package, signature file, software entry / exit identification, basic installation package information, and current time generated by this process are written into the database table of the headquarters software warehouse. The software entry flow chart is attached. Figure 5 shown.
[0049] 2) Software outbound process: The software is deleted on the headquarters server, and the corresponding hash value software of all branch servers is deleted. When the headquarters software warehouse wants to delete the software, the hash value of the software to be deleted is sent to the designated branch software warehouse service through the transmission service, and the corresponding software in the branch software warehouse is deleted, and the terminal control software server is notified that no terminal device is allowed to install the software in the future. Software outbound is generally when the unit discovers that the software has security risks or version upgrades during the use of the software.
[0050] 3) Status synchronization process: In order to accurately update the latest status of the headquarters server to each branch server, the headquarters server has all the branch server information. The headquarters server records the status synchronization time of each branch server each time. During this status synchronization, only the information after the last software warehouse update is synchronized. After the branch software warehouse service receives the status synchronization, if it is new software entering the warehouse, it will first perform a signature verification based on the signature file and the software installation package to ensure that the software installation package comes from the machine that holds the private key in the headquarters software warehouse. After the signature verification is passed, the software installation package is decrypted and the decrypted hash value is verified to be consistent with the received hash value. If they are consistent, it is determined that the received software installation package has not been tampered with. The received hash value, the software package before decryption, the signature file and other information are stored in the branch software warehouse database. Figure 6 The following is an example of software storage to illustrate the status synchronization process between the headquarters and branches.
[0051] (2) Software installation and uninstallation
[0052] 1) Software installation process: The user accesses the branch software warehouse of the branch server to which the terminal device belongs on the terminal device and downloads the software to the local computer. The software is automatically decrypted during the download process. When the user installs the software, the terminal management and control software client on the terminal device automatically sends an installation request to the terminal management and control software server of the branch server. The terminal management and control software server calculates the hash value of the software, and if it is consistent with the hash value synchronized with the branch software warehouse service, the installation is allowed; otherwise, it is intercepted and the interception message is synchronized to the branch software warehouse service. The process of installing software on the terminal device is as follows: Figure 7 shown.
[0053] 2) Software uninstallation process: There are generally two situations in which terminal devices uninstall: the user actively uninstalls or the terminal device is infected with a Trojan program and then maliciously uninstalls the software. In either case, when the terminal device uninstalls the software, the terminal control software client on the terminal device automatically sends an uninstallation request to the terminal control software server. The terminal control software server determines that if the file still exists in the branch software warehouse, it will intercept the uninstallation operation. The terminal control software server can also manually release the uninstallation operation, and the operator's identity code needs to be entered at this time.
[0054] (3) Terminal equipment software management
[0055] 1) Terminal device software collection: The terminal management and control software client on the terminal device regularly collects the software installed on the local machine and provides feedback to the terminal management and control software server on the branch server. After receiving the feedback, the terminal management and control software server writes it into the database maintained by the terminal management and control software server and displays it to the administrator.
[0056] 2) Display of installation and uninstallation records: For each installation and uninstallation operation on the terminal device, the terminal management and control software server will record it, write it into the database maintained by the terminal management and control software server, and display it to the administrator. When installing software that is not in the software warehouse, the installed software must also be recorded and the administrator will be alerted.
[0057] 3) Display of running software: The terminal management software client automatically collects the programs running on the terminal device, reports them to the terminal management software server, and displays them to the administrator. For software that must be run on the terminal device, if it is detected that it is not running, the terminal management software server will issue an alarm to prevent users from stopping important software, which may cause the terminal device to be infected with viruses or information loss.
[0058] The above describes the main steps of the high-security software distribution system, through which the whole process management of high-security software distribution is completed.
[0059] The above implementation examples are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred implementation examples, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or some technical features can be replaced by equivalents without departing from the spirit of the technical solution of the present invention, which should be included in the scope of the technical solution claimed for protection.
[0060] The present invention designs a high-security software distribution system, which is suitable for fields or industries with relatively high requirements for security and confidentiality. The present invention proposes a high-security software distribution system with a full link from the source, network transmission to the terminal device, to ensure the safety and reliability of the software on the terminal device and reduce the security risks of the unit caused by software distribution.
[0061] The present invention provides a high-security software distribution system. Compared with the prior art, the present invention has the following beneficial effects:
[0062] (1) The solution proposed by the present invention solves the problem of unsafe and unreliable software distribution process, and provides security protection throughout the entire process from software source, network transmission to terminal device installation;
[0063] (2) The solution provided by the present invention can monitor the software status of the terminal device, monitor the installation and uninstallation process, monitor the programs running on the terminal device in real time, protect the security of the software running on the terminal device, and further protect the information security of the unit.
[0064] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.
Claims
1. A high-security software distribution system, characterized in that: The system deploys software at the headquarters and branches, including: The headquarters software warehouse service is deployed on the headquarters server. The headquarters software warehouse service is used to ensure the source security and transmission security of the software. That is, the software installed on all terminal devices has a unique hash value calculated by the headquarters and signed by a designated machine. The software issued by the headquarters software warehouse is encrypted. The branch software warehouse service and the terminal management and control software server are deployed on the branch server. The branch software warehouse service receives the software distribution and deletion operations from the headquarters software warehouse service, verifies whether the signature of the received software is legal, compares the hash value of the software calculated by itself with the hash value of the distributed software, and decrypts the software when the terminal device requests to download the software; the terminal management and control software server compares the hash value again when the terminal installs the software, and monitors and displays the detailed status of the software on all terminal devices managed by this branch; Deploy the terminal management and control software client on the terminal device to monitor the installation and uninstallation process of the terminal software, and regularly collect the software details on the terminal device and report them to the terminal management and control software server, so that the computer administrator can control the software security of the terminal device.
2. The high-security software distribution system according to claim 1, characterized in that: A headquarters software warehouse is built on the headquarters server as the sole source of software. The software installed on all terminal devices must come from the headquarters software warehouse of the headquarters server.
3. The high-security software distribution system according to claim 2, characterized in that: The software is signed when it enters the headquarters software warehouse. After the software is sent to the branch software warehouse, the signature is verified. That is, the software received by the terminal device must be sent from the headquarters server. At the same time, when the software is put into the warehouse, the hash value is calculated using the security protection card.
4. The high-security software distribution system according to claim 3, characterized in that: The software is encrypted on the headquarters server and decrypted when the branch server downloads the software to the terminal device. Encryption and decryption measures ensure that key information cannot be cracked even if the software is illegally stolen. When the software is installed on the terminal device, the terminal management and control software server of the branch server calculates the hash value of the software and compares it with the hash value sent by the headquarters server. If the software hash value is tampered with, it is prohibited to be installed on the terminal device.
5. The high-security software distribution system according to claim 4, characterized in that: Deploy the terminal management and control software client on the terminal device to monitor the software ecology on the terminal device in real time, to ensure that an alarm is issued when the software that should be installed on the terminal device is not installed, and an alarm is also issued when the software that should not be installed is installed.
6. The high-security software distribution system according to claim 5, characterized in that: Install security protection cards on the headquarters server and branch servers. The functions of the security protection cards include: hash value calculation, encryption and decryption, and signature verification.
7. The high-security software distribution system according to claim 6, characterized in that: The security protection card generates a pair of keys, namely a public key and a private key. The private key is used when signing on the headquarters server, and the public key is provided to the branch server for signature verification.
8. The high-security software distribution system according to claim 5, characterized in that: The software status update process of the system includes: software storage process, software storage process and status synchronization process, among which, Software entry process: The headquarters software warehouse service is set up on the headquarters server, and the headquarters personnel upload the software installation package to the headquarters software warehouse. This process is the software entry. When the software enters the headquarters software warehouse, a series of security protection measures are carried out. First, the software installation package hash value is calculated using the security protection card, and then the software is encrypted to form an encrypted software installation package. Finally, the private key is used to sign and generate a signature file. The software installation package hash value, encrypted software installation package, signature file, software entry / exit identification, basic information of the installation package and current time generated in this process are written into the database table of the headquarters software warehouse. Software outbound process: The software is deleted on the headquarters server, and the software with the corresponding hash value on all branch servers is deleted. This process is called software outbound. When the headquarters software warehouse wants to delete the software, the hash value of the software to be deleted is sent to the designated branch software warehouse service through the transmission service, and the corresponding software in the branch software warehouse is deleted, and the terminal control software server is notified that no terminal device is allowed to install the software in the future. Status synchronization process: The headquarters server has information about all branch servers. The headquarters server records the time of each branch server status synchronization. During this status synchronization, only the information after the last software warehouse update is synchronized. After the branch software warehouse service receives the status synchronization, if it is new software entering the warehouse, the signature verification is first performed based on the signature file and the software installation package to ensure that the software installation package comes from the machine with the private key held by the headquarters software warehouse. After the signature verification is passed, the software installation package is decrypted and the hash value after decryption is verified to be consistent with the received hash value. If they are consistent, it is determined that the received software installation package has not been tampered with. The received hash value, the software package before decryption, the signature file and other information are stored in the branch software warehouse database.
9. The high-security software distribution system according to claim 5, characterized in that: The software installation and uninstallation process of the system includes: software installation process and software uninstallation process, among which: Software installation process: The user accesses the branch software warehouse of the branch server to which the terminal device belongs on the terminal device and downloads the software to the local computer. The software is automatically decrypted during the download process. When the user installs the software, the terminal management and control software client on the terminal device automatically sends an installation request to the terminal management and control software server of the branch server. The terminal management and control software server calculates the hash value of the software and allows the installation if it is consistent with the hash value synchronized with the branch software warehouse service. Otherwise, it is intercepted and the interception message is synchronized to the branch software warehouse service. Software uninstallation process: There are two situations in which terminal devices uninstall: the user actively uninstalls or the terminal device is infected with a Trojan program and then maliciously uninstalls the software; in either case, when the terminal device uninstalls the software, the terminal control software client on the terminal device automatically sends an uninstall request to the terminal control software server. The terminal control software server determines that if the file still exists in the branch software warehouse, it will intercept the uninstallation operation. If the uninstallation operation is manually released on the terminal control software server, the operator's identity identification code needs to be entered at this time.
10. The high-security software distribution system according to claim 5, characterized in that: The terminal device software management process of the system includes: terminal device software collection, installation and uninstallation record display and running software display; among which, Terminal device software collection: The terminal control software client on the terminal device regularly collects the software installed on the local machine and provides feedback to the terminal control software server on the branch server. After receiving the feedback, the terminal control software server writes it into the database maintained by the terminal control software server and displays it to the administrator; Installation and uninstallation record display: For each installation and uninstallation operation on the terminal device, the terminal control software server will record it, write it into the database maintained by the terminal control software server, and display it to the administrator. When installing software that is not in the software warehouse, the installed software will also be recorded and an alert will be sent to the administrator; Display of running software: The terminal management software client automatically collects the programs running on the terminal device, reports them to the terminal management software server, and displays them to the administrator. For software that must be run on the terminal device, if it is detected that it is not running, the terminal management software server will issue an alarm to prevent users from stopping important software, which may cause the terminal device to be infected with viruses or information loss.