Software management and control information processing method and device, storage medium and electronic device

Abstract

The embodiment of the invention provides a software control information processing method and device, a storage medium and an electronic device.The method comprises the steps that target software control information issued by a target desktop virtual machine is received, and the target software control information is software control information corresponding to target controlled software to be controlled; generating a target management and control strategy rule according to the target software management and control information, and writing the target management and control strategy rule into a target strategy file; and importing the target strategy file into a target operating system of the target desktop virtual machine by calling a target interface, so that the target operating system determines whether an operation instruction received by the target operating system is allowed to be executed or not according to the target strategy file, the target interface is an interface which is provided in the target operating system and is used for importing a decision file.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communications, and specifically, to a method and device for processing software control information, a storage medium, and an electronic device. Background Art

[0002] Cloud computers are a new model that replaces traditional computers under the background of cloud computing technology. In this model, the operating resources required by users, such as central processing units, memory, hard disks, etc., are all virtualized in the back-end server. Cloud computers based on the trusted operating system, that is, the trusted operating system is installed in the virtual machine of the server. In the cloud computer mode, there will be multiple virtual machines on the same server, and different users can download and install software at will using different virtual machines, which affects the stability of the system. Therefore, the method for processing software control information in the relevant technology has the problem of poor control over the software in the cloud computer virtual machine. Summary of the invention

[0003] The embodiments of the present application provide a method and device for processing software control information, a storage medium and an electronic device, so as to at least solve the problem that the method for processing software control information in the related art has poor control capability over the software in the cloud computer virtual machine.

[0004] According to one embodiment of the present application, a method for processing software control information is provided, including: receiving target software control information issued to a target desktop virtual machine, wherein the target software control information is software control information corresponding to the target controlled software to be controlled; generating target control policy rules according to the target software control information, and writing the target control policy rules into a target policy file; importing the target policy file into a target operating system of the target desktop virtual machine by calling a target interface, so that the target operating system determines whether to allow execution of an operation instruction received by the target operating system according to the target policy file, wherein the target interface is an interface provided in the target operating system for importing a decision file.

[0005] According to another embodiment of the present application, a software control information processing device is provided, including: a receiving unit, used to receive target software control information issued to a target desktop virtual machine, wherein the target software control information is software control information corresponding to the target controlled software to be controlled; a first execution unit, used to generate target control policy rules according to the target software control information, and write the target control policy rules into a target policy file; an importing unit, used to import the target policy file into a target operating system of the target desktop virtual machine by calling a target interface, so that the target operating system determines whether to allow the execution of the operation instructions received by the target operating system according to the target policy file, wherein the target interface is an interface provided in the target operating system for importing decision files.

[0006] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the steps in the above embodiment when running.

[0007] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in the above embodiment.

[0008] In the above-mentioned embodiment of the present application, by automatically generating a software control policy file based on the received software control information, and controlling the relevant operation instructions in the operating system according to the software control policy file, the problem of poor control capability of the software in the cloud computer virtual machine in the software control information processing method in the related technology is solved, thereby achieving the effect of improving the control capability of the software in the cloud computer virtual machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a hardware structure block diagram of a computer terminal according to an embodiment of the present application;

[0010] Figure 2 is a flowchart of an optional method for processing software control information according to an embodiment of the present application;

[0011] Figure 3 is a schematic diagram of an optional method for processing software control information according to an embodiment of the present application;

[0012] Figure 4 is a schematic diagram of another optional method for processing software control information according to an embodiment of the present application;

[0013] Figure 5is a flowchart of another optional method for processing software control information according to an embodiment of the present application;

[0014] Figure 6 is a schematic diagram of another optional method for processing software control information according to an embodiment of the present application;

[0015] Figure 7 is a flowchart of another optional method for processing software control information according to an embodiment of the present application;

[0016] Figure 8 It is a structural block diagram of an optional software control information processing device according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0018] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0019] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal and a server or a similar computing device. Taking running on a server as an example, Figure 1 : is a hardware structure block diagram of the server of the embodiment of the present application. Figure 1 As shown, the server may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the server may also include a transmission device 106 and an input / output device 108 for communication functions. A person skilled in the art will understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0020] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as computer programs for implementing the steps of the scheme in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, that is, implementing the above-mentioned method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0021] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of a computer terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a server so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0022] It should be noted that in the embodiment of the present application, the mobile terminal of the operation method embodiment may also include the above-mentioned functional components.

[0023] In this embodiment, a method for processing software management and control information is provided, and the method can be run on the server of the above structure. Figure 2 is a flowchart of an optional method for processing software control information according to an embodiment of the present application, such as Figure 2 As shown, the process includes the following steps:

[0024] Step S202: receiving target software control information issued to a target desktop virtual machine, wherein the target software control information is software control information corresponding to the target controlled software to be controlled.

[0025] The method for processing software control information in this embodiment can be applied to the scenario of software control in a cloud computer based on a target operating system. The target operating system here can be a multi-user network operating system, such as a Linux operating system (an operating system based on the Linux kernel). Cloud computers are a new model that replaces traditional computers in the context of cloud computing technology. In this mode, the operating resources required by users, such as central processing units, memory, hard disks, etc., are all virtualized in the back-end server. A cloud computer based on a target operating system is one that installs the target operating system in a virtual machine on a server.

[0026] In recent years, under the increasingly severe internal and external environment, the call for domestic substitution has become louder and louder. At the same time, the country has launched a new infrastructure strategy for information technology innovation and application (abbreviated as "Innovation and Application"). After several years of development, relatively mature domestic operating systems based on the Linux kernel, such as Tongxin and Kylin, have emerged in the operating system field. While the Xinchuang operating system has developed rapidly, it has also provided huge development prospects for cloud computers based on the Linux operating system.

[0027] The cloud computer system usually consists of three parts: client, server and desktop virtual machine. Among them, the client is responsible for initiating a login request to the server, and the server verifies the login account. After the verification, a desktop virtual machine is allocated to the corresponding login user, and the connection parameters of this virtual machine are returned to the client. The client can establish a direct link with the corresponding desktop virtual machine through the returned connection parameters. After the connection is successful, the corresponding desktop virtual machine can be operated. The server usually runs a login management module, a virtual machine management module, etc. The login management module manages user information and login verification; the virtual machine management module is responsible for managing the desktop virtual machine, including the creation, deletion, start, stop, etc. of the desktop virtual machine, and is also responsible for managing the running status of the virtual machine. The desktop virtual machine is an independent system running on the server. The client can establish a connection with it and operate the desktop virtual machine through the established link. Usually, some preset modules can also be deployed on the desktop virtual machine, through which the desktop can be controlled.

[0028] However, in the cloud computer mode, there will be multiple virtual machines on the same server, and different users can download and install software at will using different virtual machines, which affects the stability of the system. At present, the existing software control method for the Linux operating system is generally to manually search and find the program or process information to be controlled, and manually modify the policy files of the kernel security module of the operating system (such as apparmor (an application access control system), selinux (a security subsystem), etc.) as a system administrator. However, the rules of the security module policy file are very complicated and prone to errors, requiring a relatively deep technical background. In addition, software control can be easily circumvented by modifying the operating system startup items. In addition, users cannot know which software is listed as controlled software, which software is allowed to be used, whether the controlled software has been installed in the system, and how to uninstall the controlled software. The above factors lead to the lack or even loss of software control capabilities of cloud computers based on the Linux operating system in some specific application scenarios (such as home, education, government and enterprises, etc.).

[0029] In order to at least partially solve the above problems, in this embodiment, a software control application can be installed in the target operating system to automatically generate a policy file based on the received software control information, and automatically import the policy file into the relevant preset module for software control (such as the aforementioned kernel security module) to control the relevant operations on the cloud computer according to the policy file. There is no need to manually modify or edit the policy file, which avoids the situation where the policy file cannot take effect in the relevant cloud computer due to errors in modification or editing. In addition, the relevant preset module for software control is built into the operating system kernel and does not support user-defined configuration, which can prevent users from circumventing software control by modifying system startup items or policy files.

[0030] In this embodiment, the target software control information issued to the target desktop virtual machine may be received by the software control application. Here, the target software control information may be software control information corresponding to the target controlled software to be controlled, and may be control information set by the target object (e.g., operation and maintenance personnel), and may include but is not limited to software control rule types, controlled software information, software control methods, etc. The target desktop virtual machine is the aforementioned cloud computer virtual machine.

[0031] Step S204: generating target control policy rules according to the target software control information, and writing the target control policy rules into a target policy file.

[0032] According to the received target software control information, the target control policy rules can be automatically generated. In order for the target control policy rules to run normally, the target control policy rules need to be written into the target policy file. The target policy file can be the / etc / app-guard / sec-policy file.

[0033] Step S206, by calling the target interface, the target policy file is imported into the target operating system of the target desktop virtual machine, so that the target operating system determines whether to allow the execution of the operation instructions received by the target operating system according to the target policy file, wherein the target interface is an interface provided in the target operating system for importing decision files.

[0034] In order to make the target policy file effective, the target policy file can be imported into the target operating system of the target desktop virtual machine, so that the target operating system determines whether to allow the execution of the operation instruction received by the target operating system according to the target policy file. The import method can be to call the interface provided in the target operating system for importing the decision file (i.e., the file for determining whether to allow the execution of the operation instruction received by the target operating system), that is, the target interface (corresponding to the aforementioned / etc / app-guard / sec-policy file, the policy import command can be APPGuardimport / etc / app-guard / sec-policy).

[0035] Optionally, determining whether to allow the execution of the operation instruction received by the target operating system according to the target policy file may be performed by a kernel security module in the target operating system. Correspondingly, the above-mentioned target interface may be an interface provided by the kernel security module, and importing the target policy file into the target operating system of the target desktop virtual machine may refer to importing the target policy file into the kernel security module in the target operating system of the target desktop virtual machine.

[0036] In this embodiment, each desktop virtual machine can have an operating system, such as Figure 3As shown, a software control module may be provided inside the corresponding operating system, and the software control module may include a kernel security module and a software control application. The software control application may be a system service-level application, which may receive software control information issued by the management end system (i.e., the management end server), automatically generate the control policy file required by the kernel security module and import the kernel security module to make the policy effective, and may also automatically collect the feature information of the installed software in the virtual machine and report it to the management end system, so as to provide a more convenient rule setting operation for the operation and maintenance personnel. The kernel security module may be a security module built into the kernel of the operating system, which may be used to monitor the process creation, call operation and disk I / O (operation of the interface circuit connecting the device to the CPU) operation of the operating system. When the relevant operation is triggered, it is matched with the policy file imported by the software control application. If it matches the software feature, file or directory information in the policy file, if it is a blacklist software, the corresponding operation is intercepted and a notification message is sent to the software control application, and the software control application then gives the user relevant prompt information through the user interface; if it is a whitelist, it is directly released. The user interface may provide functions such as displaying a list of control software, uninstalling blacklist software with one click, and reminding the control software to be forced to close.

[0037] The above management end system can be a server independent of the server corresponding to the desktop virtual machine. Figure 3 As shown, in the management end system, there can be a software feature statistics module, a rule setting module and a rule delivery module. The software feature statistics module can be used to collect software feature information required for software control, including but not limited to process name, executable file hash value, and installation path (software feature information can also include but not limited to software name, process name, installation path, and executable file hash value). The source of feature information mainly includes client application reporting, extraction from software installation packages, and search in resource managers. The rule setting module (i.e., a module for setting software control information) can be used by operation and maintenance personnel to set software control information such as software control rule types, controlled software lists (which can be composed of multiple controlled software information), and software control methods. The rule delivery module can be used to deliver the software control information set by the operation and maintenance personnel to the software control application module of the cloud computer virtual machine. By reclaiming the system user's custom setting permissions for installation strategies and module functions, the risk of advanced users circumventing software control during the use of cloud computers is eliminated, and the security and stability of cloud computer software control application scenarios are improved.

[0038] For example, Figure 4As shown, the operation and maintenance personnel set the control mode and control rule type through the management end system software control setting page, fill in the basic information of the control rule and select the software list that needs to be controlled, and select the desktop virtual machine list to which the control rule needs to be issued (that is, to which specific user desktop it is issued). The software control application periodically queries the software control rule list and determines whether the rule list has changed based on the modification timestamp. If there is any modification, the software control rule list is parsed, the kernel security module policy file is generated and written to the specified path. Call the policy import command provided by the kernel security module to import the policy file content to make it effective. The kernel security module monitors the I / O operations and process call operations of the operating system, makes decisions on related actions, and displays relevant reminders on the user interface.

[0039] Through the above steps S202 to S206, the target software control information issued to the target desktop virtual machine is received, wherein the target software control information is the software control information corresponding to the target controlled software to be controlled; target control policy rules are generated according to the target software control information, and the target control policy rules are written into the target policy file; by calling the target interface, the target policy file is imported into the target operating system of the target desktop virtual machine, so that the target operating system determines whether to allow the execution of the operation instructions received by the target operating system according to the target policy file, wherein the target interface is an interface provided in the target operating system for importing decision files, which solves the problem that the software control information processing method in the related art has poor control capability of the software in the cloud computer virtual machine, and improves the control capability of the software in the cloud computer virtual machine.

[0040] In an exemplary embodiment, after receiving the target software management and control information issued for the target desktop virtual machine, the method further includes:

[0041] S11, writing the received target software control information into a software control rule list, wherein the software control rule list is used to record the software control information of each controlled software in a group of controlled software issued to the target desktop virtual machine;

[0042] S12, when it is determined that the software control rule list is updated according to the modification timestamp of the software control rule list, traverse the software control rule list in sequence to generate corresponding control policy rules according to the software control information of at least part of the controlled software in a group of controlled software, wherein at least part of the controlled software includes the target controlled software.

[0043] For the received target software control information, the software control application may write the received target software control information into the software control rule list. Here, the software control rule list may be used to record the software control information of each controlled software in a group of controlled software issued to the target desktop virtual machine.

[0044] Considering that the target software control information may include control information for modifying the existing control method of a group of controlled software, correspondingly, the software control rule list may record multiple control information of the same software. In this embodiment, it is possible to determine whether the software control rule list is updated according to the modification timestamp of the software control rule list, and if it is determined that the software control rule list is updated, the software control rule list may be traversed in sequence to generate corresponding control policy rules according to the software control information of at least part of the controlled software in the group of controlled software. The at least part of the controlled software here may include the target controlled software.

[0045] Optionally, the above-mentioned determining whether the software control rule list is updated according to the modification timestamp of the software control rule list may be performed by periodically querying the software control rule list, or may be triggered immediately after receiving the target software control information.

[0046] Through this embodiment, whether the software control rule list is updated is determined according to the modification timestamp of the software control rule list, and when it is determined that the software control rule list is updated, the generation of corresponding control policy rules is executed. This can avoid the situation where the same controlled software cannot quickly determine the latest software control information due to multiple different control information recorded in the software control rule list, thereby causing the corresponding policy file to not be generated in time, and can improve the efficiency of software control.

[0047] In an exemplary embodiment, before receiving the target software management and control information sent by the target desktop virtual machine of the target object, the method further includes:

[0048] S21, in response to the software control generation instruction, generating a set of software control information, wherein each piece of software control information in the set of software control information is software control information of a controlled software, and the set of software control information includes target software control information;

[0049] S22, sending a set of software control information to the software control application of each desktop virtual machine in a group of desktop virtual machines, so that the software control application of each desktop virtual machine generates a policy file corresponding to each software control information according to the set of software control information, wherein the group of desktop virtual machines includes the target desktop virtual machine.

[0050] The aforementioned target software control information may be generated in response to a software control generation instruction. In this embodiment, in response to a software control generation instruction, a set of software control information may be generated. Here, each piece of software control information in a set of software control information may be software control information of a controlled software. A set of software control information may include target software control information.

[0051] After generating a set of software control information, the set of software control information can be sent to the software control application of each desktop virtual machine in a set of desktop virtual machines, so that the software control application of each desktop virtual machine generates a policy file corresponding to each software control information according to the set of software control information. The set of desktop virtual machines here can include the aforementioned target desktop virtual machine.

[0052] The above-mentioned operation of generating software control information and sending it to the software control application of the corresponding desktop virtual machine can be performed in the aforementioned management end system. The above-mentioned software control generation instruction can be triggered after the operation and maintenance personnel set the corresponding control information in the rule setting module.

[0053] Through this embodiment, software control information is generated through software control generation instructions and sent to the software control application of the corresponding desktop virtual machine, which can effectively improve the generation efficiency of the software control policy file and reduce the complexity of the overall operation.

[0054] In an exemplary embodiment, generating a target control policy rule according to target software control information includes:

[0055] S31, determining the control rule type of the target controlled software and the software control method of the target controlled software according to the target software control information;

[0056] S32, generating a target control policy rule according to the control rule type of the target controlled software, the software control method of the target controlled software, and the object type of the user object of the target desktop virtual machine, wherein the target control policy rule is used to indicate the control rule type of the target controlled software, the software control method of the target controlled software, and the object type of the user object.

[0057] According to the target software control information, the control rule type of the target controlled software and the software control method of the target controlled software can be determined. When the target software control information is written into the software control rule list, the control rule type of the target controlled software and the software control method of the target controlled software can be obtained by parsing the software control rule list.

[0058] According to the control rule type of the target controlled software, the software control method of the target controlled software, and the object type of the user of the target desktop virtual machine, the target control policy rule can be generated. Correspondingly, the target control policy rule can be used to indicate the control rule type of the target controlled software, the software control method of the target controlled software, and the object type of the user.

[0059] Optionally, the object type of the user object of the above-mentioned target desktop virtual machine can be recorded in the software control rule list, which can be collected by the software feature statistics module in the management system and sent to the software control application, and recorded in the software control rule list by the software control application.

[0060] Through this embodiment, target control policy rules are generated according to the control rule type of the target controlled software, the software control method of the target controlled software, and the object type of the user of the target desktop virtual machine, thereby enriching the use scenarios of cloud computers such as home, education, and office, and expanding the application scope of this technology in the field of cloud computers.

[0061] In an exemplary embodiment, a target control policy rule is generated according to the control rule type of the target controlled software, the software control mode of the target controlled software, and the object type of the user object of the target desktop virtual machine, including:

[0062] S41, generating a target control policy rule including a rule type identifier corresponding to the control rule type of the target controlled software, a control method identifier corresponding to the software control method of the target controlled software, and an object type identifier corresponding to the object type of the use object;

[0063] Among them, the control rule type of the target controlled software includes one of the following: directory rule, name rule, hash rule, the software control method of the target controlled software includes one of the following: blacklist, whitelist, and the object type of the use object includes one of the following: the use object of non-home desktop virtual machine, the use object of a usage level of home desktop virtual machine.

[0064] When generating target control policy rules based on the control rule type, software control method and object type of the usage object, a target control policy rule can be generated that includes a rule type identifier corresponding to the control rule type of the target controlled software, a control method identifier corresponding to the software control method of the target controlled software, and an object type identifier corresponding to the object type of the usage object.

[0065] The identifiers corresponding to the control rule type, software control method and usage object may be different types of identifiers.

[0066] The control rule type of the above target controlled software may include one of the following: directory rule, name rule, hash rule. Directory rule may be identified by / a / b / c / *, name rule may be identified by software name, and hash rule may be identified by hash value of software executable file.

[0067] The software control method of the above-mentioned target controlled software may include one of the following: blacklist, whitelist. The blacklist may use deny as the keyword (identifier), and the whitelist may use allow as the keyword (identifier). The blacklist indicates that the software cannot be used on the desktop virtual machine, and the whitelist indicates that the software can be used on the desktop virtual machine.

[0068] The object type of the above-mentioned usage object may include one of the following: a user object of a non-home desktop virtual machine, a user object of a usage level of a home desktop virtual machine. A user object of a usage level of a home desktop virtual machine may include an ordinary object of a home desktop virtual machine, and other objects of a home desktop virtual machine (such as teenagers, elderly users, etc.). Different usage objects may be represented by different numbers. For example, 0 represents a non-home cloud computer user (i.e., a user object of a non-home desktop virtual machine); 1 represents an ordinary user of a home cloud computer (i.e., an ordinary object of a home desktop virtual machine); and 2 represents other users of a home cloud computer (i.e., other objects of a home desktop virtual machine). Correspondingly, based on the above-mentioned related identifiers, a rule with the syntax of / a / b / c / *|[appname]|[hash]:deny|allow:0|1|2 may be generated.

[0069] Through this embodiment, different identifiers are used in the generated control policy rules to distinguish different control rule types, software control methods and usage objects, which can improve the efficiency of the target control policy rules in directly determining relevant information, thereby improving the timeliness of software control.

[0070] In an exemplary embodiment, after importing the target policy file into the kernel security module of the target desktop virtual machine by calling the target interface, the method further includes:

[0071] S51, monitoring a target operation instruction corresponding to the target software on the operating system of the target desktop virtual machine through the kernel security module, wherein the target operation instruction is at least one of the following: a process creation instruction, a process call instruction, and a disk input / output I / O operation instruction;

[0072] S52, matching the target operation instruction with the target policy file to obtain a matching result corresponding to the target operation instruction;

[0073] S53: When the matching result corresponding to the target operation instruction indicates that there is a control policy rule matching the target operation instruction, determine whether to allow execution of the target operation instruction according to the control policy rule matching the target operation instruction.

[0074] In this embodiment, the kernel security module may monitor the operation instructions on the corresponding operating system, and match the monitored operation instructions with the policy file to determine whether to allow the operation instructions to be executed.

[0075] When a target operation instruction corresponding to the target software on the operating system of the target desktop virtual machine is monitored, the target operation instruction can be matched with the target policy file to obtain a matching result corresponding to the target operation instruction. Here, the target operation instruction can be at least one of the following: a process creation instruction, a process call instruction, and a disk input / output I / O operation instruction.

[0076] The monitoring method can be implemented through a hook function, which monitors the process creation, call operation and disk I / O operation of the operating system and matches them with the imported policy file to decide whether to intercept the process call or disk I / O operation.

[0077] When the matching result corresponding to the target operation instruction is used to indicate that there is a control policy rule matching the target operation instruction, it can be determined whether to allow the target operation instruction to be executed according to the control policy rule matching the target operation instruction.

[0078] Through this embodiment, the kernel security module on the operating system monitors the operation instructions on the operating system and matches them with relevant policy files to determine whether to allow the operation instructions to be executed, which can improve the efficiency of software management and control.

[0079] In an exemplary embodiment, matching the target operation instruction with the target policy file to obtain a matching result corresponding to the target operation instruction includes:

[0080] S61, matching the context information corresponding to the operation instruction, the object type of the user object of the target desktop virtual machine, and the control policy rules in the target policy file to obtain a matching result corresponding to the target operation instruction.

[0081] In order to improve the accuracy of the matching results, when matching the target operation instruction with the target policy file, the context information corresponding to the operation instruction and the object type of the object used by the target desktop virtual machine can be matched with the control policy rules in the target policy file to obtain the matching result corresponding to the target operation instruction. The context information here can refer to the context information of the message / event of the I / O operation or process call.

[0082] For example, Figure 5 As shown, the process of the kernel security module monitoring the I / O operations and process call operations of the operating system and making decisions on related actions may include the following steps:

[0083] Step S502: The user initiates a file access or software execution operation to the operating system through a desktop shortcut or a resource manager.

[0084] Step S504: the kernel security module monitors the I / O or process call message / event, and matches the execution context information, the current user type and the rules in the policy cache.

[0085] Step S506: The kernel security module makes a decision of allowing / denying based on the matching result in the previous step.

[0086] If the operation is allowed, it will be executed normally. If not allowed, the user interface will be notified to give the user relevant prompts.

[0087] Through this embodiment, the context information corresponding to the operation instruction, the object type of the user object of the target desktop virtual machine and the management and control policy rules in the target policy file are matched, so that the accuracy of the matching result can be improved.

[0088] In an exemplary embodiment, when the matching result corresponding to the target operation instruction is used to indicate that there is a control policy rule matching the target operation instruction, after determining whether to allow execution of the target operation instruction according to the control policy rule matching the target operation instruction, the method further includes:

[0089] S71, when it is determined that the target operation instruction is allowed to be executed according to the control policy rule matching the target operation instruction, performing a release operation on the target operation instruction;

[0090] S72, when it is determined to intercept the target operation instruction according to the control policy rule matching the target operation instruction, perform an interception operation on the target operation instruction.

[0091] According to the matching result, the kernel security module can make a decision to allow / reject the target operation instruction. In this embodiment, when it is determined that the target operation instruction is allowed to be executed according to the control policy rule matching the target operation instruction, the target operation instruction can be released, that is, the target operating system is allowed to execute the target operation instruction normally.

[0092] In the case where the target operation instruction is determined to be intercepted according to the control policy rules matching the target operation instruction, the target operation instruction can be intercepted. In addition, the display interface of the target desktop virtual machine (such as Figure 3 A notification indicating that the target operation instruction is not allowed to be executed is displayed on the user interface of the cloud computer virtual machine as shown, so as to give the user a relevant prompt.

[0093] Through this embodiment, the release or interception operation of the target operation instruction is determined according to the matching result between the operation instruction and the policy file, which can improve the security and stability of software management and control.

[0094] In an exemplary embodiment, after receiving the target software management and control information issued for the target desktop virtual machine, the method further includes at least one of the following:

[0095] S81, displaying a controlled software list through a display interface of the target desktop virtual machine, wherein the controlled software list is a list of controlled software corresponding to the target desktop virtual machine, and the controlled software corresponding to the target desktop virtual machine includes the target controlled software;

[0096] S82, displaying the uncontrolled software list through the display interface of the target desktop virtual machine, wherein the uncontrolled software list is a list of software that the operating system of the target desktop virtual machine is allowed to use;

[0097] S83, displaying the list of installed controlled software through the display interface of the target desktop virtual machine, wherein the list of installed controlled software is a list of controlled software installed in the operating system of the target desktop virtual machine.

[0098] In order to enhance the user experience, the display interface of the target desktop virtual machine may display at least one of the following information: a list of controlled software, a list of uncontrolled software, and a list of installed controlled software. Here, the display method may be to display in the form of a pop-up window.

[0099] The above-mentioned controlled software list may be a list of controlled software corresponding to the target desktop virtual machine. The controlled software corresponding to the target desktop virtual machine may include the target controlled software. The uncontrolled software list may be a list of software that the operating system of the target desktop virtual machine is allowed to use. The installed controlled software list may be a list of controlled software installed in the operating system of the target desktop virtual machine.

[0100] Through this embodiment, based on the relevant information displayed on the display interface of the target desktop virtual machine, the user can quickly know which software is listed as controlled software, which software is allowed to be used, whether the controlled software has been installed in the system and how to uninstall the controlled software, etc., thereby improving the user experience.

[0101] In an exemplary embodiment, after receiving the target software management and control information issued for the target desktop virtual machine, the method further includes:

[0102] S91, in response to a triggering operation performed on a software uninstall button in a display interface of a target desktop virtual machine, an uninstallation operation is performed on all controlled software installed in an operating system of the target desktop virtual machine.

[0103] Since the use of controlled software in the operating system of the target desktop virtual machine will be greatly restricted or even unusable, for the controlled software installed in the operating system of the target desktop virtual machine, while displaying the list of installed controlled software through the display interface of the target desktop virtual machine, a one-click uninstall function can be provided, that is, one-click uninstallation of all selected installed controlled software. Figure 6 As shown, when the display interface displays the list of installed controlled software in the form of a pop-up window, the one-click uninstall function can be provided by the pop-up window.

[0104] In this embodiment, in response to a trigger operation performed on a software uninstall button in a display interface of a target desktop virtual machine, an uninstall operation may be performed on all controlled software installed in an operating system of the target desktop virtual machine.

[0105] Through this embodiment, the one-click uninstall function can improve the efficiency of uninstalling the controlled software. At the same time, since the user does not need to uninstall the controlled software one by one, the user experience can be improved.

[0106] The following is an explanation of the method for processing software control information in the embodiment of the present application in conjunction with an optional example. In this optional example, the target operating system is a Linux operating system, and the target desktop virtual machine is a cloud computer virtual machine.

[0107] This optional example provides a cloud computer software control method, system and application technology solution based on the Linux operating system. The operation and maintenance personnel set the software control information on the management side, and the management side system sends the software control information to the cloud computer virtual machine. The software control application in the operating system kernel of the cloud computer virtual machine automatically generates a policy file based on the software control information and imports it into the kernel security module. The kernel security module monitors the process creation, call operation and disk I / O operation of the operating system through the hook function, and matches the imported policy file to decide whether to intercept the process call or disk I / O operation. The kernel security module does not support user-defined configuration, which can prevent users from circumventing software control by modifying system startup items or policy files. At the same time, combined with the software control application and user interface, the overall operation complexity can be reduced, the use scenarios of the cloud computer can be enriched, and the user experience effect can be improved.

[0108] like Figure 7 As shown, the process of the method for processing software control information in this optional example may include the following steps:

[0109] Step S702: The operation and maintenance personnel set software control information in the management end system.

[0110] Software control information includes software control method (blacklist or whitelist), software rule type, controlled software list, and cloud computer virtual machines corresponding to the controlled software.

[0111] Step S704: the software management and control application receives software management and control information.

[0112] Step S706, determining whether the software control rule list is updated.

[0113] The software control application periodically queries the software control rule list and determines whether the software control rule list has changed according to the modification timestamp. If yes, execute step S708, otherwise return to step S702.

[0114] Step S708: The software control application generates policy rules according to the software control information and writes them into a policy file.

[0115] Step S710: The software control application imports the policy file into the kernel security module to make it effective.

[0116] The kernel security module can monitor the I / O operations and process call operations of the operating system and make decisions on related actions.

[0117] Step S712: The user interface displays a list of controlled software, reminds whether controlled applications are installed, and provides a one-click uninstall function for installed controlled software.

[0118] Through this optional example, by reclaiming the system user's custom setting permissions for installation policies and module functions, the security and stability of cloud computer software management and control application scenarios based on the Linux operating system are improved. By combining software management applications and user interfaces, the overall operation complexity is reduced, the use scenarios of cloud computers are enriched, the application scope of this technology in the cloud computer field is expanded, and the user experience effect is improved.

[0119] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0120] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM (Read-Only Memory) / RAM (Random Access Memory), a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods of each embodiment of the present application.

[0121] According to another aspect of an embodiment of the present application, a software control information processing device for implementing the above-mentioned software control information processing method is also provided, and the software control information processing device can be applied to a smart device. Figure 8 is a structural block diagram of an optional software control information processing device according to an embodiment of the present application, such as Figure 8 As shown, the device may include:

[0122] The receiving unit 802 is used to receive the target software control information issued for the target desktop virtual machine, wherein the target software control information is the software control information corresponding to the target controlled software to be controlled;

[0123] The first execution unit 804 is connected to the receiving unit 802 and is used to generate a target control policy rule according to the target software control information and write the target control policy rule into a target policy file;

[0124] The import unit 806 is connected to the first execution unit 804, and is used to import the target policy file into the target operating system of the target desktop virtual machine by calling the target interface, so that the target operating system determines whether to allow the execution of the operation instructions received by the target operating system based on the target policy file, wherein the target interface is an interface provided in the target operating system for importing decision files.

[0125] It should be noted that the receiving unit 802 in this embodiment can be used to execute the above step S202, the first executing unit 804 in this embodiment can be used to execute the above step S204, and the importing unit 806 in this embodiment can be used to execute the above step S206.

[0126] Through the above-mentioned module, the target software control information issued to the target desktop virtual machine is received, wherein the target software control information is the software control information corresponding to the target controlled software to be controlled; the target control policy rules are generated according to the target software control information, and the target control policy rules are written into the target policy file; by calling the target interface, the target policy file is imported into the target operating system of the target desktop virtual machine, so that the target operating system determines whether to allow the execution of the operation instructions received by the target operating system according to the target policy file, wherein the target interface is an interface provided in the target operating system for importing decision files. The method for processing software control information in the related art has the problem of poor control capability of the software in the cloud computer virtual machine, and improves the control capability of the software in the cloud computer virtual machine.

[0127] In an exemplary embodiment, the above device further comprises:

[0128] A writing unit, configured to write the received target software control information into a software control rule list after receiving the target software control information issued for the target desktop virtual machine, wherein the software control rule list is used to record the software control information of each controlled software in a group of controlled software issued for the target desktop virtual machine;

[0129] A traversal unit is used to traverse the software control rule list in sequence when it is determined that the software control rule list is updated according to the modification timestamp of the software control rule list, so as to generate corresponding control policy rules according to the software control information of at least part of the controlled software in a group of controlled software, wherein at least part of the controlled software includes the target controlled software.

[0130] In an exemplary embodiment, the above device further comprises:

[0131] A generating unit, configured to generate a set of software control information in response to a software control generating instruction before receiving the target software control information sent by the target desktop virtual machine as the target object, wherein each piece of software control information in the set of software control information is software control information of a controlled software, and the set of software control information includes the target software control information;

[0132] A sending unit is used to send a set of software control information to the software control application of each desktop virtual machine in a group of desktop virtual machines, so that the software control application of each desktop virtual machine generates a policy file corresponding to each software control information according to the set of software control information, wherein the group of desktop virtual machines includes a target desktop virtual machine.

[0133] In an exemplary embodiment, the first execution unit includes:

[0134] A determination module, used to determine the control rule type of the target controlled software and the software control method of the target controlled software according to the target software control information;

[0135] A generation module is used to generate target control policy rules based on the control rule type of the target controlled software, the software control method of the target controlled software, and the object type of the user object of the target desktop virtual machine, wherein the target control policy rules are used to indicate the control rule type of the target controlled software, the software control method of the target controlled software, and the object type of the user object.

[0136] In an exemplary embodiment, the generation module includes:

[0137] A generation submodule, used to generate a target control policy rule including a rule type identifier corresponding to the control rule type of the target controlled software, a control method identifier corresponding to the software control method of the target controlled software, and an object type identifier corresponding to the object type of the use object;

[0138] Among them, the control rule type of the target controlled software includes one of the following: directory rule, name rule, hash rule, the software control method of the target controlled software includes one of the following: blacklist, whitelist, and the object type of the use object includes one of the following: the use object of non-home desktop virtual machine, the use object of a usage level of home desktop virtual machine.

[0139] In an exemplary embodiment, the above device further comprises:

[0140] A monitoring unit is used to monitor the target operation instruction corresponding to the target software on the operating system of the target desktop virtual machine through the kernel security module after importing the target policy file into the kernel security module of the target desktop virtual machine by calling the target interface, wherein the target operation instruction is at least one of the following: a process creation instruction, a process call instruction, and a disk input and output I / O operation instruction;

[0141] A matching unit, used to match the target operation instruction with the target policy file to obtain a matching result corresponding to the target operation instruction;

[0142] A determination unit is used to determine whether to allow execution of the target operation instruction according to the control policy rule matching the target operation instruction when a matching result corresponding to the target operation instruction indicates that there is a control policy rule matching the target operation instruction.

[0143] In an exemplary embodiment, the matching unit comprises:

[0144] The matching module is used to match the context information corresponding to the operation instruction, the object type of the user object of the target desktop virtual machine and the management and control policy rules in the target policy file to obtain a matching result corresponding to the target operation instruction.

[0145] In an exemplary embodiment, the above device further comprises:

[0146] a second execution unit, configured to, if the matching result corresponding to the target operation instruction indicates that there is a control policy rule matching the target operation instruction, determine whether to allow the target operation instruction to be executed according to the control policy rule matching the target operation instruction, and if it is determined that the target operation instruction is allowed to be executed according to the control policy rule matching the target operation instruction, perform a release operation on the target operation instruction;

[0147] The third execution unit is used to perform an interception operation on the target operation instruction when determining to intercept the target operation instruction according to the control policy rule matching the target operation instruction.

[0148] In an exemplary embodiment, the device further comprises at least one of the following:

[0149] A first display unit is used to display a controlled software list through a display interface of the target desktop virtual machine after receiving the target software control information issued for the target desktop virtual machine, wherein the controlled software list is a list of controlled software corresponding to the target desktop virtual machine, and the controlled software corresponding to the target desktop virtual machine includes the target controlled software;

[0150] A second display unit, configured to display the uncontrolled software list through a display interface of the target desktop virtual machine, wherein the uncontrolled software list is a list of software that the operating system of the target desktop virtual machine is allowed to use;

[0151] The third display unit is used to display the list of installed controlled software through the display interface of the target desktop virtual machine, wherein the list of installed controlled software is a list of controlled software installed in the operating system of the target desktop virtual machine.

[0152] In an exemplary embodiment, the above device further comprises:

[0153] The fourth execution unit is used to, after receiving the target software management and control information issued to the target desktop virtual machine, respond to the trigger operation performed on the software uninstall button in the display interface of the target desktop virtual machine, and perform an uninstall operation on all controlled software installed in the operating system of the target desktop virtual machine.

[0154] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the above modules as part of the device can be run in Figure 1 In the hardware environment shown, it can be implemented by software or by hardware, wherein the hardware environment includes a network environment.

[0155] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when executed.

[0156] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0157] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0158] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0159] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0160] Obviously, those skilled in the art should understand that the modules or steps of the above-mentioned embodiments of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0161] The above description is only the preferred embodiment of the present application and is not intended to limit the embodiments of the present application. For those skilled in the art, the embodiments of the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the embodiments of the present application shall be included in the protection scope of the embodiments of the present application.

Claims

1. A method for processing software control information, characterized in that: include: Receive target software control information issued for a target desktop virtual machine, wherein the target software control information is software control information corresponding to the target controlled software to be controlled; Generate a target control policy rule according to the target software control information, and write the target control policy rule into a target policy file; By calling the target interface, the target policy file is imported into the target operating system of the target desktop virtual machine, so that the target operating system determines whether to allow the execution of the operation instructions received by the target operating system based on the target policy file, wherein the target interface is an interface provided in the target operating system for importing decision files.

2. The method according to claim 1, characterized in that After receiving the target software control information issued by the target desktop virtual machine, the method further includes: Writing the received target software control information into a software control rule list, wherein the software control rule list is used to record the software control information of each controlled software in a group of controlled software issued to the target desktop virtual machine; When it is determined that the software control rule list is updated based on the modification timestamp of the software control rule list, the software control rule list is traversed in sequence to generate corresponding control policy rules based on the software control information of at least part of the controlled software in the group of controlled software, wherein the at least part of the controlled software includes the target controlled software.

3. The method according to claim 1, characterized in that Before receiving the target software control information sent by the target desktop virtual machine as the target object, the method further includes: In response to the software control generation instruction, a set of software control information is generated, wherein each piece of software control information in the set of software control information is software control information of a controlled software, and the set of software control information includes the target software control information; The set of software control information is sent to the software control application of each desktop virtual machine in a group of desktop virtual machines, so that the software control application of each desktop virtual machine generates a policy file corresponding to each software control information based on the set of software control information, wherein the group of desktop virtual machines includes the target desktop virtual machine.

4. The method according to claim 1, characterized in that: The generating of target control policy rules according to the target software control information includes: Determining the control rule type of the target controlled software and the software control method of the target controlled software according to the target software control information; The target control policy rule is generated according to the control rule type of the target controlled software, the software control method of the target controlled software, and the object type of the user object of the target desktop virtual machine, wherein the target control policy rule is used to indicate the control rule type of the target controlled software, the software control method of the target controlled software, and the object type of the user object.

5. The method according to claim 4, characterized in that The generating the target control policy rule according to the control rule type of the target controlled software, the software control mode of the target controlled software and the object type of the user object of the target desktop virtual machine includes: Generate the target control policy rule including a rule type identifier corresponding to the control rule type of the target controlled software, a control mode identifier corresponding to the software control mode of the target controlled software, and an object type identifier corresponding to the object type of the use object; Among them, the control rule type of the target controlled software includes one of the following: directory rule, name rule, hash rule, the software control method of the target controlled software includes one of the following: blacklist, whitelist, and the object type of the usage object includes one of the following: a usage object of a non-home desktop virtual machine, a usage object of a usage level of a home desktop virtual machine.

6. The method according to any one of claims 1 to 5, characterized in that After importing the target policy file into the kernel security module of the target desktop virtual machine by calling the target interface, the method further includes: The target operation instruction corresponding to the target software on the operating system of the target desktop virtual machine is monitored by the kernel security module, wherein the target operation instruction is at least one of the following: a process creation instruction, a process call instruction, and a disk input / output I / O operation instruction; Matching the target operation instruction with the target policy file to obtain a matching result corresponding to the target operation instruction; When the matching result corresponding to the target operation instruction is used to indicate that there is a control policy rule matching the target operation instruction, it is determined whether to allow the target operation instruction to be executed according to the control policy rule matching the target operation instruction.

7. The method according to claim 6, characterized in that The step of matching the target operation instruction with the target policy file to obtain a matching result corresponding to the target operation instruction includes: The context information corresponding to the operation instruction and the object type of the user object of the target desktop virtual machine are matched with the control policy rules in the target policy file to obtain a matching result corresponding to the target operation instruction.

8. The method according to claim 6, characterized in that In a case where the matching result corresponding to the target operation instruction is used to indicate that there is a control policy rule matching the target operation instruction, after determining whether to allow execution of the target operation instruction according to the control policy rule matching the target operation instruction, the method further includes: When it is determined that the target operation instruction is allowed to be executed according to the control policy rule matching the target operation instruction, performing a release operation on the target operation instruction; In a case where it is determined to intercept the target operation instruction according to the control policy rule matching the target operation instruction, an interception operation is performed on the target operation instruction.

9. The method according to any one of claims 1 to 5, characterized in that After receiving the target software control information issued to the target desktop virtual machine, the method further includes at least one of the following: Displaying a controlled software list through a display interface of the target desktop virtual machine, wherein the controlled software list is a list of controlled software corresponding to the target desktop virtual machine, and the controlled software corresponding to the target desktop virtual machine includes the target controlled software; Displaying the uncontrolled software list through the display interface of the target desktop virtual machine, wherein the uncontrolled software list is a list of software that the operating system of the target desktop virtual machine is allowed to use; The list of installed controlled software is displayed through the display interface of the target desktop virtual machine, wherein the list of installed controlled software is a list of controlled software installed in the operating system of the target desktop virtual machine.

10. The method according to any one of claims 1 to 5, characterized in that After receiving the target software control information issued by the target desktop virtual machine, the method further includes: In response to a trigger operation performed on a software uninstall button in a display interface of the target desktop virtual machine, an uninstall operation is performed on all controlled software installed in an operating system of the target desktop virtual machine.

11. A software control information processing device, characterized in that: include: A receiving unit, configured to receive target software control information issued for a target desktop virtual machine, wherein the target software control information is software control information corresponding to a target controlled software to be controlled; A first execution unit, configured to generate a target control policy rule according to the target software control information, and write the target control policy rule into a target policy file; An import unit is used to import the target policy file into the target operating system of the target desktop virtual machine by calling a target interface, so that the target operating system determines whether to allow the execution of the operation instructions received by the target operating system according to the target policy file, wherein the target interface is an interface provided in the target operating system for importing decision files.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the method described in any one of claims 1 to 10 when executed by a processor.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method described in any one of claims 1 to 10 is implemented.

Images