METHOD AND SYSTEM FOR SECURELY INSTALLING PATCHES FOR AN OPERATING SYSTEM

• US 20090083727A1
• Filed: 09/23/2008
• Published: 03/26/2009
• Est. Priority Date: 09/26/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Quan, Yuan, Zhang, Xia Tian, Zhao, Shi Wan, Fu, Rong Yao
• Granted Patent: US 8,640,125 B2
• Time in Patent Office: Days
• US Class Current: 717/172
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and a system for securely installing patches for an operating system, wherein the system comprises a personal firewall, for filtering inbound and outbound network traffic; an operating system update agent, for connecting to an update server via the personal firewall to download patches; a policy manager, for invoking respective policies according to respective stages of the operating system; a stage coordinator, for coordinating the policy manager and the operating system update agent for different stages; and a policy database, for storing respective policies for respective stages of the operating system. With the method and system, the possibility of being infected by malicious software is significantly reduced when downloading patches for the operating system from the Internet.

Claims

1. A system for securely installing patches for an operating system, comprising:

a personal firewall, for filtering inbound and outbound network traffic;

an operating system update agent, for connecting to an update server via the personal firewall to download patches;

a policy manager, for invoking respective policies according to respective stages of the operating system;

a stage coordinator, for coordinating the policy manager and the operating system update agent for different stages; and

a policy database, for storing respective policies for respective stages of the operating system.

2. The system of claim 1, further comprising an update packet checker for performing security check for the downloaded patches.

3. The system of claim 1, wherein the respective policies for respective stages include a startup policy, an updating policy and a usage policy.

4. The system of claim 3, wherein for the updating policy, only the system update agent is permitted to connect to the update server.

5. A method for securely installing patches for an operating system, comprising the steps of:

in a system startup stage, starting a personal firewall and invoking a startup policy to filter inbound and outbound network traffic;

in a system updating stage, invoking an updating policy to connect an operating system update agent to an update server via a personal firewall to download patches; and

in a usage stage, invoking a usage policy to let the system work properly;

wherein the policies invoked are coordinated according to the respective stages of the operating system to update the operating system.

6. The method of claim 5, further comprising a step of performing security check for the downloaded patches.

7. The method of claim 5, wherein for the updating policy, only a system update agent is permitted to connect to an update server.

8. The method of claim 5, wherein a personal firewall is started in the system startup stage.