Computer System and Security Reinforcing Method Thereof

• US 20080256637A1
• Filed: 03/22/2006
• Published: 10/16/2008
• Est. Priority Date: 09/30/2005
• Status: Abandoned Application

• Current Assignee: Lenovo (Beijing) Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo (Beijing) Limited (Lenovo Group Ltd.)
• Inventors: Ke, Ke, Song, Chunyu, Liu, Yongfeng
• Application Number:
  US12/088,603
• Publication Number:
  US 20080256637A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems

Abstract

The present invention provides a computer system for carrying out security reinforcing and a security reinforcing method. The computer system comprises hardware, a BIOS, and a virtual machine monitor, and has at least one servo operating system and at least one user operating system running thereon, wherein, the servo operating system comprises a security reinforcing proxy module, and the user operating system comprises a security reinforcing module. With the present invention, it is possible to prevent the security reinforcing performance from being tampered by the frangibility of the user operating system, and to avoid hacker attacks which cannot be avoided in case of regular or manual security reinforcing, and also to ensure better secure defense of the computer system and the security of the downloaded security reinforcing files own.

Claims

1. A computer system for carrying out security reinforcing, comprising hardware, a BIOS, and a virtual machine monitor, characterized in further comprising at least one servo operating system and at least one user operating system running on the computer system, wherein,

the servo operating system is booted before the user operating system is booted;

the servo operating system comprises a security reinforcing proxy unit for communicating with a security server in a network in which the computer system locates, to determine whether it is needed to carry out security reinforcing on the user operating system or not, and to determine whether the security reinforcing on the user operating system is to be carried out by the security reinforcing proxy unit itself or not based on the types of security reinforcing files to be reinforced.

2. The computer system according to claim 1, characterized in that, the security reinforcing files comprise at least one of operating system kernels, operating system patches, and user installed program feature libraries and rule libraries thereof.

3. The computer system according to claim 2, characterized in that, when the type of the security reinforcing file to be reinforced is an operating system kernel, the security reinforcing proxy unit immediately carries out security reinforcing on the user operating system to update the operating system kernel of the user operating system.

4. The computer system according to claim 1, characterized in that, the user operating system comprises a security reinforcing unit for updating the security reinforcing files in the user operating system when the security reinforcing proxy unit determines it is needed to carry out security reinforcing on the user operating system while the security reinforcing on the user operating system is not to be carried out by the security reinforcing proxy unit itself.

5. The computer system according to claim 4, characterized in that, the security reinforcing unit checks the security reinforcing files in the user operating system, and provides the version information thereof to the security reinforcing proxy unit via the virtual machine monitor.

6. The computer system according to claim 1, characterized in that, the security reinforcing proxy unit determines whether it is needed to carry out security reinforcing on the user operating system or not by comparing at least one of the versions of the various security reinforcing files in the user operating system and check sums thereof with at least one of the versions of the files in the security server and check sums thereof.

7. The computer system according to claim 6, characterized in that, if it is needed to carry out security reinforcing on the user operating system, the security reinforcing proxy unit downloads the latest security reinforcing files from the security server.

8. The computer system according to claim 1, characterized in that, the servo operating system is an embedded operating system.

9. The computer system according to claim 1, characterized in the security reinforcing proxy unit communicates with the security server by means of PPTP, L2TP, IPSec or SSL protocol.

13. The computer system security reinforcing method according to claim 1, further comprising a step of:

updating the security reinforcing files in the user operating system by a security reinforcing unit of the user operating system when the security reinforcing proxy unit determines it is needed to carry out security reinforcing on the user operating system while the security reinforcing on the user operating system is not to be carried out by the security reinforcing proxy unit itself.

14. The computer system security reinforcing method according to claim 13, further comprising a step of:

checking the security reinforcing files in the user operating system by the security reinforcing unit, and providing the version information thereof to the security reinforcing proxy unit via a virtual machine monitor.

15. The computer system security reinforcing method according to claim 1, characterized in that, the security reinforcing proxy unit determines whether it is needed to carry out security reinforcing on the user operating system or not by comparing at least one of the versions of the various security reinforcing files in the user operating system and check sums thereof with at least one of the versions of the files in the security server and check sums thereof.

16. The computer system security reinforcing method according to claim 15, further comprising a step of:

downloading the latest security reinforcing files from the security server by the security reinforcing proxy unit if it is needed to carry out security reinforcing on the user operating system.

10. A computer system security reinforcing method, comprising steps of:

booting at least one servo operating system before booting a user operating system;

communicating with a security server in a network in which the computer system locates by a security reinforcing proxy unit of the servo operating system, to determine whether it is needed to carry out security reinforcing on the user operating system or not;

determining whether the security reinforcing on the user operating system is to be carried out by the security reinforcing proxy unit itself or not based on the types of security reinforcing files to be reinforced; and

immediately carrying out security reinforcing on the user operating system and updating the corresponding security reinforcing files in the user operating system when it is determined that the security reinforcing on the user operating system is to be carried out by the security reinforcing proxy unit itself.

11. The computer system security reinforcing method according to claim 10, characterized in that, the security reinforcing files comprise at least one of operating system kernels, operating system patches, and user installed program feature libraries and rule libraries thereof.

12. The computer system security reinforcing method according to claim 11, characterized in that, when the type of the security reinforcing file to be reinforced is an operating system kernel, it is determined that the security reinforcing on the user operating system is to be carried out by the security reinforcing proxy unit itself.

17. The computer system security reinforcing method according to claim 10, characterized in that, the servo operating system is an embedded operating system.

18. The computer system security reinforcing method according to claim 10, characterized in that, the security reinforcing proxy unit communicates with the security server by means of PPTP, L2TP, IPSec or SSL protocol.