Patch update method and system based on WFP

Abstract

The present invention provides a patch update method and system based on WFP, wherein the method on the terminal device side includes: intercepting IP data packets received by the terminal device from the external network through an activated WFP module deployed in the terminal device; determining whether the IP data packet contains a target data packet for patch updates of the Windows system in the terminal device; if so, parsing the target data packet to extract the patch file and patch information; reporting the patch update content to a patch management server, so that the patch management server updates the patch library and provides the required patch files to an intranet server; the patch update content includes the patch file, patch information, and the Windows system version of the terminal device, and the intranet server is used to provide the Windows system patch update to the intranet terminal. This solution can timely and easily obtain the patch file to be updated, so as to provide the required patch files to the intranet terminal.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a patch updating method and system based on WFP. Background Art

[0002] Computer system updates are very frequent. To prevent vulnerabilities and other issues in the systems installed on terminals, Windows systems must be patched and updated promptly. Currently, some enterprises operating within intranet environments cannot access the internet for security reasons. This causes interruptions during system updates, leading to vulnerabilities and other security risks.

[0003] The traditional method for patching intranet terminals is to use web crawlers to obtain updated patch files from the external network. These files are then uploaded to the enterprise's intranet server, which then provides the updated patch files to the intranet terminals. However, this method is not only difficult to crawl, but also suffers from poor timeliness in obtaining patch files. Summary of the Invention

[0004] The embodiment of the present invention provides a patch updating method and system based on WFP, which can timely and easily obtain the patch files to be updated, so as to provide the required patch files for terminals deployed in the intranet.

[0005] In a first aspect, an embodiment of the present invention provides a patch update method based on WFP, which is applied to a terminal device, wherein a WFP module is deployed in the terminal device, and the method includes:

[0006] Intercepting IP data packets received by the terminal device from the external network through the activated WFP module;

[0007] Determine whether the received IP data packet contains a target data packet for a patch update of the Windows system in the terminal device; if so, parse the target data packet to obtain a patch file and patch information;

[0008] Report the patch update content to the patch management server so that the patch management server updates the patch library based on the patch update content, and then uses the updated patch library to provide the required patch files to the intranet server; the patch update content includes at least the patch file, patch information and the Windows system version of the terminal device, and the intranet server is used to provide Windows system patch updates for terminals deployed on the intranet.

[0009] In a possible implementation, determining whether the received IP data packet contains a target data packet for a patch update of the Windows system in the terminal device includes:

[0010] determining whether the IP data packet contains a target data packet for a patch update of the Windows system in the terminal device based on at least one of whether the IP data packet contains an IP address of a Microsoft server, whether the IP data packet contains an HTTP domain name of a Microsoft server, and whether the content of the IP data packet contains patch information; and / or,

[0011] After determining the first target data packet based on at least one of whether the IP address of the Microsoft server exists in the IP data packet, whether the HTTP domain name of the Microsoft server exists in the IP data packet, and whether patch information exists in the content of the IP data packet, subsequent target data packets are determined based on the data stream length specified by the protocol to which the IP data packet belongs.

[0012] In a possible implementation, the patch file parsing method includes:

[0013] sorting the multiple target data packets continuously intercepted by the WFP module according to TCP numbers to restore the TCP link;

[0014] The file in the TCP data stream corresponding to the TCP link is restored to obtain a patch file for patch updating of the Windows system in the terminal device.

[0015] In a possible implementation, before reporting the patch update content to the patch management server, the method further includes:

[0016] Determine whether the patch file needs to be reported to the patch management server, and if so, report the patch update content to the patch management server.

[0017] In a possible implementation, determining whether the patch file needs to be reported to the patch management server includes:

[0018] Calculating a hash value of the patch file, and sending the hash value and / or patch information to the patch management server, so that the patch management server determines whether the patch file is stored in the patch library based on the hash value and / or patch information;

[0019] When the reporting instruction sent by the patch management server is received, it is determined that the patch file needs to be uploaded to the patch management server.

[0020] In a second aspect, an embodiment of the present invention further provides a patch update method based on WFP, which is applied to a patch management server. The method includes:

[0021] Receive patch update content reported by multiple terminal devices; the patch update content includes at least a patch file, patch information, and the Windows system version of the corresponding terminal device; the patch file is obtained and reported by the corresponding terminal device when it detects that it is undergoing a Windows system patch update, and the patch file is parsed from an IP data packet intercepted by a WFP module deployed on the corresponding terminal device;

[0022] Perform a security check on the received patch file. If the check passes, update the preset patch library based on the received patch update content; the patch library includes patch files and patch information corresponding to the Windows system version;

[0023] In response to receiving a patch file download request sent by the intranet server, the target patch file requested for download is sent to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system patch updates for terminals deployed in the intranet.

[0024] In a possible implementation, before receiving the patch update contents respectively reported by the plurality of terminal devices, the method further includes:

[0025] receiving a hash value and / or patch information sent by the terminal device; the hash value is calculated by the terminal device for the patch file to be reported;

[0026] Based on the hash value and / or patch information, it is determined whether the patch file to be reported is stored in the patch library; if not, a reporting instruction is sent to the terminal device to instruct the terminal device to report patch update content including the patch file to be reported.

[0027] In a possible implementation, the plurality of terminal devices cover a plurality of different Windows system versions; and the patch library includes patch files and patch information corresponding to different Windows system versions.

[0028] In one possible implementation, the method further includes: establishing a patch whitelist, and updating the patch whitelist each time a patch update content reported by a terminal device is received; the patch whitelist includes a correspondence between different Windows system versions and patch information;

[0029] Before responding to the patch file download request sent by the intranet server, the method also includes: responding to the query request received by the intranet server and sending the patch whitelist list to the intranet server, so that the intranet server determines whether there is a patch file that needs to be updated based on the patch whitelist list and the patch installation status of the terminal deployed in the intranet, and requests to download the patch file that needs to be updated; the patch installation status includes: the Windows system version corresponding to the terminal deployed in the intranet and the patch information of the currently installed patch file.

[0030] In a third aspect, an embodiment of the present invention further provides a patch update system based on WFP, comprising: a patch management server and a plurality of terminal devices; wherein each of the terminal devices is deployed with a WFP module;

[0031] Each terminal device is configured to intercept IP data packets received by the terminal device from an external network through an activated WFP module; determine whether the received IP data packets contain a target data packet for a patch update for the Windows system in the terminal device; if so, parse the target data packet to extract the patch file and patch information; and report the patch update content to a patch management server; the patch update content includes at least the patch file, patch information, and the Windows system version of the terminal device;

[0032] The patch management server is used to receive patch update content reported by multiple terminal devices respectively; perform a security check on the received patch files, and when the check passes, update the preset patch library according to the received patch update content; the patch library includes patch files and patch information corresponding to the Windows system version; in response to receiving a patch file download request sent by the intranet server, send the target patch file requested for download to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system patch updates for terminals deployed on the intranet.

[0033] In a fourth aspect, an embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0034] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in any embodiment of this specification.

[0035] An embodiment of the present invention provides a patch update method and system based on WFP. The WFP module deployed in the terminal device intercepts the IP data packets of the terminal device to monitor whether the terminal device is performing a patch update for the Windows system. When it is determined that the terminal device is performing a patch update for the Windows system, the patch file is parsed and reported to the patch management server. The patch management server updates the patch library to provide the required patch files to the intranet server, and the intranet server then provides the Windows system patch update for the terminal deployed on the intranet. It can be seen that in this solution, the patch files can be obtained by the WFP module during the security monitoring process of the terminal device with relatively low difficulty. Moreover, when the terminal device in the networked state is performing a patch update, the patch files of the patch update can be quickly updated to the patch library, so that the patch files in the patch library are the latest, thereby ensuring the timely acquisition of the patch files required by the intranet terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 This is a patch update system architecture diagram provided by an embodiment of the present invention;

[0038] Figure 2 This is a flow chart of a patch update method based on WFP provided by one embodiment of the present invention;

[0039] Figure 3 This is a flow chart of another WFP-based patch update method provided by one embodiment of the present invention;

[0040] Figure 4 This is a structural diagram of a WFP-based patch update system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0042] As mentioned above, obtaining updated patch files from the external network through web crawlers requires continuous web crawling to obtain the latest patch files in a timely manner. However, web crawlers are not only costly but also difficult to use. For example, network regulations may prohibit web crawlers. Therefore, there is no guarantee that the latest patch files can be crawled in a timely manner. If this is not achieved, the required patch files cannot be provided to terminals deployed on the intranet, affecting the security of intranet terminals.

[0043] Based on the above problems, the inventive concept of the present invention is to build a patch management server, use the WFP module in the terminal device to monitor the terminal device, and when the terminal device performs a patch update on the Windows system, obtain the patch file of the patch update and quickly update the patch library, so as to provide the required patch files for the terminals managed by the intranet server and ensure the security of the intranet terminals.

[0044] Based on the above concept, the system architecture of the embodiment of the present invention is described.

[0045] Please refer to Figure 1 One embodiment of the present invention provides a patch update system, comprising: a patch management server 10 and multiple terminal devices 20. The patch management server 10 can connect to each terminal device 20 when needed; each terminal device 20 can connect to a Microsoft server 50 when needed. The patch management server 10 can connect to an intranet server 30 when needed. The intranet server 30 is connected to multiple terminals 40 via an intranet. These terminals 40 are all deployed within the intranet environment.

[0046] The specific implementation process of the concept of the present invention will be described below with respect to the patch management server and the terminal device in the patch update system.

[0047] Please refer to Figure 2 , a WFP-based patch update method provided in one embodiment of the present invention is applied to a terminal device in which a WFP module is deployed; the method comprises:

[0048] Step 200: intercepting the IP data packet received by the terminal device from the external network through the activated WFP module.

[0049] The Windows Filtering Platform (WFP) module is a set of system services and application programming interfaces (APIs) in Microsoft operating systems. It provides a platform for creating network filtering applications. The API provided by WFP enables developers to write code that interacts with IP packet processing, which occurs at multiple layers in the operating system's network stack.

[0050] In the embodiment of the present invention, after the WFP module is activated, it can intercept all IP data packets on the IP layer of the terminal device and send the IP data packets to the application layer for processing.

[0051] Since the terminal device needs to establish a network connection when performing a patch update for the Windows system and download the patch file in the form of an IP data packet, in an embodiment of the present invention, the WFP module is used to intercept the IP data packet to determine whether the terminal device is performing a Windows system update by analyzing the intercepted IP data packet.

[0052] Step 202: Determine whether the received IP data packet contains a target data packet for patch updating of the Windows system in the terminal device; if so, parse the target data packet to obtain the patch file and patch information.

[0053] In an embodiment of the present invention, whether the terminal device is performing a patch update for the Windows system can be determined by determining whether there is a target data packet for patch update for the Windows system in the terminal device in the IP data packet. If so, it is determined that the terminal device is performing a patch update for the Windows system.

[0054] In one embodiment of the present invention, a method for determining whether a target data packet for a patch update of a Windows system in a terminal device exists in an IP data packet may be performed in at least one of the following ways:

[0055] Method 1: Determine whether the IP data packet contains a target data packet for patch updating of the Windows system in the terminal device, based on whether the IP data packet contains the IP address of the Microsoft server.

[0056] Method 2: Determine whether the IP data packet contains a target data packet for patch updating of the Windows system in the terminal device, based on whether the IP data packet contains the HTTP domain name of the Microsoft server.

[0057] Method 3: Determine whether the IP data packet contains a target data packet for patch updating of the Windows system in the terminal device, based on whether there is patch information in the content of the IP data packet.

[0058] Method 4: After determining the first target data packet using at least one of the above three methods, determine subsequent target data packets based on the data stream length specified by the protocol to which the IP data packet belongs.

[0059] Because terminal devices need to establish a connection with Microsoft servers to obtain patch files when performing Windows system patch updates, in Methods 1 and 2, the IP address and / or HTTP domain name of the Microsoft server can be pre-set. When the IP address and / or HTTP domain name in the IP packet is determined to be the IP address and / or HTTP domain name of the Microsoft server, it is determined that the IP packet contains the target data packet for the Windows system patch update on the terminal device.

[0060] In mode 3, the content of the IP data packet can be parsed to determine whether patch information exists in the parsed content. If patch information exists, it is determined that the IP data packet contains a target data packet for patch updating of the Windows system in the terminal device.

[0061] It should be noted that in the above-mentioned method 1 or method 2, when it is determined that the IP address in the IP data packet is the IP address of the Microsoft server or the HTTP domain name is the HTTP domain name of the Microsoft server, method 3 can be further used to determine whether patch information exists in the content of the IP data packet, so as to determine whether the IP data packet contains the target data packet for the patch update of the Windows system in the terminal device, thereby further improving the determination accuracy.

[0062] In method 4, since the data transmission protocol has regulations on the length of the transmitted data stream, after the first target data packet is determined using any of the above three methods, if the length of the first target data packet does not reach the data stream length specified by the protocol to which the IP data packet belongs, the subsequent IP data packets also have target data packets. Therefore, the determination of the subsequent target data can be determined based on the data stream length specified by the protocol to which the IP data packet belongs, thereby improving the determination speed of the target data packet.

[0063] Regardless of which of the above methods is used to determine whether the target data packet exists in the IP data packet, if it is determined that the IP data packet does not contain the target data packet for the patch update of the Windows system in the terminal device, the IP data packet will not be processed; if it is determined that the IP data packet contains the target data packet for the patch update of the Windows system in the terminal device, the patch file and patch information will be parsed from the target data packet.

[0064] Furthermore, the patch file parsing method may include: sorting multiple target data packets continuously intercepted by the WFP module according to TCP numbers to restore the TCP link; restoring the file in the TCP data stream corresponding to the TCP link to obtain a patch file for patch updating of the Windows system in the terminal device.

[0065] Because the patch file is sent by multiple target packets, and the TCP numbers within the target packets may be discontinuous, to restore the TCP connection, it is necessary to sort the multiple intercepted target packets by TCP number. After restoring the TCP connection, the corresponding TCP data stream can be obtained and the patch file can be obtained through file recovery.

[0066] It should be noted that the patch information can also be parsed from the header of the target data packet. In the embodiment of the present invention, the patch information may include: the operating system to which the patch belongs, the patch list, hardware information and drivers, patch acquisition channels, and official patch file information.

[0067] Step 204: Report the patch update content to the patch management server so that the patch management server updates the patch library based on the patch update content, and then uses the updated patch library to provide the required patch files to the intranet server; the patch update content at least includes the patch file, patch information and the Windows system version of the terminal device, and the intranet server is used to provide Windows system patch updates for terminals deployed on the intranet.

[0068] After obtaining the patch file, it needs to be reported to the patch management server in a timely manner to ensure the timely update of the patch file.

[0069] Considering that the patch management server is connected to multiple terminal devices, the patch management server may have obtained the patch file reported by other terminal devices. In order to prevent repeated reporting of patch files and waste of resources during the reporting process, in one embodiment of the present invention, before step 204, it can also include: determining whether the patch file needs to be reported to the patch management server, and if so, executing step 204.

[0070] In one implementation, it is possible to determine whether the corresponding patch file has been stored in the patch library of the patch management server by reporting patch information.

[0071] In another implementation, it may be possible to determine whether the corresponding patch file is already stored in the patch library of the patch management server by reporting a hash value.

[0072] The method of reporting the hash value may specifically include: calculating the hash value of the patch file, and sending the hash value to the patch management server, so that the patch management server determines whether the patch file is stored in the patch library based on the hash value; when receiving the reporting instruction sent by the patch management server, determining that the patch file needs to be uploaded to the patch management server.

[0073] The patch management server can pre-calculate a hash value for each stored patch file, creating a hash value list. Whenever a reported hash value is received, it is compared against the hash value list. If the reported hash value is included in the hash value list, it indicates that the patch file is already stored in the patch library; otherwise, it indicates that the patch file is not stored in the patch library. Using hash values ​​not only uniquely identifies patch files but also reduces the amount of data transmitted.

[0074] Since there are many Windows system versions on terminal devices, the types of patch files are complex, and the Windows system version corresponds to the patch file, when reporting the patch file, the Windows system version of the terminal device needs to be reported together.

[0075] Among them, the Windows system version can be Windows XP, Windows Vista, Windows 7, Windows 8 / Windows 8.1, Windows 10, Windows 11, etc.

[0076] In an embodiment of the present invention, when a terminal device monitors itself by using IP data packets intercepted by a WFP module to perform a patch update on its Windows system, the terminal device parses the patch file used for the patch update and reports it to the patch management server, thereby enabling rapid updating of the patch library, thereby enabling the patch management server to provide the required patch files to the intranet server, and then the intranet server provides Windows system patch updates to the terminals deployed on the intranet, thereby ensuring timely acquisition of the patch files required by the intranet terminals.

[0077] Please refer to Figure 3 , a patch update method based on WFP provided in one embodiment of the present invention, applied to a patch management server, the method comprising:

[0078] Step 300, receiving patch update content reported by multiple terminal devices respectively; the patch update content includes at least patch files, patch information and the Windows system version of the corresponding terminal device; the patch files are obtained and reported by the corresponding terminal device when it detects that it is performing a patch update on the Windows system.

[0079] In one implementation, the patch file is obtained by parsing an IP data packet intercepted by a WFP module deployed on a corresponding terminal device.

[0080] The patch information may include: the operating system to which the patch belongs, a patch list, hardware information and drivers, how to obtain the patch, and official information about the patch file.

[0081] Since there are many Windows system versions on terminal devices, the types of patch files are complex, and the Windows system version corresponds to the patch file, when reporting the patch file, the file information of the patch file and the Windows system version of the terminal device need to be reported together.

[0082] Among them, the Windows system version can be Windows XP, Windows Vista, Windows 7, Windows 8 / Windows 8.1, Windows 10, Windows 11, etc.

[0083] In this embodiment of the present invention, to ensure timely patch file acquisition, the terminal device parses the target IP packet intercepted by the WFP module upon determining that the packet contains a target packet for a Windows system patch update. This ensures that the terminal device reports the patch file almost immediately upon detecting that the Windows system patch is being updated, thereby ensuring timely patch file acquisition.

[0084] In one embodiment of the present invention, since the patch management server is connected to multiple terminal devices, any terminal device can report the patch file to the patch management server when performing a patch update for the Windows system. In order to prevent repeated reporting of patch files and waste of resources during the reporting process, this step may include: receiving a hash value and / or patch information sent by the terminal device; the hash value is calculated by the terminal device for the patch file to be reported; determining whether the patch file to be reported is stored in the patch library based on the hash value and / or patch information, and if not, sending a reporting instruction to the terminal device to instruct the terminal device to report the patch update content containing the patch file to be reported.

[0085] When using the hash value method to determine whether the patch library stores the patch file to be reported, specifically, the patch management server can pre-calculate the hash value for each stored patch file to form a hash value list. Whenever a reported hash value is received, it is compared with the hash value list. If the hash value list includes the reported hash value, it indicates that the patch library has stored the patch file to be reported; otherwise, it indicates that the patch library has not stored the patch file to be reported.

[0086] When using patch information to determine whether the patch library stores the patch file to be reported, specifically, the patch management server can compare the received patch information with the patch information stored in the patch library. If the patch information exists in the patch library, it indicates that the patch file to be reported has been stored in the patch library; otherwise, it indicates that the patch file to be reported is not stored in the patch library.

[0087] In one embodiment of the present invention, since terminals in an enterprise intranet may use different Windows system versions, in order to ensure the comprehensiveness of patch files in the patch library and to be able to provide the required patch files for terminals with different Windows system versions, multiple terminal devices connected to the patch management server can cover multiple different Windows system versions; the patch library includes patch files and patch information corresponding to different Windows system versions.

[0088] For example, the Windows system versions that need to be covered are Windows XP, Windows Vista, Windows 7, Windows 8 / Windows 8.1, Windows 10, and Windows 11. Then, for each of the above Windows system versions, at least one terminal device among the multiple terminal devices connected to the patch management server must have a Windows system of the corresponding covered Windows system version.

[0089] Step 302: Perform a security check on the received patch file. If the check passes, update the preset patch library according to the received patch update content. The patch library includes patch files and patch information corresponding to the Windows system version.

[0090] Since the patch management server needs to provide the required patch files to the intranet servers of different enterprises, it needs to ensure the security of the provided patch files. Therefore, after receiving the patch update content, the patch file can be checked for security to determine whether it is safe and legal.

[0091] In one implementation, the system can connect to external threat intelligence centers and various antivirus engines to perform security checks on patch files.

[0092] Step 304, in response to receiving the patch file download request sent by the intranet server, the target patch file requested for download is sent to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system patch updates for terminals deployed in the intranet.

[0093] An intranet server is deployed within an enterprise to provide Windows system patch updates to terminals deployed on the intranet. A patch management server provides services for the intranet server, allowing it to download required patch files.

[0094] To improve user experience and ensure timely patch updates for intranet terminals, one embodiment of the present invention may also include: establishing a patch whitelist, which is updated each time a patch update is received from a terminal device; the patch whitelist includes a mapping between different Windows system versions and patch information. The patch whitelist may include only the latest patch information for the same Windows system version, or it may include both the latest patch information and historical patch information, for selection by the intranet server.

[0095] Before responding to the patch file download request sent by the intranet server, the method also includes: responding to the query request received by the intranet server and sending the patch whitelist list to the intranet server, so that the intranet server determines whether there is a patch file that needs to be updated based on the patch whitelist list and the patch installation status of the terminal deployed in the intranet, and requests to download the patch file that needs to be updated; the patch installation status includes: the Windows system version corresponding to the terminal deployed in the intranet and the patch information of the currently installed patch file.

[0096] Specifically, the intranet server can obtain the patch installation status of the intranet terminal in advance and determine whether there is a patch file that needs to be updated based on the received patch whitelist. The patch file that needs to be updated can be a patch file corresponding to the latest patch information or a patch file corresponding to historical patch information.

[0097] When the intranet server determines that there is a patch file that needs to be updated, it sends a patch file download request to the patch management server. The patch file download request carries the Windows system version and patch information.

[0098] In the embodiment of the present invention, the intranet server may periodically send a query request to the patch management server to determine whether there is a patch file that needs to be updated.

[0099] Furthermore, the patch management server can also classify patch files according to the urgency. When the urgency meets the set conditions, the corresponding patch files can be directly sent to the intranet server so that the intranet server can provide Windows system patch updates to the intranet terminals in a timely manner to ensure the security of the intranet terminals.

[0100] In addition, after obtaining the patch file that needs to be updated, the intranet server can control the intranet terminals to perform patch updates within an appropriate time period.

[0101] In an embodiment of the present invention, the patch management server updates the patch library through the patch update content reported by the terminal device, so that the patch library can provide the required patch files to the intranet server in a timely manner. In turn, the intranet server can provide Windows system patch updates to the terminals deployed on the intranet, thereby ensuring the security of the terminals on the intranet.

[0102] like Figure 4 As shown, an embodiment of the present invention further provides a patch update system based on WFP, comprising: a patch management server 401 and multiple terminal devices 402; wherein each of the terminal devices 402 is deployed with a WFP module;

[0103] Each terminal device 402 is configured to intercept IP data packets received by the terminal device from an external network through an activated WFP module; determine whether the received IP data packets contain a target data packet for a patch update of the Windows system in the terminal device; if so, parse the target data packet to extract the patch file and patch information; and report the patch update content to a patch management server; the patch update content includes at least the patch file, patch information, and the Windows system version of the terminal device;

[0104] The patch management server 401 is used to receive patch update content reported by multiple terminal devices respectively; perform a security check on the received patch files, and when the check passes, update the preset patch library according to the received patch update content; the patch library includes patch files and patch information corresponding to the Windows system version; in response to receiving a patch file download request sent by the intranet server, the target patch file requested for download is sent to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system patch updates for terminals deployed on the intranet.

[0105] In one embodiment of the present invention, when a terminal device determines whether a received IP data packet contains a target data packet for a patch update of a Windows system in the terminal device, the terminal device is specifically configured to: determine whether the IP data packet contains a target data packet for a patch update of a Windows system in the terminal device based on at least one of whether the IP data packet contains an IP address of a Microsoft server, whether the IP data packet contains an HTTP domain name of a Microsoft server, and whether the content of the IP data packet contains patch information; and / or, after determining the first target data packet based on at least one of whether the IP data packet contains an IP address of a Microsoft server, whether the IP data packet contains an HTTP domain name of a Microsoft server, and whether the content of the IP data packet contains patch information, determine subsequent target data packets based on the data stream length specified by the protocol to which the IP data packet belongs.

[0106] In one embodiment of the present invention, a terminal device parses a patch file from a target data packet using the following patch file parsing method: multiple target data packets continuously intercepted by the WFP module are sorted according to TCP numbers to restore a TCP link; files in the TCP data stream corresponding to the TCP link are restored to obtain a patch file for patch updates of the Windows system in the terminal device.

[0107] In one embodiment of the present invention, the terminal device is further configured to determine whether the patch file needs to be reported to the patch management server, and if so, to report the patch update content to the patch management server.

[0108] In one embodiment of the present invention, when determining whether the patch file needs to be reported to the patch management server, the terminal device is specifically configured to: calculate a hash value of the patch file, and send the hash value and / or patch information to the patch management server; and upon receiving a reporting instruction sent by the patch management server, determine that the patch file needs to be uploaded to the patch management server;

[0109] The patch management server is further configured to receive the hash value and / or patch information sent by the terminal device, determine whether the patch file is stored in the patch library based on the hash value and / or patch information, and if not, send a reporting instruction to the terminal device.

[0110] In one embodiment of the present invention, the plurality of terminal devices cover a plurality of different Windows system versions; the patch library includes patch files and patch information corresponding to different Windows system versions.

[0111] In one embodiment of the present invention, the patch management server is also used to establish a patch whitelist list, and update the patch whitelist list whenever the patch update content reported by the terminal device is received; the patch whitelist list includes the correspondence between different Windows system versions and patch information; and in response to receiving a query request from the intranet server, the patch whitelist list is sent to the intranet server, so that the intranet server determines whether there is a patch file that needs to be updated based on the patch whitelist list and the patch installation status of the terminal deployed in the intranet, and requests to download the patch file that needs to be updated; the patch installation status includes: the Windows system version corresponding to the terminal deployed in the intranet and the patch information of the currently installed patch file.

[0112] An embodiment of the present invention further provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a WFP-based patch update method in any embodiment of the present invention is implemented.

[0113] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor executes a WFP-based patch update method according to any embodiment of the present invention.

[0114] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0115] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0116] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0117] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0118] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0119] It should be noted that, in this article, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical factors in the process, method, article or device comprising the elements.

[0120] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk, etc. Various media that can store program codes.

[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A patch update method based on WFP, characterized in that: Applied to a terminal device, wherein a WFP module is deployed in the terminal device, the method includes: Intercepting IP data packets received by the terminal device from the external network through the activated WFP module; Determine whether the received IP data packet contains a target data packet for a patch update of the Windows system in the terminal device; if so, parse the target data packet to obtain a patch file and patch information; Report the patch update content to the patch management server so that the patch management server updates the patch library based on the patch update content, and then uses the updated patch library to provide the required patch files to the intranet server; the patch update content includes at least the patch file, patch information and the Windows system version of the terminal device, and the intranet server is used to provide Windows system patch updates for terminals deployed on the intranet.

2. The method according to claim 1, characterized in that The determining whether the received IP data packet contains a target data packet for a patch update of the Windows system in the terminal device includes: determining whether the IP data packet contains a target data packet for a patch update of the Windows system in the terminal device based on at least one of whether the IP data packet contains an IP address of a Microsoft server, whether the IP data packet contains an HTTP domain name of a Microsoft server, and whether the content of the IP data packet contains patch information; and / or, After determining the first target data packet based on at least one of whether the IP address of the Microsoft server exists in the IP data packet, whether the HTTP domain name of the Microsoft server exists in the IP data packet, and whether patch information exists in the content of the IP data packet, subsequent target data packets are determined based on the data stream length specified by the protocol to which the IP data packet belongs.

3. The method according to claim 1, characterized in that The patch file parsing method includes: sorting the multiple target data packets continuously intercepted by the WFP module according to TCP numbers to restore the TCP link; The file in the TCP data stream corresponding to the TCP link is restored to obtain a patch file for patch updating of the Windows system in the terminal device.

4. The method according to claim 1, wherein Before reporting the patch update content to the patch management server, the method further includes: Determine whether the patch file needs to be reported to the patch management server, and if so, report the patch update content to the patch management server.

5. The method according to claim 4, characterized in that The determining whether the patch file needs to be reported to the patch management server includes: Calculating a hash value of the patch file, and sending the hash value and / or patch information to the patch management server, so that the patch management server determines whether the patch file is stored in the patch library based on the hash value and / or patch information; When the reporting instruction sent by the patch management server is received, it is determined that the patch file needs to be uploaded to the patch management server.

6. A patch update method based on WFP, characterized in that: Applied to a patch management server, the method includes: Receive patch update content reported by multiple terminal devices; the patch update content includes at least a patch file, patch information, and the Windows system version of the corresponding terminal device; the patch file is obtained and reported by the corresponding terminal device when it detects that it is undergoing a Windows system patch update, and the patch file is parsed from an IP data packet intercepted by a WFP module deployed on the corresponding terminal device; Perform a security check on the received patch file. If the check passes, update the preset patch library based on the received patch update content; the patch library includes patch files and patch information corresponding to the Windows system version; In response to receiving a patch file download request sent by the intranet server, the target patch file requested for download is sent to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system patch updates for terminals deployed in the intranet.

7. The method according to claim 6, characterized in that Before receiving the patch update contents reported by the plurality of terminal devices respectively, the method further includes: receiving a hash value and / or patch information sent by the terminal device; the hash value is calculated by the terminal device for the patch file to be reported; Based on the hash value and / or patch information, it is determined whether the patch file to be reported is stored in the patch library; if not, a reporting instruction is sent to the terminal device to instruct the terminal device to report patch update content including the patch file to be reported.

8. The method according to claim 6, characterized in that The multiple terminal devices cover multiple different Windows system versions; the patch library includes patch files and patch information corresponding to different Windows system versions.

9. The method according to claim 8, characterized in that The method also includes: establishing a patch whitelist, and updating the patch whitelist whenever patch update content reported by a terminal device is received; the patch whitelist includes a correspondence between different Windows system versions and patch information; Before responding to the patch file download request sent by the intranet server, the method also includes: responding to the query request received by the intranet server and sending the patch whitelist list to the intranet server, so that the intranet server determines whether there is a patch file that needs to be updated based on the patch whitelist list and the patch installation status of the terminal deployed in the intranet, and requests to download the patch file that needs to be updated; the patch installation status includes: the Windows system version corresponding to the terminal deployed in the intranet and the patch information of the currently installed patch file.

10. A patch update system based on WFP, characterized in that: include: A patch management server and multiple terminal devices; wherein each of the terminal devices is deployed with a WFP module; Each terminal device is configured to intercept IP data packets received by the terminal device from an external network through an activated WFP module; determine whether the received IP data packets contain a target data packet for a patch update for the Windows system in the terminal device; if so, parse the target data packet to extract the patch file and patch information; and report the patch update content to a patch management server; the patch update content includes at least the patch file, patch information, and the Windows system version of the terminal device; The patch management server is used to receive patch update content reported by multiple terminal devices respectively; perform a security check on the received patch files, and when the check passes, update the preset patch library according to the received patch update content; the patch library includes patch files and patch information corresponding to the Windows system version; in response to receiving a patch file download request sent by the intranet server, send the target patch file requested for download to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system patch updates for terminals deployed on the intranet.

11. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 5 or the method according to any one of claims 6 to 9 is implemented.

Images