Real-time password verification method and system based on network state and storage medium

Abstract

The invention relates to the technical field of databases, and discloses a real-time password verification method and system based on a network state and a storage medium, and the method comprises the following steps: firstly obtaining a password change strategy containing an old password based on a password change task notification, and then detecting a current network line to obtain state data; and if the data is abnormal, sending a network establishment request, operating by using a temporary network line and detecting the state data again, and if the data is abnormal, continuing to send a new request until the network state is good. And when the current or temporary network state is good, the old password is verified by using the good line, the password is changed and updated after the verification succeeds, the new password is verified on line, a password changing result is generated if the verification succeeds, the application connection pool is refreshed, and finally the password changing result is uploaded, so that the accuracy and the stability of password verification and password changing operation are ensured.

Description

Technical Field

[0001] The present application relates to the technical field of databases, and in particular to a real-time password verification method, system and storage medium based on network status. Background Art

[0002] xPAM is a privileged account management system that focuses on the management of privileged accounts. It aims to solve the account management problems faced by enterprises in the process of digital transformation, ensure data security and business continuity, and is suitable for all types of enterprises and organizations, especially those with large IT assets and complex account management systems.

[0003] Password verification is done by xPAM on the server side through the API or client tools provided by the database asset. The return of the result is limited by the network between xPAM and the database asset. The main password change process strongly depends on the result of password verification, and password verification strongly depends on the client tools and network of the asset. The verification result strongly depends on the network between the asset and the xPAM server.

[0004] If the network status is normal, there will be no problem with password modification and verification. If the network is abnormal, the password modification may succeed but the verification may fail. At this time, the modified new password will not be stored in xPAM, resulting in the old invalid password being stored in xPAM, while the password of the database asset has been changed to the new password. Summary of the invention

[0005] In order to prevent the situation where the password change is successful but the verification fails in the case of network abnormalities, the present application provides a real-time password verification method, system and storage medium based on network status.

[0006] In the first aspect, the present application provides a real-time password verification method based on network status, which adopts the following technical solution: A real-time password verification method based on network status includes the following steps: Based on the password change notification of creating the password change task, obtaining a password change policy corresponding to the new password after the password change, wherein the password change policy contains the old password; Performing network detection on the current network line to obtain current status data of the current network line; If the current status data is abnormal, a network establishment request is sent; a temporary network line corresponding to the network establishment request is obtained, network establishment return data is sent through the temporary network line and the encryption change strategy is received, a network detection is performed on the temporary network line to obtain temporary status data of the temporary network line, and if the temporary network status is abnormal, a new network establishment request is sent until good network status data is obtained; If the current status data or the temporary status data is good, the old password is verified for the encryption change strategy using a network line with a good network data status; after the verification is successful, the encryption change operation is performed, the old password is updated with the new password, and then the new password is verified online; after the new password is successfully verified online, an encryption change result is generated, the application connection pool is refreshed, and the encryption change result is uploaded.

[0007] By adopting the above technical solutions, using the self-developed asset encryption client tool Keyuinkerclient, the encryption change does not depend on the API or client provided by the asset test; KeyLinker-Client implements the password verification of the asset, decoupling the main encryption process and password verification, and the correctness of the application encryption change does not depend on the instantaneous network stability.

[0008] Optionally, the step of performing online verification on the new password further includes the following sub-steps: If there are at least two network lines, and both the current state data and the temporary state data are good, an online check is performed based on the current network line to obtain a first check result, and at the same time, an online check is performed based on the temporary network line to obtain a second check result; If the first verification result is inconsistent with the second verification result, the encryption process is stopped and an error message is given; If the first verification result is consistent with the second verification result, the generation time of the first verification result and the generation time of the second verification result are obtained, and the absolute value of the difference between the two generation times is calculated as the generation time difference. If the generation time difference is greater than the preset reference time difference, the network line with a shorter generation time is selected as the current network line.

[0009] By adopting the above technical solution, first, when there are multiple network lines and they are all in good condition, the accuracy of password verification can be greatly improved by performing verification based on different lines and comparing the results. Through the double verification mechanism, it is possible to effectively avoid the misrecognition of incorrect verification results caused by a single network line failure or anomaly, thereby ensuring the correctness and effectiveness of the new password and providing more reliable protection for enterprise data security.

[0010] Secondly, when the verification results of the two lines are inconsistent, the password change process is stopped and an error prompt is given, which can timely discover potential problems or risks, prevent incorrect password information from entering the system or being applied, and avoid a series of subsequent adverse consequences such as account management confusion and increased data leakage risk caused by inconsistent passwords, thereby ensuring the rigor and stability of the account management process.

[0011] Finally, when the verification results of two lines are consistent but the generation time is different, the network line with the shorter generation time is selected as the current network line, which helps optimize the utilization efficiency of network resources. Giving priority to the network line with faster response speed can reduce the time wasted due to network delays and improve the operating efficiency of the overall password change and verification process. Especially in the scenario of large-scale account management and frequent password change operations, it can significantly improve the processing speed and performance of the system, making the enterprise's privileged account management system more efficient and flexible to deal with various complex situations, and adapt to the requirements of fast, accurate and secure account management in the process of enterprise digital transformation.

[0012] Optionally, the step of uploading the encryption result further includes the following sub-steps: If the generation time difference is greater than the reference time difference, the decryption result is first signed and then encrypted to obtain an intermediate result, and the intermediate result is reported; the decryption response returned by first decrypting and then unsigning the intermediate result and then verifying the decryption result is obtained to complete the decryption operation; wherein, the complexity of signing and unsigning is adjusted according to the generation time difference, the larger the generation time difference, the higher the complexity, and the smaller the generation time difference, the lower the complexity.

[0013] By adopting the above technical solution, on the one hand, the decryption result is signed and then encrypted before reporting the intermediate result, and the decryption result is verified by decryption and then unsigning in the future. This series of operations greatly enhances the security and integrity of the decryption result transmission process. Signing can ensure the traceability and non-repudiation of the source of data, and encryption can effectively prevent the data from being stolen or tampered with during transmission, effectively resist security threats such as network attacks and malicious theft, and ensure the security of sensitive account information of enterprises. On the other hand, adjusting the complexity of signing and unsigning according to the generation time difference has strong flexibility and adaptability. When the generation time difference is large, it means that there may be more unstable factors or potential risks in the network environment. At this time, increasing the complexity of signing and unsigning can respond to possible security risks with higher security protection strength, and further enhance the confidentiality and reliability of data. When the generation time difference is small, appropriately reducing the complexity can reduce unnecessary computing resource consumption and processing time under the premise of ensuring a certain security, optimize system performance, and enable the system to balance the relationship between security and efficiency under different network conditions, meeting the needs of enterprises for efficient and secure operation of privileged account management systems in diversified network scenarios.

[0014] Optionally, the step of uploading the encryption result further includes the following sub-steps: If the generation time difference is less than the reference time difference, and the fluctuation amplitudes of the most recent multiple generation time differences are within the preset fluctuation reference range, the decryption result is first signed and then encrypted to obtain an intermediate result, and the intermediate result is reported; the decryption response returned by first decrypting and then unsigning the intermediate result and then verifying the decryption result is obtained to complete the decryption operation; wherein, the complexity of encryption and decryption is adjusted according to the generation time difference, the larger the generation time difference, the higher the complexity, and the smaller the generation time difference, the lower the complexity.

[0015] By adopting the above technical solution, when the generation time difference is less than the reference time difference and the fluctuation range is stable, the encryption result is still signed and encrypted, which can ensure the security and integrity of the encryption result transmission in a relatively stable but still risky network environment. Signatures can ensure that the data source is reliable and cannot be tampered with, and encryption can prevent information leakage, providing basic security protection for account management data. The complexity of encryption and decryption is adjusted according to the generation time difference, achieving a dynamic balance between security and efficiency. When the generation time difference is small, reducing the complexity of encryption and decryption can reduce unnecessary computing resource usage and processing time, improve the overall performance of the system, and avoid slow system response due to excessive security protection measures. In a stable network environment with a small time difference, appropriately reducing the complexity is also sufficient to deal with conventional security risks, so that the system can run more efficiently while ensuring security, adapt to the daily account management business needs of enterprises, and help enterprises to smoothly carry out privileged account management and ensure data security under stable network conditions.

[0016] Optionally, the method further comprises the following steps: If the current state data or the temporary state data is good, the old password is verified for the password change strategy using a network line with good data status, and the first online network verification with the server is performed; after the verification is successful, the password change operation is performed, the old password is updated with the new password, and then the new password is verified, and the second online network verification with the server is performed; after the new password verification is successful, a password change result is generated, the application connection pool is refreshed, and the third online network verification with the server is performed; and the password change result is uploaded; The evaluation value is calculated based on the results of three online network verifications; Calculate the dispersion coefficient of multiple evaluation values ​​within the most recent set time period; if the dispersion coefficient is greater than a preset threshold, issue a network warning prompt.

[0017] By adopting the above technical solution, firstly, by conducting online network verification on the Internet and the server at three different stages, namely, the old password verification, the new password verification, and the verification before uploading the encryption result, the stability and reliability of the network in the entire encryption process can be fully and deeply monitored. This multi-stage verification mechanism greatly reduces the probability of password verification errors, encryption failures, or inaccurate encryption result uploads due to network anomalies, effectively ensuring the accuracy and integrity of the privileged account management system and establishing a guarantee for enterprise data security. Secondly, the evaluation value is calculated based on the results of the three online network verifications, and network early warning prompts are issued based on the fluctuations of the evaluation values ​​in the last few times. This measure is highly forward-looking and preventive, and can promptly detect potential unstable trends or abnormal changes in the network. In the digital operation environment of an enterprise, network fluctuations may indicate a variety of risks, such as network equipment failures, preludes to network attacks, or insufficient network bandwidth. Early warning enables the company's IT operation and maintenance team to take appropriate measures before the problem worsens, such as checking network equipment, optimizing network configuration, or strengthening network security protection, thereby effectively avoiding serious consequences such as large-scale account management chaos, business interruption, and even data leakage caused by network failures, ensuring the continuity and stability of the company's business, and improving the company's overall IT operation management level and risk response capabilities.

[0018] Optionally, the method further comprises: If the dispersion coefficient is less than or equal to a preset threshold, the average value of multiple evaluation values ​​within the most recent set time period is calculated; The reference time difference is adjusted according to the average value of the evaluation value. The larger the average value of the evaluation value is, the larger the reference time difference is; and the smaller the average value of the evaluation value is, the smaller the reference time difference is.

[0019] By adopting the above technical solution, when the evaluation value is large, it means that there may be more unstable factors or more prominent delays in the network verification process. By increasing the reference time difference, the system can be given more time to process the time difference tolerance of the verification results between different network lines, avoiding misjudgment of the verification results due to instantaneous network fluctuations, thereby further ensuring the accuracy and stability of password verification and the entire encryption process in a complex network environment. It can effectively adapt to the dynamic changes in network performance, improve the system's adaptability to network anomalies, and reduce encryption errors or security risks caused by network instability.

[0020] Optionally, the method further comprises: If the discrete coefficient is less than or equal to a preset threshold, a random number of m evaluation values ​​are recorded within a recently set time period, a random number of n evaluation values ​​are extracted from the m evaluation values, and the average value of the extracted n evaluation values ​​is calculated as a random average value; wherein n is less than m; The reference time difference is adjusted according to the random average value. The larger the random average value is, the larger the reference time difference is; the smaller the random average value is, the smaller the reference time difference is.

[0021] By adopting the above technical solution, by calculating the random average value to adjust the reference time difference, it is possible to more flexibly respond to potential small fluctuations in the network. The smaller the random average value, the smaller the reference time difference, which helps to improve the operating efficiency of the system. When the network is in good condition and the evaluation value is relatively stable and low, the system can quickly complete password verification and related operations. On the contrary, when the random average value is larger, the reference time difference is larger. This adjustment mechanism can improve the fault tolerance of the system. When some small unstable factors in the network cause the evaluation value to increase, the system increases the reference time difference to give the network more time to complete operations such as verification, avoid misjudgment due to time constraints, ensure the stability and accuracy of the password management system, and thus protect the security of corporate accounts. Through this method of dynamically adjusting the reference time difference, the system can make reasonable adjustments according to the actual situation of the network and reduce the impact of network fluctuations or unstable factors on the password management system. In the long-term operation process, whether facing short-term small fluctuations in the network or long-term minor performance changes, the system can maintain a relatively stable operating state.

[0022] Optionally, the method further comprises: If the discrete coefficient is less than or equal to a preset threshold, the encryption window period is adjusted according to the discrete coefficient. The larger the discrete coefficient is, the longer the encryption window period is; the smaller the discrete coefficient is, the shorter the encryption window period is.

[0023] By adopting the above technical solution, the dispersion coefficient reflects the degree of dispersion of the evaluation value within the set period, that is, the fluctuation range of the network verification result. When the dispersion coefficient is large, it indicates that the stability of the network is poor and the uncertainty of the verification result increases. At this time, extending the password change window period means giving the network more time to stabilize and recover during the password change operation, reducing the possibility of errors or abnormalities in the password change process due to frequent network fluctuations. For example, during periods of network instability, a longer password change window period can wait for the network condition to improve before performing key password change operations, avoiding incomplete or incorrect password updates due to network jitter. The rhythm of the password change operation can be flexibly adjusted according to the fluctuation characteristics of the network, effectively ensuring the smooth progress of the password change process, reducing the negative impact of network instability on the privileged account management system, and improving the reliability and adaptability of the system in complex network environments.

[0024] In the second aspect, the present application provides a real-time password verification system based on network status, which adopts the following technical solution: A real-time password verification system based on network status includes a processor, wherein the processor executes the steps of any one of the real-time password verification methods based on network status described above.

[0025] In a third aspect, the present application provides a storage medium, which adopts the following technical solution: A storage medium stores a program, and when the program is executed by a processor, the program implements the steps of any one of the above-mentioned real-time password verification methods based on network status.

[0026] In summary, the present application includes at least one of the following beneficial technical effects: Through the self-developed asset encryption client tool Keyuinkerclient, we have successfully achieved the decoupling of encryption from the API or client provided by the asset side, so that the encryption process is no longer restricted by specific asset interface conditions, enhancing the autonomy and compatibility of the system, and can flexibly adapt to the privileged account management needs in different asset environments, effectively improving the system's deployment and application capabilities in complex IT architectures.

[0027] KeyLinker - Client is used to decouple the main password change process from password verification, significantly reducing the dependence of password change operations on instantaneous network stability. No matter how the network fluctuates, as long as a stable network connection can be established for verification, the correctness and integrity of the password change can be ensured, greatly improving the reliability of the account management system in an unstable network environment, reducing problems such as password change failures or password inconsistencies caused by network failures, and ensuring the continuous and stable operation of corporate business.

[0028] In the case of multiple network lines, password verification is performed based on different lines and the results are compared. At the same time, corresponding processing is performed based on the consistency of the verification results and the generation time difference. This not only greatly improves the accuracy of password verification and effectively prevents incorrect passwords from entering the system, but also optimizes line selection according to network conditions and improves the efficiency of network resource utilization. This enables the system to operate intelligently and efficiently in a multi-line network environment and adapt to privileged account management tasks under the enterprise's diversified network configuration.

[0029] For the transmission of the decryption results, the complexity of signing and unsigning, as well as encryption and decryption, is adjusted according to the network conditions, achieving a dynamic balance between security and efficiency while ensuring data security. When the network environment is good, the complexity is appropriately reduced to improve system performance, and when the network is unstable or there are risks, the complexity is increased to strengthen data protection, ensuring the confidentiality, integrity and traceability of the decryption results during transmission, effectively resisting network attacks and data leakage risks, and protecting sensitive enterprise account information.

[0030] Through online network verification and calculation of evaluation values ​​at three key stages, as well as adjusting the reference time difference and the re-encryption window period according to the evaluation value, the average value of the evaluation value and the discrete coefficient, it is possible to comprehensively and accurately monitor changes in network status. On the one hand, it can timely discover potential network problems and issue early warnings, so that enterprises can take measures in advance to deal with network failures or risks and ensure business continuity; on the other hand, it can flexibly adjust key system parameters according to the comprehensive performance of the network, optimize the re-encryption process and rhythm, so that the privileged account management system can operate stably and efficiently under different network conditions, and improve the overall IT operation management level and account management security of the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The invention is a step diagram of a real-time password verification method based on network status.

[0032] Figure 2 It is a step diagram when there are at least two network lines in the network environment where the system is located, and the current state data and the temporary state data are both in good status.

[0033] Figure 3 It is a flow chart of three online network verifications with the server. DETAILED DESCRIPTION

[0034] Embodiments of the present application are described in detail below, examples of which are shown in the accompanying drawings.

[0035] In the description of this specification, the description with reference to the terms "certain embodiments", "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples" or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0036] The present application embodiment discloses a real-time password verification method based on network status, referring to Figure 1 , including the following steps: Based on the password change notification issued by the creation of the password change task, the password change policy corresponding to the new password after the password change is obtained, wherein the password change policy contains the old password. After receiving the password change notification issued by the creation of the password change task, the system will quickly and accurately obtain the corresponding password change policy, which explicitly contains the old password information.

[0037] Perform network detection on the current network line to obtain the current status data of the current network line; the system will immediately start a comprehensive detection of the current network line, and obtain the accurate current status data of the current network line through a series of complex and efficient detection methods.

[0038] If the detection result shows that the current status data is abnormal, the system will automatically trigger the emergency mechanism and quickly send a network construction request. Subsequently, the system will obtain a temporary network line that closely corresponds to the network construction request, and use this temporarily opened network line to ensure that the network construction return data is sent accurately and the encryption policy is received smoothly. After that, the system will once again conduct an in-depth and detailed network detection on the temporary network line to obtain the temporary status data of the temporary network line. If it is found that the temporary network status is still abnormal, the system will continue to send new network construction requests, and repeat this cycle until it finally successfully obtains good network status data.

[0039] When the current status data or temporary status data is in good condition, the system will enable the network line with good network data status and verify the old password for the password change policy. Only after the old password verification is successfully passed, the system will perform the password change operation and use a new password to update and replace the old password. Subsequently, the system will conduct an online verification of the new password, which further ensures the accuracy and validity of the new password. When the new password is successfully verified online, the system will generate a detailed password change result and refresh the application connection pool in time to ensure the consistency and real-time nature of the system data. Finally, the system will upload the password change result to the relevant system to complete the closed-loop process of password verification and update.

[0040] The self-developed asset encryption client tool Keyuinkerclient is used to make encryption independent of the API or client provided by the asset test; KeyLinker-Client implements the password verification of assets, decoupling the main encryption process and password verification, and the correctness of the application encryption does not depend on the instantaneous network stability. As long as a stable network connection can be established for verification, the correctness and integrity of the encryption can be ensured, thereby ensuring the security of enterprise data and business continuity for the enterprise's privileged account management system in a complex and changing network environment.

[0041] Reference Figure 2, the step of online verification of the new password also includes the following sub-steps: When there are at least two network lines in the network environment where the system is located, and the current status data and temporary status data are both in good condition, the system will simultaneously start the verification process based on different lines. Specifically, on the one hand, the system will carry out comprehensive and in-depth online verification work based on the current network line, and finally obtain the first verification result through a series of complex algorithms and data interactions. At the same time, the system will also carry out parallel online verification work based on the temporary network line, and also obtain the second verification result after a series of precise calculations and data verification.

[0042] Once the first verification result and the second verification result show inconsistency, the system will stop the password modification process to prevent the wrong password information from being further spread or applied. In addition, the system will immediately report an error and notify relevant personnel to come and troubleshoot the problem to ensure that the accuracy and consistency of password verification are maintained.

[0043] When the first verification result is consistent with the second verification result, the system will conduct further in-depth inspections to obtain the generation time of the first verification result and the generation time of the second verification result. Subsequently, the absolute value of the difference between the two generation times is calculated, which is defined as the generation time difference. If the generation time difference is greater than the preset reference time difference, this means that there is a significant difference in the speed of the two network lines when processing password verification. At this time, based on the principle of efficiency first, the system will select the network line with a short generation time as the current network line, so that password verification and related data transmission can be performed more efficiently in subsequent operations, thereby improving the operating efficiency and response speed of the entire system, and providing more reliable and efficient protection for the company's privileged account management.

[0044] The step of uploading the encryption result also includes the following sub-steps: If the generated time difference is greater than the reference time difference, the decryption result is first signed and then encrypted to obtain an intermediate result, and the intermediate result is reported; the decryption response returned by first decrypting the intermediate result and then unsigning it and then verifying the decryption result is obtained to complete the decryption operation; wherein, the complexity of signing and unsigning is adjusted according to the generated time difference, the larger the generation time difference, the higher the complexity, and the smaller the generation time difference, the lower the complexity.

[0045] When the initial verification process determines that the generated time difference is greater than the reference time difference, the system will start a series of high-intensity data protection mechanisms. First, the decryption result will be signed. The signed label contains rich information, such as the source identifier of the data, timestamp, and specific encryption algorithm identifier. By signing, not only can the non-repudiation of the decryption result during transmission be ensured, that is, any party receiving the data can clearly know the source of the data, but also the integrity of the data can be effectively verified. Once the data is maliciously tampered with during transmission, the recipient can detect it by verifying the signature.

[0046] After signing, the system will encrypt the signed data. Encryption uses advanced and high-strength encryption algorithms to convert data into ciphertext. Only with the correct decryption key can it be restored to the original encrypted result, which greatly reduces the risk of data being stolen or interpreted by unauthorized parties during transmission. After the dual protection of signing and encryption, the intermediate result is obtained, and then the system will report this intermediate result to the relevant receiving end or server according to the established transmission protocol.

[0047] When the receiving end receives the intermediate result, it will start the corresponding reverse operation process, that is, decryption processing will be performed first. After successful decryption, the decryption operation will be performed. Decryption is to verify and unlock the data label assigned by the previous signature. Through a series of mathematical operations and algorithm verification, it is confirmed that the source of the data is legitimate and whether it remains intact and has not been tampered with during the transmission process. Only after the decryption and decryption are successfully completed, the decryption result will be further verified and the corresponding decryption response will be returned. If the verification passes, the entire decryption operation is finally completed.

[0048] In this process, the system also has the ability to dynamically adjust the complexity of signing and decryption according to the generation time difference. When the generation time difference is larger, it means that there may be more unstable factors or potential security risks in the network environment. At this time, the system will automatically increase the complexity of signing and decryption, such as using longer key lengths, more complex encryption algorithms, or more rounds of encryption and decryption operations. The purpose is to further strengthen the security of data under such harsh network conditions, and ensure that even in the face of high-intensity network attacks or complex network interference, the encryption results can be safely and reliably transmitted and verified. On the contrary, when the generation time difference is smaller, it means that the network environment is relatively stable and the security risk is low. At this time, the system will appropriately reduce the complexity of signing and decryption. This can not only meet the basic requirements of data security, but also reduce unnecessary computing resource consumption and processing time, thereby improving the operating efficiency of the entire system, so that the system can flexibly balance the relationship between data security and processing efficiency in different network environments, and provide a more intelligent, efficient and secure protection mechanism for the privileged account management of enterprises.

[0049] The step of uploading the encryption result also includes the following sub-steps: If the generation time difference is less than the reference time difference, and the fluctuation range of the most recent multiple generation time differences is within the preset fluctuation reference range, the decryption result is first signed and then encrypted to obtain the intermediate result, and the intermediate result is reported. The decryption response returned by first decrypting the intermediate result, then decrypting and then signing it, and then verifying the decryption result is obtained to complete the decryption operation; wherein, the complexity of encryption and decryption is adjusted according to the generation time difference, the larger the generation time difference, the higher the complexity, and the smaller the generation time difference, the lower the complexity.

[0050] First, the system will perform a signing operation on the decryption result. The signed label contains rich and critical information, such as being able to accurately identify the source of the data, accurately record the specific timestamp of data generation, and clearly mark the specific encryption algorithm used. The source of the decryption result after signing is strongly guaranteed during network transmission. Any recipient can know where the data comes from without any doubt, and it also provides a reliable basis for data integrity verification. Once the data is maliciously tampered with during transmission, the recipient can quickly detect it by simply verifying the signature.

[0051] Then, after the signature is completed, the system will encrypt the signed data. Encryption uses advanced and highly confidential encryption algorithms to convert the original data into ciphertext. In this way, the risk of data being stolen by criminals or interpreted by unauthorized parties during transmission is greatly reduced. After the double protection of signature and encryption, the intermediate result is obtained. Then the system will strictly follow the established transmission protocols and specifications to accurately report this intermediate result to the relevant receiving end or server.

[0052] When the receiving end successfully receives the intermediate result, it will start the corresponding reverse operation process, that is, decryption processing will be performed first. Decryption uses the decryption key that completely matches the encryption key to restore the signed data. After successful decryption, the decryption operation is performed. Only after the two key operations of decryption and decryption are successfully completed, the decryption result will be further verified and the corresponding decryption response will be returned. Once the verification is successfully passed, the entire decryption operation is completed.

[0053] In this process, the system can intelligently adjust the complexity of encryption and decryption according to the generation time difference. When the generation time difference is larger, it often means that there may be many unstable factors in the network environment, or there are higher security risks. In this case, the system will automatically and decisively increase the complexity of encryption and decryption, such as using longer and more complex key lengths, enabling more advanced and sophisticated encryption algorithms, and even increasing the number of encryption and decryption rounds. The purpose is that even in the face of extremely harsh network conditions, such as high-intensity network attacks, complex and changeable network interference, etc., the encryption results can still be safely and reliably transmitted and verified in the network to ensure the security of data. On the contrary, when the generation time difference is smaller, it means that the network environment is relatively stable and the security risk is at a lower level. At this time, the system will appropriately reduce the complexity of encryption and decryption, effectively reduce unnecessary computing resource consumption and processing time on the basis of ensuring the basic bottom line of data security, so that the operation efficiency of the entire system is significantly improved. The system can flexibly balance the relationship between data security and processing efficiency in different network environments, creating a more intelligent, efficient, safe and reliable protection mechanism for the privileged account management of enterprises.

[0054] Reference Figure 3 , the method further comprises the following steps: If the current status data or temporary status data is good, use the network line with good data status to verify the old password for the encryption strategy, and perform the first online network verification with the server; after the verification is successful, perform the encryption operation, use the new password to update the old password, and then verify the new password, and perform the second online network verification with the server; after the new password is successfully verified, generate the encryption result, refresh the application connection pool, and perform the third online network verification with the server; upload the encryption result.

[0055] The evaluation value is calculated based on the results of three online network verifications; Calculate the dispersion coefficient of multiple evaluation values ​​within the most recent set time period; if the dispersion coefficient is greater than the preset threshold, a network warning prompt will be issued.

[0056] When it is determined that the current state data or temporary state data is in good condition, the system will enable the network line with good data status and start the verification of the old password for the password change policy. This is the first online network verification with the server. During this verification process, the system will send a verification request containing relevant information such as the old password to the server through the network. The server will conduct a comprehensive and detailed comparison and verification of the received old password based on its stored password information and established verification rules.

[0057] Once the old password verification is successfully passed, the system will perform the password change operation. The original old password will be replaced with a new password to ensure that the account password information is updated and meets the needs of enterprise security management. After the password change operation is successfully completed, the system will verify the new password. This is the second online network verification with the server. This verification is mainly to verify whether there are no errors in the generation, storage and transmission of the new password, to ensure the accuracy and effectiveness of the new password, and to prevent security risks caused by password errors due to various potential factors.

[0058] When the new password verification is successfully completed and correct, the system will generate a detailed result of the password change. Subsequently, the system will update and optimize the system's cache information to ensure that each application can obtain the latest account and password information, avoiding application operation errors or security vulnerabilities caused by inconsistent data. After completing the above operations, the system will conduct a third online network verification with the server. This verification is mainly for the last comprehensive check of the password change result before uploading, to ensure that there will be no data loss, tampering or error in the password change result during the transmission process, just like setting up the last security checkpoint on the data transmission highway. After completing the third verification, the system will upload the password change result to the relevant system or server for subsequent recording, management and analysis.

[0059] The system will calculate the evaluation value based on the results of these three online network verifications. This evaluation value is a comprehensive score of the network health status, which can intuitively reflect the stability, reliability, and accuracy of data transmission of the network in the entire decryption process. Calculate the dispersion coefficient of multiple evaluation values ​​in the most recent set time period; if the dispersion coefficient is greater than the preset threshold, a network early warning prompt will be issued. If the system finds that the fluctuations of the evaluation values ​​in the most recent few times are large when analyzing them, it may indicate that the network has potential failure risks, performance bottlenecks, or external interference. At this time, the system will issue a network early warning prompt and promptly notify the relevant network management and maintenance personnel to come and troubleshoot the problem, ensuring that the company's privileged account management system can continue to operate in a stable and secure network environment, effectively protecting the company's data security and business continuity.

[0060] in, Figure 3 xPAM is a privileged account management system that focuses on the management of privileged accounts. It aims to solve the account management problems faced by enterprises in the process of digital transformation, ensure data security and business continuity, and is suitable for all types of enterprises and organizations, especially those with large IT assets and complex account management systems.

[0061] Figure 3 The following is the KeyLinker workflow diagram, where the encryption server is called Client and the encryption client is called Server.

[0062] The method also includes: If the discrete coefficient is less than or equal to the preset threshold, calculate the average of multiple evaluation values ​​within the most recent set time period. Adjust the reference time difference according to the average value of the evaluation value. The larger the average value of the evaluation value, the larger the reference time difference. The larger the average value of the evaluation value, the more unstable factors or prominent delays may exist in the network verification process. By increasing the reference time difference, the system can be given more time to process the time difference tolerance of the verification results between different network lines, avoiding misjudgment of the verification results due to instantaneous network fluctuations, thereby further ensuring the accuracy and stability of password verification and the entire decryption process in a complex network environment. It can effectively adapt to the dynamic changes in network performance, improve the system's adaptability to network anomalies, and reduce decryption errors or security risks caused by network instability.

[0063] The smaller the average value of the evaluation value, the smaller the reference time difference. When the average value of the evaluation value is small, it means that the network as a whole presents a good and stable operating situation. During the password verification process, data can be transmitted quickly and accurately, verification requests can be responded to in a timely manner, verification results can be quickly fed back, and network line switching is smooth. At this time, the smaller reference time difference improves the system operation efficiency. The system no longer needs to reserve too much redundant time to deal with possible network problems, so that password verification and password change operations can be completed at a faster speed, reducing unnecessary waiting time, so that the entire privileged account management system can operate efficiently, and can respond to various business needs more agilely and flexibly, providing solid and fast support for enterprise data security and business continuity.

[0064] In terms of adjusting the reference time difference according to the average value of the evaluation value, the larger the average value of the evaluation value, the more subtle fluctuations and unstable factors there are in the network, such as occasional network delay spikes and small fluctuations in data transmission rate, although there was no serious stability collapse in the previous verification and operation process. In order to better adapt to this relatively complex but still stable network environment and ensure that various subsequent network operations can be completed smoothly within a relatively loose and reasonable time frame, the system will intelligently increase the reference time difference. For example, the time interval tolerance value originally set for two consecutive network operations is 500 milliseconds. When the average value of the evaluation value increases, the system may moderately adjust this time interval tolerance value to 800 milliseconds or even higher. In this way, in subsequent password verification, data transmission or other related network interaction operations, even if the network has a short-term performance decline or small fluctuations, the system can have more time to wait and process the operation results, effectively avoiding the risk of misjudgment of operation failure or unnecessary system interruption due to overly strict time limits, thereby significantly improving the robustness and reliability of the system in a complex network environment.

[0065] On the contrary, when the average value of the evaluation value is small, it clearly shows that the network performed well during the period, with high stability and fluency, efficient and fast data transmission, and nearly perfect verification process, with almost no obvious interference or delay. At this time, the system will decisively reduce the reference time difference accordingly to maximize the overall operation efficiency of the system. For example, the originally set relatively loose network operation time interval tolerance value is greatly reduced from 600 milliseconds to 300 milliseconds, enabling the system to complete password verification, encryption operations and other network-related tasks at a faster speed, significantly reducing unnecessary waiting time consumption, greatly enhancing the responsiveness and processing efficiency of the privileged account management system, and providing strong support for the rapid advancement and security of corporate business.

[0066] The method also includes: If the discrete coefficient is less than or equal to the preset threshold, record a random number of m evaluation values ​​within the most recently set time period, extract a random number of n evaluation values ​​from the m evaluation values, and calculate the average of the n extracted evaluation values ​​as the random average value; where n is less than m.

[0067] The reference time difference is adjusted according to the random average value. The larger the random average value, the larger the reference time difference; the smaller the random average value, the smaller the reference time difference.

[0068] By calculating the random average to adjust the reference time difference, we can more flexibly deal with potential small fluctuations in the network. In the actual network environment, even if the overall situation is relatively stable, there may still be some subtle changes. For example, occasional network packet delays or slight bandwidth fluctuations. Calculating the random average can capture these small fluctuations and adjust the reference time difference according to their size, so that the system can better adapt to this "relatively stable but with small changes" network state. The smaller the random average, the smaller the reference time difference, which helps to improve the operating efficiency of the system. When the network is in good condition and the evaluation value is relatively stable and low, the system can quickly complete password verification and related operations. For example, in a financial institution with high network security requirements, there are a large number of account password operations every day. When the network is stable and the evaluation value is low, reducing the reference time difference allows the system to handle these operations more agilely, reduce unnecessary waiting time, improve business processing speed, and meet the needs of fast and efficient financial transactions. On the contrary, when the random average is larger, the reference time difference is larger. This adjustment mechanism can improve the fault tolerance of the system. When some small unstable factors in the network cause the evaluation value to increase, the system increases the reference time difference to give the network more time to complete verification and other operations, avoiding misjudgment due to time constraints, ensuring the stability and accuracy of the password management system, and thus protecting the security of corporate accounts. By dynamically adjusting the reference time difference, the system can make reasonable adjustments based on the actual situation of the network and reduce the impact of network fluctuations or unstable factors on the password management system. In the long-term operation process, whether facing short-term small fluctuations in the network or long-term minor performance changes, the system can maintain a relatively stable operating state. For example, for a global account management system of a multinational enterprise, the network status will be affected by multiple factors such as the network environment in different regions and network service providers. With this adjustment mechanism, the system can always maintain good control over password verification and password modification operations in a complex and changeable network environment, effectively reducing account security risks caused by network problems and enhancing the reliability of the entire system.

[0069] The method also includes: If the discrete coefficient is less than or equal to the preset threshold, the password change window period is adjusted according to the discrete coefficient. The larger the discrete coefficient, the longer the password change window period; the smaller the discrete coefficient, the shorter the password change window period. The password change window period refers to a specific time period during which the system allows the password change operation to be performed when performing a password change operation.

[0070] For example, if the originally set password change window period is 10 minutes, when the dispersion coefficient increases, the system may extend the password change window period to 15 minutes or even longer, so that when there is a small fluctuation in the network, the system has enough time to wait for the network to recover and stabilize before performing the password change operation, ensuring the accuracy and integrity of the password change process. On the contrary, when the dispersion coefficient is smaller, it indicates that the network performance fluctuation is very small and the stability is very high. At this time, the password change window period can be appropriately shortened to further improve the operating efficiency of the system. For example, shortening the password change window period from 8 minutes to 5 minutes enables the system to respond to enterprise business needs more quickly, complete the password update operation in a timely manner, and ensure that the enterprise business operates efficiently in a safe and stable network environment.

[0071] When the coefficient of dispersion is large, it indicates that the stability of the network is poor and the uncertainty of the verification results increases. At this time, extending the password change window means giving the network more time to stabilize and recover during the password change operation, reducing the possibility of errors or abnormalities in the password change process due to frequent network fluctuations. For example, during network instability, a longer password change window can wait for the network condition to improve before performing key password changes, avoiding incomplete or incorrect password updates due to network jitter. The rhythm of the password change operation can be flexibly adjusted according to the fluctuation characteristics of the network, effectively ensuring the smooth progress of the password change process, reducing the negative impact of network instability on the privileged account management system, and improving the reliability and adaptability of the system in a complex network environment. When the coefficient of dispersion is small, it means that the network is in a stable operating state. During the entire set period, the network performance fluctuates slightly, and data transmission always maintains a high speed and stability. At this time, the system will shorten the password change window accordingly to improve the overall operating efficiency of the system. By shortening the password change window period, the system can respond to the business needs of the enterprise more agilely, quickly complete password verification and password change operations, reduce unnecessary waiting time, and provide more efficient and convenient privileged account management services for the daily operations of the enterprise, ensuring that the enterprise's business can be carried out continuously and smoothly in a stable and reliable network environment.

[0072] An embodiment of the present application further discloses a real-time password verification system based on network status, comprising a processor, wherein the processor executes the steps of any one of the real-time password verification methods based on network status described above.

[0073] An embodiment of the present application further discloses a storage medium, in which a program is stored. When the program is executed by a processor, the steps of any one of the above-mentioned real-time password verification methods based on network status are implemented.

[0074] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A real-time password verification method based on network status, characterized in that: The steps include: Based on the password change notification of creating the password change task, obtaining a password change policy corresponding to the new password after the password change, wherein the password change policy contains the old password; Performing network detection on the current network line to obtain current status data of the current network line; If the current status data is abnormal, a network establishment request is sent; a temporary network line corresponding to the network establishment request is obtained, network establishment return data is sent through the temporary network line and the encryption change strategy is received, a network detection is performed on the temporary network line to obtain temporary status data of the temporary network line, and if the temporary network status is abnormal, a new network establishment request is sent until good network status data is obtained; If the current status data or the temporary status data is good, the old password is verified for the encryption change strategy using a network line with a good network data status; after the verification is successful, the encryption change operation is performed, the old password is updated with the new password, and then the new password is verified online; after the new password is successfully verified online, an encryption change result is generated, the application connection pool is refreshed, and the encryption change result is uploaded.

2. The real-time password verification method based on network status according to claim 1 is characterized in that: The step of performing online verification on the new password also includes the following sub-steps: If there are at least two network lines, and both the current state data and the temporary state data are good, an online check is performed based on the current network line to obtain a first check result, and at the same time, an online check is performed based on the temporary network line to obtain a second check result; If the first verification result is inconsistent with the second verification result, the encryption process is stopped and an error message is given; If the first verification result is consistent with the second verification result, the generation time of the first verification result and the generation time of the second verification result are obtained, and the absolute value of the difference between the two generation times is calculated as the generation time difference. If the generation time difference is greater than the preset reference time difference, the network line with a shorter generation time is selected as the current network line.

3. The real-time password verification method based on network status according to claim 2 is characterized in that: The step of uploading the encryption result further includes the following sub-steps: If the generation time difference is greater than the reference time difference, the decryption result is first signed and then encrypted to obtain an intermediate result, and the intermediate result is reported; the decryption response returned by first decrypting and then unsigning the intermediate result and then verifying the decryption result is obtained to complete the decryption operation; wherein, the complexity of signing and unsigning is adjusted according to the generation time difference, the larger the generation time difference, the higher the complexity, and the smaller the generation time difference, the lower the complexity.

4. The real-time password verification method based on network status according to claim 2 is characterized in that: The step of uploading the encryption result further includes the following sub-steps: If the generation time difference is less than the reference time difference, and the fluctuation amplitudes of the most recent multiple generation time differences are within the preset fluctuation reference range, the decryption result is first signed and then encrypted to obtain an intermediate result, and the intermediate result is reported; the decryption response returned by first decrypting and then unsigning the intermediate result and then verifying the decryption result is obtained to complete the decryption operation; wherein, the complexity of encryption and decryption is adjusted according to the generation time difference, the larger the generation time difference, the higher the complexity, and the smaller the generation time difference, the lower the complexity.

5. The real-time password verification method based on network status according to claim 2 is characterized in that: The method further comprises the steps of: If the current state data or the temporary state data is good, the old password is verified for the password change strategy using a network line with good data status, and the first online network verification with the server is performed; after the verification is successful, the password change operation is performed, the old password is updated with the new password, and then the new password is verified, and the second online network verification with the server is performed; after the new password verification is successful, a password change result is generated, the application connection pool is refreshed, and the third online network verification with the server is performed; Upload the encryption result; The evaluation value is calculated based on the results of three online network verifications; Calculate the dispersion coefficient of multiple evaluation values ​​within the most recent set time period; if the dispersion coefficient is greater than a preset threshold, issue a network warning prompt.

6. The real-time password verification method based on network status according to claim 5 is characterized in that: The method also includes: If the dispersion coefficient is less than or equal to a preset threshold, the average value of multiple evaluation values ​​within the most recent set time period is calculated; The reference time difference is adjusted according to the average value of the evaluation value. The larger the average value of the evaluation value is, the larger the reference time difference is; and the smaller the average value of the evaluation value is, the smaller the reference time difference is.

7. The real-time password verification method based on network status according to claim 5 is characterized in that: The method also includes: If the dispersion coefficient is less than or equal to a preset threshold, a random number of m evaluation values ​​are recorded within a recently set time period, a random number of n evaluation values ​​are extracted from the m evaluation values, and the average value of the extracted n evaluation values ​​is calculated as a random average value; wherein n is less than m; The reference time difference is adjusted according to the random average value. The larger the random average value is, the larger the reference time difference is; the smaller the random average value is, the smaller the reference time difference is.

8. The real-time password verification method based on network status according to claim 5 is characterized in that: The method also includes: If the discrete coefficient is less than or equal to a preset threshold, the encryption window period is adjusted according to the discrete coefficient. The larger the discrete coefficient is, the longer the encryption window period is; the smaller the discrete coefficient is, the shorter the encryption window period is. The encryption window period refers to a specific time period in which the system allows the encryption operation to be performed when the password is changed.

9. A real-time password verification system based on network status, characterized in that: It comprises a processor, wherein the processor executes the steps of the real-time password verification method based on network status as described in any one of claims 1-8.

10. A storage medium, characterized in that: The medium stores a program, and when the program is executed by the processor, the steps of the real-time password verification method based on network status described in any one of claims 1 to 8 are implemented.

Images