Method for partitioning executable codes

Abstract

The invention discloses a method for partitioning executable codes, and aims to enable a second computer to recognize one or more character strings in information, one or more characters are added between any two characters, and the characters are not or cannot be converted into the executable codes. The plurality of characters cannot be combined with one or more of the preceding or following or preceding and following characters to form an executable code which is stored in a database of a second computer. The method has the advantage that the execution of malicious codes can be effectively reduced.

Description

Technical Field

[0001] This invention relates to the field of Internet / computer technology, and more particularly to a method for isolating executable code. Background Technology

[0002] In today's society, many companies and organizations have their own websites to publish information for customers and users to understand their information. However, such websites are vulnerable to hacker attacks, which can give hackers the opportunity to send executable code to the website's database, causing incalculable losses. Summary of the Invention

[0003] The purpose of this invention is to provide a method for isolating executable code, which can prevent the execution of executable code.

[0004] The first image acquisition device sends first data to the second computer, or the first image acquisition device processes the first data to generate second data, and then sends the second data to the second computer. The first data, the second data, or a portion of the first data or a portion of the second data are collectively referred to as information. The second computer can process the information using any of the following methods, and the result of the processing is called the first form of information processing; The first method: The second computer identifies one or more strings in the information, adds one or more characters between any two characters, the multiple characters are not or cannot be converted into executable code, the multiple characters cannot be combined with the preceding or following or preceding or following one or more characters to form executable code, and stores them in the database of the second computer; Stored in a database on a second computer; or, The second method involves storing one or more characters identified by the second computer in different storage areas of the second computer. or, The third method: After the second computer identifies a certain number of characters in a certain line of the information as needed, it stops identifying the unidentified characters in that line. Alternatively, a second computer may identify the content of the information. The fourth method: The second computer encrypts the content and stores it in the second computer; or, The fifth method: The second computer divides the content into multiple parts and stores them in different storage areas of the second computer; or, The sixth method: The second computer reorders the contents and stores them in the second computer; or, The seventh method: The second computer rearranges the content in order, divides it into multiple parts, and stores them in different storage areas of the second computer.

[0005] Advantages: If the information received by the database server contains executable code, this invention can effectively reduce the execution of the executable code. Attached Figure Description

[0006] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments: Figure 1 is a flowchart of an embodiment of the method for transmitting data between a first computer and a second computer according to the present invention; Figure 2 This is a schematic diagram of the structure of one embodiment of the data transmission device of the present invention;

[0007] Explanation of icon numbers: 1. First computer, 2. First image acquisition device, 3. Second image acquisition device, 4. Second computer, 5. First display card, 6. Second display card, 7. Third display card, 8. Fourth display card, 9. First monitor, 10. Second monitor. Detailed Implementation

[0008] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the specific implementation methods of the present invention will be described below with reference to the accompanying drawings. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings and other implementation methods can be obtained based on these drawings without any creative effort.

[0009] To keep the drawings concise, only the parts relevant to the invention are shown schematically in each figure, and they do not represent the actual structure of the product. Furthermore, for ease of understanding, in some figures, only one of components with the same structure or function is shown schematically, or only one is labeled. In this document, "one" can mean not only "only one" but also "more than one".

[0010] 1. Establish a website: Create a website W on the first computer 1. Website W's user data is stored in a database, including username, password, and personal information. Database B is installed on the second computer 4. The steps for storing website W's user data in database B are described in detail in the following implementation column. Technical personnel commonly use .NET... Web pages of website W are generated using programming languages ​​or platforms such as JAVA. In subsequent embodiments, program developers can choose different development tools as needed.

[0011] The first computer is a web server; the first computer can also be an application server.

[0012] An application server can be defined in any of the following ways: The second computer is a database server. Its primary purpose is to receive and store data sent by a primary computer (web server, application server, or other computer).

[0013] 2. Settings: 1) The first display card 5 and the third display card 7 are the same type of display card, and the first display card 5 and the third display card 7 use the same driver.

[0014] In the initial working state, neither the first graphics card 5 nor the third graphics card 7 outputs a signal; unless otherwise specified, the first graphics card does not output the desktop content of the first computer. The third graphics card does not output the desktop content of the second computer.

[0015] 2) Add a dynamic link library Rec.dll to the system directory of the first and second computers, or to a user-specified directory. This dynamic link library contains the Recpic() function. The functionality that Recpic() may have is described in detail in the implementation examples.

[0016] 3) In the embodiment, the first computer contains software M, a program P (referred to as program P), software F, software K and other programs, and the second computer contains software J. The functions of these programs are described in detail in the embodiment. There are many development languages ​​(tools) or platforms commonly used by developers to write these programs, and developers can choose different development tools as needed.

[0017] 4) The first computer sends an image through the video / image output port of the first display card (or the second computer sends an image through the video / image output port of the third display card). The content identified in the image includes letters, numbers, text, and symbols. The height of the content in the image is between 1.5 mm and 40 mm. The background color of the image is white, the color of the content in the image is black, and the line spacing of the content in the image is between 1 mm and 15 mm.

[0018] It should be noted that after the data in the image sent by the computer through the video / image output port of the display card is identified, blank lines need to be removed first. In the example implementation, the data identified in the image no longer contains blank lines.

[0019] In one embodiment of the present invention: 1. User F opens the user login page of website W, enters the username and password, clicks the "Login" button, and logs in successfully; 2. When a user clicks the "Modify Personal Information" button on their computer, the first computer displays the user's personal information. After modifying the personal information, the first computer places the serial number (or session number), "update", and name (assuming that the username is unique in this system) in the first, second, and third rows of image Q. The modified information is placed in the fourth row (or the fourth row and multiple rows after the fourth row) of image Q. Then, image Q is sent to the second computer. The first image acquisition device receives image Q from the video / image output port of the first display card of the first computer; the first image acquisition device saves image Q as 0001.JPG in its memory, and then sends 0001.JPG to the second computer, or the first image acquisition device sends image Q to the second computer. The second computer recognizes the data of image Q or 0001.JPG. If the second line is "update", the second computer processes the data from the fourth line onwards in the following way: The second computer recognizes the fourth line, which is called the first form of information processing; adding one or more spaces between two characters, or one or more characters, where any number of characters are not executable code, is called the second form of information processing, which is stored in the database. When a user views user information, the first computer sends the information needed to access the database to the second computer; the second computer restores the second form of information processing back to the first form of information processing.

[0020] The second computer places the first form of information processing into image T and sends it to the first computer, which then sends the data to the user's computer.

[0021] In one embodiment of the present invention: 1. User F opens the user login page of website W, enters the username and password, clicks the "Login" button, and logs in successfully; 2. When a user clicks the "Modify Personal Information" button on their computer, the first computer displays the user's personal information. The user modifies the information and places the serial number (or session number), "update," and name (assuming the username is unique in this system) in the first, second, and third rows of image Q. The modified information is placed in the fourth row (or multiple rows after the fourth row) of image Q. Then, image Q is sent to the second computer. Assume the modified personal information is an executable code segment "ABCDEFGHHIJK," where each letter A, B, C, D, E, F, G, H, H, I, J, and K represents one or more characters.

[0022] “ABCDEFGHHIJK” is called the raw data; the first image acquisition device receives image Q from the video / image output port of the first display card of the first computer; the first image acquisition device saves image Q as 0001.JPG and stores it in the memory of the first image acquisition device, and then sends 0001.JPG to the second computer, or the first image acquisition device sends image Q to the second computer, the second computer recognizes the data of image Q or 0001.JPG, if the second line is “update”, the second computer processes the data of the fourth line and thereafter in the following way, and the processed data is called the first form of information processing; a) After the second computer recognizes a certain amount of data (let's say 3 characters) in the fourth row, it stores it in the first field of the database table. After the second computer recognizes a certain amount of data (let's say 3 characters), it stores it in the second field of the database table. This step is repeated until the fourth row and subsequent data are recognized. If the last data is less than 3 characters, this operation will also terminate. or, (b) After the second computer identifies a certain number of characters in a line of information (assuming 15 characters), and this certain number does not exceed the total length of the line, it stops identifying any unidentified characters in that line. For example, if a line contains a username, normally 15 characters are more than enough; the rest are unnecessary.

[0023] Alternatively, the second computer can identify the content in the first data. c) The second computer will encrypt the content identified in the first data and store it in the second computer; or, d) The second computer divides the content into multiple parts “ABC”, “DEF”, and “HIJK”, which are stored in multiple storage areas of the second computer respectively; or, e) Assume that “ABC”, “DEF”, and “HIJK” could also be components of executable code. The second computer shuffled the contents and stored "HJKFDBACIE" in its memory. or, f) The second computer shuffles the contents into multiple parts, “HJK”, “FDB”, and “ACIE”, and stores them in multiple storage areas of the second computer’s memory. When a user views their profile, the first computer sends the information needed to access the database to the second computer. The second computer converts the contents of multiple parts into a second form of information processing, "HJKFD" and "BACIE", which are then stored in multiple storage areas of the second computer's memory.

[0024] The second computer places the second form of information processing into image T and sends it to the first computer. The first computer restores the second form of the data to "ABCDEFGHHIJK" and sends it to the user's computer.

[0025] In one embodiment of the present invention 1. The web server (first computer) receives external data from the Internet. Assuming that the received data is small and is only stored in one image Q, the first computer sends image Q to the first image acquisition device. 2. The first image acquisition device receives image Q from the video / image output port of the first display card of the first computer; the first image acquisition device saves image Q as 0001.JPG in its memory, and then sends 0001.JPG to the second computer; alternatively, the first image acquisition device sends image Q to the second computer. 3. The second computer identifies the data of image Q or 0001.JPG. The second computer will identify the data in image Q or 0001.JPG and process it in one of the following ways. The processed data is called the first form of information processing. After the second computer recognizes a certain amount of data (let's say 3 characters), it stores it in the first field of the table in the second computer's database. This process is repeated until all the data has been recognized. If the last data is less than 3 characters, the operation will terminate. or, Alternatively, the second computer can identify the content in the first data. B) The second computer divides the content into multiple parts “ABC”, “DEF”, and “HIJK”, which are stored in multiple storage areas of the second computer’s memory respectively; or, Assuming that "ABC", "DEF", and "HIJK" could also be components of executable code, c) The second computer stores "HJKFDBACIE" after shuffling the content order; or, d) The second computer shuffles the contents into multiple parts, “HJK”, “FDB”, and “ACIE”, and stores them in multiple storage areas of the second computer’s memory. 4. If data needs to be sent to the first computer, the first form of information processing needs to be converted into the second form of information processing. The first form of data processing and the second form of data processing are different, specifically in that the order of the content after adjustment is different, the number of parts is different, etc.

[0026] Thus, even if a hacker gains control of the web server and obtains the second form of the data as it appears in the image, the hacker can obtain the rules for converting the original data into the second form, and then design a piece of data. The final displayed part of the second form of the data is "ABC" or another piece of executable code. The hacker thought this might harm the system, but that was impossible because the original data was stored in the second computer in its first form and was not transmitted to the first computer, so the hacker could not obtain it. In this way, hackers cannot know the rules for transforming raw data into its first form, and therefore cannot design the first form of data or a part of the first form of data into "ABC" or other executable code, thus reducing potential harm. The output ports of the graphics card can be DVI, HDMI, etc., and the input ports of the corresponding image acquisition devices also adopt the corresponding image input ports. The first computer converts the relevant images / image files into signals suitable for transmission through the DVI or HDMI output ports of the first graphics card, and the second computer converts the relevant images / image files into signals suitable for transmission through the DVI or HDMI output ports of the third graphics card.

[0027] Any device capable of acquiring data from the first computer and sending image signals to the image acquisition device should be considered a replacement for the graphics card. Users can perform various operations using the techniques described in the above embodiments.

[0028] As shown in Figure 1, a method for isolating executable code, used for transmitting data between a first computer and a second computer, includes: A first computer sends first data to a first image acquisition device through its image output port; the first image acquisition device sends the first data to a second computer, or the first image acquisition device processes the first data to generate second data, and then sends the second data to the second computer. The first data, the second data, or a portion of the first data or a portion of the second data are referred to as information.

[0029] Step S10: The second computer identifies one or more strings in the information, and adds one or more characters between any two characters. The multiple characters are not or cannot be converted into executable code, and the multiple characters cannot be combined with one or more characters before or after the preceding or following characters to form executable code. Step S20: The second computer stores the modified information in its database.

[0030] The first image acquisition device has an image input port, which is used to connect to the image output port of the first computer; the image output port of the first computer includes the output port of the display card of the first computer; the second computer can process the information using any of the following methods, and the result of the processing is called the first form of information processing; The first method involves storing one or more characters identified by a second computer in different storage areas of the second computer. Alternatively, a second computer may identify the content of the information. The second method: The second computer divides the content into multiple parts and stores them in different storage areas of the second computer; or, The third method: The second computer reorders the contents and stores them in the second computer; or, The fourth method: The second computer rearranges the content in order, divides it into multiple parts, and stores them in different storage areas of the second computer.

[0031] The second computer converts the first form of information processing into the second form of information processing and sends it to the first computer.

[0032] It should be noted that the steps in the above embodiments can be freely combined as needed. The above description is only a preferred embodiment of the present invention. It should be pointed out that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for isolating executable code, characterized in that, include: The first computer sends first data to the first image acquisition device through the image output port of the first computer; The first image acquisition device sends the first data to the second computer, or the first image acquisition device processes the first data to generate second data, and then sends the second data to the second computer. The first data, the second data, or a portion of the first data or a portion of the second data are referred to as information. The second computer can process the information using any of the following methods: The first method: The second computer identifies one or more strings in the information and adds one or more characters between any two adjacent characters, wherein the multiple characters are not or cannot be converted into executable code; The second method: The first time the second computer recognizes one or more characters in the information, and the second time the second computer recognizes one or more characters in the information, they are stored in different storage areas of the second computer; or, The third method: After the second computer identifies a certain number of characters in a certain line of the information as needed, it stops identifying the unidentified characters in that line. Alternatively, the second computer identifies the content of the information. The fourth method: The second computer encrypts the content and stores it in the second computer; or, Fifth method: The second computer divides the content into multiple parts and stores them in different storage areas of the second computer; or, Fifth method: The second computer reorders the content and stores it in the second computer; or, The seventh method: The second computer rearranges the content in order, divides it into multiple parts, and stores them in different storage areas of the second computer.

2. The method for isolating executable code according to claim 1, characterized in that, The first computer is a web server or an application server.

3. The method for isolating executable code according to claim 1, characterized in that, The second computer is a database server.

Images