Privilege escalation processing method, device, storage medium and electronic device

Abstract

The present disclosure provides a privilege escalation processing method, device, storage medium and electronic device, which relate to the field of computer technology, wherein the privilege escalation processing method includes: sending a device identification of a user device to a domain control server, so that the domain control server determines whether the user device is a trusted device based on the device identification; receiving a domain control administrator account sent by the domain control server when determining that the user device is a trusted device, and creating a user privilege escalation account for the user device based on the domain control administrator account; in response to obtaining a privilege escalation request for a privilege escalation trigger operation corresponding to a target permission, sending a verification request to the domain control server, and receiving a verification result corresponding to the verification request returned by the domain control server; if the verification result is passed, the operation corresponding to the target permission is allowed to be performed through the user privilege escalation account. The present disclosure realizes automatic privilege escalation by constructing a user privilege escalation account to improve the convenience of user privilege escalation operations.

Description

Background Art

[0002] When the user device is in a domain control scenario, that is, the user device in the network needs to be controlled by the domain control server for access, the user device sometimes needs to use the domain control administrator privileges to perform certain operations, and at this time, it is necessary to perform privilege escalation operations.

[0003] In the related art, when the user device is in the domain control state, it is necessary to manually enter the domain control administrator account to perform the privilege escalation operation. Since the domain control server is out of the domain, when the user device is out of the domain, if it wants to continue the privilege escalation operation, it is necessary to re-enter the domain control administrator account, so that the domain control server can rejoin the domain control network before performing the privilege escalation operation. The privilege escalation method is not convenient enough.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a privilege escalation processing method, a privilege escalation processing device, a computer-readable storage medium and an electronic device, thereby at least to a certain extent solving the problem that privilege escalation in the related art is not convenient enough.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of the present disclosure, a privilege escalation processing method is provided, comprising: sending a device identification of a user device to a domain control server, so that the domain control server determines whether the user device is a trusted device based on the device identification; receiving a domain control administrator account sent by the domain control server when determining that the user device is a trusted device, and creating a user privilege escalation account for the user device based on the domain control administrator account; in response to obtaining a privilege escalation request for a privilege escalation trigger operation corresponding to a target permission, sending a verification request to the domain control server, and receiving a verification result corresponding to the verification request returned by the domain control server; if the verification result is passed, allowing the operation corresponding to the target permission to be performed through the user privilege escalation account.

[0008] In an exemplary embodiment of the present disclosure, the obtaining of a privilege escalation request for a privilege escalation trigger operation corresponding to a target permission includes: detecting that a user requests a privilege escalation trigger operation corresponding to the target permission.

[0009] In an exemplary embodiment of the present disclosure, in response to obtaining a privilege escalation request for a privilege escalation trigger operation corresponding to a target permission, sending a verification request to the domain control server, so that the domain control server verifies the privilege escalation trigger operation corresponding to the target permission according to the verification request, and receiving a verification result corresponding to the verification request returned by the domain control server, including: when it is detected that a user initiates the privilege escalation trigger operation in the target software, generating ciphertext parameters based on characteristic parameters corresponding to the target software, and adding the ciphertext parameters to the verification request, the characteristic parameters including information of the user privilege escalation account; sending the verification request to the domain control server, so that the domain control server verifies the ciphertext parameters in the verification request; receiving the verification result returned by the domain control server, the verification result including whether the user privilege escalation account is allowed to perform the privilege escalation operation and whether the target software is legal.

[0010] In an exemplary embodiment of the present disclosure, the method further includes: after creating the user privilege escalation account, sending information of the user privilege escalation account to the domain control server, so that the domain control server verifies the ciphertext parameters according to the information of the user privilege escalation account.

[0011] In an exemplary embodiment of the present disclosure, the method further includes: maintaining the user privilege escalation account according to privilege escalation status information obtained from the domain control server.

[0012] In an exemplary embodiment of the present disclosure, the user privilege escalation account is maintained according to the privilege escalation status information obtained from the domain control server, including: if the privilege escalation status information indicates that the user device is prohibited from performing privilege escalation operations, deleting the user privilege escalation account.

[0013] In an exemplary embodiment of the present disclosure, the maintaining of the user privilege escalation account according to the privilege escalation status information obtained from the domain control server also includes: if the privilege escalation status information indicates that the user privilege escalation account is prohibited from performing privilege escalation operations, deleting the user privilege escalation account and creating a new user privilege escalation account for the user device.

[0014] In an exemplary embodiment of the present disclosure, the maintenance of the user escalation account based on the escalation status information obtained from the domain control server also includes: if the escalation status information indicates that the user escalation account is allowed to perform escalation operations, resetting the password of the user escalation account at a preset time period and encrypting and storing the password.

[0015] According to a second aspect of the present disclosure, there is provided a privilege escalation processing apparatus, comprising: an interaction module, configured to send a device identification of a user device to a domain control server, so that the domain control server determines whether the user device is a trusted device based on the device identification; an account creation module, configured to receive a domain control administrator account sent by the domain control server when determining that the user device is a trusted device, and to create a user privilege escalation account for the user device based on the domain control administrator account; a verification initiation module, configured to initiate a verification request to the domain control server in response to obtaining a privilege escalation trigger operation corresponding to a target permission, so that the domain control server verifies the privilege escalation trigger operation corresponding to the target permission according to the verification request, and receives a verification result corresponding to the verification request returned by the domain control server; and a privilege escalation execution module, configured to allow the operation corresponding to the target permission to be performed through the user privilege escalation account if the verification result is passed.

[0016] According to a third aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned privilege escalation processing method is implemented.

[0017] According to a fourth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-mentioned privilege escalation processing method by executing the executable instructions.

[0018] The technical solution disclosed in this disclosure has the following beneficial effects:

[0019] In the above privilege escalation process, the domain controller account is used to create a user privilege escalation account. By maintaining the user privilege escalation account, the user device can automatically escalate privileges, without having to manually enter the domain controller password to escalate privileges each time. This can reduce the workload of manual operations and improve the convenience of privilege escalation. In addition, by judging the credibility of the user device and verifying the user privilege escalation trigger operation, the security and legality of the privilege escalation operation can also be ensured.

[0020] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and are used together with the specification to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A system architecture diagram showing the operating environment of the exemplary embodiment;

[0023] Figure 2 A flowchart of a privilege escalation processing method in this exemplary embodiment is shown;

[0024] Figure 3 A system architecture diagram for creating a user privilege escalation account in this exemplary embodiment is shown;

[0025] Figure 4 A flowchart of verifying a privilege escalation trigger operation corresponding to a target privilege in this exemplary embodiment is shown;

[0026] Figure 5 A system architecture diagram for performing privilege escalation based on a user privilege escalation account in this exemplary embodiment is shown;

[0027] Figure 6 A system architecture diagram for maintaining a user privilege escalation account in this exemplary embodiment is shown;

[0028] Figure 7 A structural block diagram of a privilege escalation processing device in this exemplary embodiment is shown;

[0029] Figure 8 An electronic device for implementing the above method in this exemplary embodiment is shown. DETAILED DESCRIPTION

[0030] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0031] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0032] In the related art, when the domain controller server is not connected to the domain controller network for a long time, it may be out of the domain. Once the domain controller server is out of the domain, the domain controller administrator account cannot be elevated. It is necessary to manually re-enter the domain controller administrator account to make the domain controller server rejoin the domain controller network, and then perform the elevation operation. Automatic elevation of privileges cannot be achieved.

[0033] In view of one or more of the above problems, an exemplary embodiment of the present disclosure provides a privilege escalation processing method, which can be applied to controlled devices in a domain control environment within an enterprise. Domain control refers to a logical set of users and computer devices on a network. A network can establish one or more domains, each domain is a security boundary, and the settings of various permissions cannot cross different domains. In addition, the processing method can be deployed on a user device in the form of a software toolkit, so that the processing method can be executed by starting the software toolkit.

[0034] Figure 1 The system architecture diagram of the operating environment of the method is shown, including a user device 110 and a domain control server 120. The user device 110 can be a user terminal device such as a computer or a mobile phone in a domain control environment, which is used to execute the above processing method; the domain control server 120 can be a background domain control computer or server, which is responsible for a series of verification tasks of user devices connected to the domain control network.

[0035] Figure 2 The schematic flow of the privilege escalation processing method in this exemplary embodiment is shown, including the following steps S210 to S240:

[0036] Step S210, sending the device identification of the user device to the domain control server, so that the domain control server determines whether the user device is a trusted device based on the device identification;

[0037] Step S220, receiving the domain controller administrator account sent by the domain controller server when determining that the user device is a trusted device, and creating a user privilege escalation account for the user device based on the domain controller administrator account;

[0038] Step S230, in response to obtaining the privilege escalation request of the privilege escalation trigger operation corresponding to the target privilege, sending a verification request to the domain control server, and receiving a verification result corresponding to the verification request returned by the domain control server;

[0039] Step S240: If the verification result is passed, the user's privileged account is allowed to perform operations corresponding to the target permissions.

[0040] In the above privilege escalation process, the domain controller account is used to create a user privilege escalation account. By maintaining the user privilege escalation account, the user device can automatically escalate privileges without having to manually enter the domain controller password to escalate privileges, which can reduce the workload of manual operations and improve the convenience of privilege escalation. In addition, by judging the credibility of the user device and verifying the user privilege escalation trigger operation, the security and legality of the privilege escalation operation can also be ensured.

[0041] The following are Figure 1 Each step in the procedure is described in detail.

[0042] Step S210: Send the device identification of the user device to the domain control server, so that the domain control server determines whether the user device is a trustworthy device based on the device identification.

[0043] User devices have a unique device ID that can be used to distinguish other devices. Trusted devices refer to legal and available devices that are allowed to create local privileged accounts. Domain control servers are mainly used to centrally manage user devices. In order to enable specific user devices to run specific software functions according to enterprise requirements, the legitimacy of user devices connected to the domain control network needs to be verified. Here, the device ID can be used to determine whether the user device is a trusted device.

[0044] When judging whether a user device is a trustworthy device based on the device identification of the user device, the domain control server can achieve this by maintaining a device whitelist / device blacklist. The device whitelist / device blacklist contains identification information of various devices, and whether the user device is trustworthy is judged by detecting whether the user device identification is included in the device whitelist / device blacklist.

[0045] Taking the configuration of the device whitelist on the domain control server as an example, the domain control server determines whether the user device is included in the device whitelist of the domain control server based on the device identifier. When the user device is included in the device whitelist of the domain control server, the user device is considered to be a trusted device and can be further used to create a user privilege escalation account device. The domain control server maintains the device whitelist and adds trusted user devices to the device whitelist. When the user device is prohibited from privilege escalation or is an untrusted device, the user device is deleted from the device whitelist.

[0046] Taking the domain control server configuration device blacklist as an example, the domain control server determines whether the user device is included in the domain control server's device blacklist based on the device identifier. When the user device is not included in the domain control server's device blacklist, the user device is considered to be a trusted device and can be further used to create a user privilege escalation account device. The domain control server maintains the device blacklist. When a user device is prohibited from privilege escalation or is an untrusted device, the user device is added to the device name blacklist.

[0047] The above process determines whether the user device is credible by interacting with the domain control server, which can achieve unified management of the legitimacy of the user device, and is simple to operate and easy to maintain.

[0048] Step S220: receiving a domain controller administrator account sent by the domain controller server when determining that the user device is a trusted device, and creating a user privilege escalation account for the user device based on the domain controller administrator account.

[0049] The user privilege escalation account refers to the account used by the user device to escalate privileges. The domain controller administrator account is an account that can execute higher permissions and can be used to create a user privilege escalation account. When the user device is a trusted device, the domain controller administrator account can be obtained by calling the encrypted interface of the domain controller server to ensure the security of the domain controller administrator account, and the account name and account password of the domain controller administrator account can be used to encapsulate the account name and account password of a user extraction account, which can be managed by the program to achieve automatic privilege escalation.

[0050] It should be noted that before executing the above steps S210 and S220, it can be pre-determined whether the current device used by the user has a corresponding user escalation account. When there is a user escalation account, there is no need to create a new user escalation account, and subsequent escalation operations can be performed based on the user escalation account; when there is no user escalation account, it is necessary to create a user escalation account.

[0051] In addition, when the user who logs in to the user device does not have a domain controller account, a user privilege escalation account can be automatically created through the above steps S110 to S120. When the user who logs in to the user device has a domain controller account, a user privilege escalation account can be directly created through the domain controller account of the current user who logs in to the user device. Figure 3As shown, a system framework diagram for creating a user privilege escalation account is given, which includes two modes: the login person does not have a domain controller administrator account 301 and the login person has a domain controller administrator account 302. In the mode of the login person does not have a domain controller administrator account 301, the device identification of the user device is sent to the domain control server, and the domain control server determines whether the user device is in the device whitelist / device blacklist to determine whether the user device is a trusted device. The domain control server returns the judgment result to the user device. When the user device is a trusted device, the domain controller administrator account is obtained from the domain control server to create a user privilege escalation account; in the mode of the login person has a domain controller administrator account 302, the user privilege escalation account is directly created.

[0052] Step S230, in response to obtaining the privilege escalation request of the privilege escalation trigger operation corresponding to the target privilege, sending a verification request to the domain control server, and receiving a verification result corresponding to the verification request returned by the domain control server.

[0053] Privilege escalation refers to the process of elevating the privileges of the current user of the device, that is, from ordinary user privileges to system administrator privileges. The target privilege refers to the higher privilege that the user can access after privilege escalation. The privilege escalation trigger operation can be the user's startup operation of the software or program. The privilege escalation request here refers to the request generated by the user on the user device by executing the privilege escalation trigger operation. The verification request here refers to the verification request generated for whether the target privilege can be accessed. This ensures that the operation of accessing the target privilege is performed under the premise of being allowed.

[0054] In an optional implementation, obtaining a privilege escalation request for a privilege escalation trigger operation corresponding to a target permission includes: detecting that a user requests a privilege escalation trigger operation corresponding to the target permission.

[0055] In the above process, when a privilege escalation trigger operation is detected, the corresponding privilege escalation request is automatically generated, and the privilege escalation request is triggered by the user's operation, thereby automating the privilege escalation process and avoiding the need to manually enter the domain controller administrator password to escalate privileges every time.

[0056] In an optional implementation, in response to obtaining a privilege escalation request for a privilege escalation trigger operation corresponding to a target permission, a verification request is sent to a domain control server, so that the domain control server verifies the privilege escalation trigger operation corresponding to the target permission according to the verification request, and receives a verification result corresponding to the verification request returned by the domain control server, which can be achieved by Figure 4 The steps shown in the figure are implemented, specifically including the following steps S410 to S430:

[0057] Step S410, when it is detected that the user initiates a privilege escalation trigger operation in the target software, a ciphertext parameter is generated based on the characteristic parameter corresponding to the target software, and the ciphertext parameter is added to the verification request, and the characteristic parameter includes information of the user privilege escalation account;

[0058] Step S420, sending the verification request to the domain control server, so that the domain control server verifies the ciphertext parameters in the verification request;

[0059] Step S430, receiving the verification result returned by the domain control server, the verification result includes whether the user privilege escalation account is allowed to perform privilege escalation operations and whether the target software is legal.

[0060] The target software refers to the user-side carrier of the target permission to be accessed, and the target software can be software downloaded from the domain control server and installed on the user's device. The characteristic parameters may include information of the user's privilege escalation account, and may also include parameters such as the user device identifier, the identification information of the target software, and the session identifier. The ciphertext parameter refers to the ciphertext-related information of the characteristic parameter, and may include the hash value of the identification information of the target software, and the ciphertext field generated by the characteristic parameters such as the user's privilege escalation account, user device identifier, and session identifier, so that the domain control server can verify the legitimacy of the ciphertext parameter. The verification result refers to the result of the domain control server verifying the ciphertext parameter.

[0061] The software that can elevate privileges corresponding to the user device can be set in advance in the domain control server and configured in the form of a software whitelist. The domain control server can determine the authenticity of the target software by verifying the hash value of the target software identification information and verify whether the target software is in the software whitelist. When the target software is in the software whitelist, the domain control server can determine that the target software is legal.

[0062] In addition, the domain control server can verify through the ciphertext field whether the user privilege escalation account used on the current user device has the authority to perform privilege escalation operations.

[0063] exist Figure 4 In the steps shown, the legitimacy of the ciphertext parameters is verified by the domain control server to determine whether the privilege escalation operation is allowed to be performed, thereby ensuring the legitimacy of the user's privilege escalation operation.

[0064] In an optional implementation, after the user privilege escalation account is created, information about the user privilege escalation account is sent to a domain control server, so that the domain control server verifies the ciphertext parameters according to the information about the user privilege escalation account.

[0065] After the user escalation account is created, the relevant information generated during the creation of the user escalation account can be used to generate account creation log information, and the log can be sent to the domain control server, which stores the account creation log information so that the domain control server can manage the user escalation account and verify the user escalation account corresponding to the escalation request.

[0066] Step S240: If the verification result is passed, the user's privileged account is allowed to perform operations corresponding to the target permissions.

[0067] If the verification result fails, the privilege escalation request fails and the privilege escalation request is abandoned.

[0068] like Figure 5 As shown, a system framework diagram for using a user privilege escalation account to escalate privileges is provided. When it is detected that a user initiates a privilege escalation trigger operation in the target software, two execution modes are included: the logged-in person does not have a domain controller account 501 and the logged-in person has a domain controller account 502. In the mode 501 where the logged-in person does not have a domain controller account, the ciphertext parameters are first determined based on the characteristic information of the target software, and the ciphertext parameters are added to the verification request; and the verification request is sent to the domain controller server, which performs the verification. When the verification result passes, the operation corresponding to the target permission is performed based on the user privilege escalation account; in the mode where the logged-in person has a domain controller account 502, the operation corresponding to the target permission can be performed directly based on the domain controller account.

[0069] In an optional implementation, after the operation corresponding to the target permission is executed, privilege escalation log information may be generated and sent to the domain control server.

[0070] Privilege escalation log information refers to the log information generated for privilege escalation related information such as the time, object, device, and user of the privilege escalation. It can be recorded and saved by the domain control server so that the domain control server can monitor and manage the user's privilege escalation operations, which is conducive to problem finding and maintenance.

[0071] In an optional implementation, the user's privilege escalation account may also be maintained according to the privilege escalation status information obtained from the domain control server.

[0072] The privilege escalation permission status refers to whether the user device and the corresponding user privilege escalation account are allowed to perform privilege escalation operations. After performing the maintenance operation, account maintenance log information can be generated and sent to the domain control server. The account maintenance log information here refers to the log information generated for operations such as creation, deletion, and password change of the user privilege escalation account, which can be recorded and saved by the domain control server. The account maintenance here is mainly to ensure the validity and security of the user privilege escalation account.

[0073] In an optional implementation, the above-mentioned maintaining the user privilege escalation account according to the privilege escalation status information obtained from the domain control server may include: if the privilege escalation status information indicates that the user device is prohibited from performing privilege escalation operations, deleting the user privilege escalation account.

[0074] The domain control server can add the user device to the device blacklist or remove it from the device whitelist, so that the user device is prohibited from performing privilege escalation operations. In this case, the user privilege escalation account corresponding to the user device can be deleted to clean up useless account information in a timely manner.

[0075] In an optional implementation, the user escalation account is maintained based on the escalation status information obtained from the domain control server, and may also include: if the escalation status information indicates that the user escalation account is prohibited from performing escalation operations, the user escalation account is deleted and a new user escalation account is created for the user device.

[0076] The domain control server can add the user privilege escalation account to the domain control server's account blacklist or remove it from the account whitelist. The user privilege escalation account added to the account blacklist or removed from the account whitelist is prohibited from performing privilege escalation operations. In this case, the user privilege escalation account is deleted and a new user privilege escalation account is created, which can realize the management of user privilege escalation accounts and timely update invalid, useless, and banned accounts.

[0077] In an optional implementation, the user's elevated privilege account is maintained based on the elevated privilege status information obtained from the domain control server, and may also include: if the elevated privilege status information indicates that the user's elevated privilege account is allowed to perform elevated privilege operations, resetting the password of the user's elevated privilege account at a preset time period and encrypting and storing the password.

[0078] The password of the created user privilege escalation account can be stored in the user database through encrypted storage means, and the password of the user privilege escalation account can be reset regularly through the database to ensure the security of the account information.

[0079] like Figure 6 As shown, a system architecture diagram for maintaining user privilege escalation accounts is provided, including account maintenance methods under three privilege escalation status modes: user device is prohibited from privilege escalation 601, user privilege escalation account is prohibited from privilege escalation 602, and user privilege escalation account is allowed to privilege escalate 603.

[0080] In the user device prohibited privilege escalation mode 601, delete the user privilege escalation account; in the user privilege escalation account prohibited privilege escalation mode 602, delete the user privilege escalation account and create a new user privilege escalation account; in the user privilege escalation account allowed privilege escalation mode 603, use the user privilege escalation account to reset the account password regularly.

[0081] It should be noted that when the network request fails during the above maintenance process, no processing will be performed on the user's privilege escalation account.

[0082] In the actual implementation process, the above privilege escalation method can be implemented by automatically developing two programs. The first program is responsible for the creation and maintenance of the user privilege escalation account system; the second program is responsible for privilege escalation operations, and the user privilege escalation account created by the first program can be used for privilege escalation. These two programs can be installed on the user's device.

[0083] The first program can specifically perform the following operations: communicate with the domain control server to determine whether the current device is a trusted device. If it is a trusted device, then create a user privilege escalation account through the domain control administrator account. The account name can be the unique device identifier of the current device or a random user identifier, and the account password is encrypted and stored in the user database. According to the creation time period in the database, the program regularly updates the password, for example, resetting the password once a month.

[0084] When the user initiates a privilege escalation trigger operation in the target software, the second program can be started, and the second program obtains the verification result by interacting with the domain control server. The verification result can include two parts: whether the user has the authority to apply for the privilege escalation operation; whether the target software is included in the software whitelist. If both are passed, the privilege escalation operation is performed. If not, the operation is abandoned and the privilege escalation execution result is returned to the domain control server, and finally logged.

[0085] The exemplary embodiment of the present disclosure also provides a privilege escalation processing device, such as Figure 7 As shown, the privilege escalation processing device 700 may include:

[0086] An interaction module 710 is used to send a device identification of the user device to the domain control server, so that the domain control server determines whether the user device is a trusted device based on the device identification;

[0087] The account creation module 720 is used to receive the domain controller administrator account sent by the domain controller server when determining that the user device is a trusted device, and create a user privilege escalation account for the user device based on the domain controller administrator account;

[0088] The verification initiation module 730 is used to initiate a verification request to the domain control server in response to obtaining a privilege escalation trigger operation corresponding to the target permission, so that the domain control server verifies the privilege escalation trigger operation corresponding to the target permission according to the verification request, and receives a verification result corresponding to the verification request returned by the domain control server;

[0089] The privilege escalation execution module 740 is used to allow the user privilege escalation account to perform operations corresponding to the target permissions if the verification result is passed.

[0090] In an optional implementation, the verification initiation module 730 obtains the privilege escalation request corresponding to the privilege escalation trigger operation of the target permission, which can be configured as follows: detecting the privilege escalation trigger operation corresponding to the user requesting the target permission.

[0091] In an optional embodiment, the verification initiation module 730 can also be configured as follows: when it is detected that a user initiates a privilege escalation trigger operation in the target software, a ciphertext parameter is generated based on the characteristic parameters corresponding to the target software, and the ciphertext parameter is added to the verification request, the characteristic parameters including information of the user's privilege escalation account; the verification request is sent to the domain control server so that the domain control server verifies the ciphertext parameter in the verification request; and the verification result returned by the domain control server is received, the verification result including whether the user's privilege escalation account is allowed to perform the privilege escalation operation and whether the target software is legal.

[0092] In an optional implementation, the privilege escalation processing device 700 further includes: an information sending module, which is used to send the information of the user privilege escalation account to the domain control server after creating the user privilege escalation account, so that the domain control server verifies the ciphertext parameters according to the information of the user privilege escalation account.

[0093] In an optional implementation, the privilege escalation processing device 700 further includes: an account maintenance module, configured to maintain the user privilege escalation account according to privilege escalation status information obtained from the domain control server.

[0094] In an optional implementation, the account maintenance module may also be configured to: if the privilege escalation status information indicates that the user device is prohibited from performing privilege escalation operations, delete the user privilege escalation account.

[0095] In an optional implementation, the account maintenance module may also be configured to: if the privilege escalation status information indicates that the user privilege escalation account is prohibited from performing privilege escalation operations, delete the user privilege escalation account and create a new user privilege escalation account for the user device.

[0096] In an optional implementation, the account maintenance module may also be configured to: if the privilege escalation status information indicates that the user privilege escalation account is allowed to perform privilege escalation operations, reset the password of the user privilege escalation account at a preset time period and encrypt and store the password.

[0097] The specific details of each part of the above-mentioned privilege escalation processing device 700 have been described in detail in the implementation method part. The undisclosed details can be found in the implementation method part, so they will not be repeated here.

[0098] The exemplary embodiments of the present disclosure also provide a computer-readable storage medium on which a program product capable of implementing the privilege escalation processing method described above in this specification is stored. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on an electronic device, the program code is used to cause the electronic device to execute the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present disclosure. The program product may be in the form of a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on an electronic device, such as a personal computer. However, the program product of the present disclosure is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0099] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0100] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0101] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0102] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0103] The exemplary embodiment of the present disclosure also provides an electronic device capable of implementing the above-mentioned privilege escalation processing method. Figure 8 800 according to this exemplary embodiment of the present disclosure will be described. Figure 8 The electronic device 800 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0104] like Figure 8 As shown, the electronic device 800 may be in the form of a general-purpose computing device. The components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810), and a display unit 840.

[0105] The storage unit 820 stores program codes, which can be executed by the processing unit 810, so that the processing unit 810 executes the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 810 can execute Figure 1 , Figure 2 , Figure 4 Any one or more method steps.

[0106] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 821 and / or a cache memory unit 822 , and may further include a read-only memory unit (ROM) 823 .

[0107] The storage unit 820 may also include a program / utility 824 having a set (at least one) of program modules 825, such program modules 825 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0108] Bus 830 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0109] The electronic device 800 may also communicate with one or more external devices 900 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 800, and / or communicate with any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 850. Furthermore, the electronic device 800 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 860. As shown, the network adapter 860 communicates with other modules of the electronic device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0110] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the exemplary implementation of the present disclosure.

[0111] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiment of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0112] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the exemplary embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0113] It will be appreciated by those skilled in the art that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or implementations combining hardware and software aspects, which may be collectively referred to herein as "circuit", "module" or "system". Those skilled in the art will readily think of other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any variations, uses or adaptive changes of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and implementation are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0114] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A privilege escalation processing method, characterized in that: include: Sending a device identification of the user device to a domain control server, so that the domain control server determines whether the user device is a trusted device based on the device identification; receiving a domain controller administrator account sent by the domain controller server when determining that the user device is a trusted device, and creating a user privilege escalation account for the user device based on the domain controller administrator account; In response to obtaining a privilege escalation request for a privilege escalation trigger operation corresponding to a target privilege, sending a verification request to the domain control server, and receiving a verification result corresponding to the verification request returned by the domain control server; If the verification result is passed, the operation corresponding to the target permission is allowed to be performed through the user privilege escalation account; Wherein, in response to obtaining the privilege escalation request of the privilege escalation trigger operation corresponding to the target permission, sending a verification request to the domain control server, so that the domain control server verifies the privilege escalation trigger operation corresponding to the target permission according to the verification request, and receiving the verification result corresponding to the verification request returned by the domain control server, includes: When it is detected that the user initiates the privilege escalation trigger operation in the target software, a ciphertext parameter is generated based on the characteristic parameter corresponding to the target software, and the ciphertext parameter is added to the verification request, wherein the characteristic parameter includes information of the user privilege escalation account; the target software refers to the user-side carrier of the target permission accessed; Sending the verification request to the domain control server, so that the domain control server verifies the ciphertext parameter in the verification request; Receive the verification result returned by the domain control server, the verification result including whether the user privilege escalation account is allowed to perform privilege escalation operations and whether the target software is legal.

2. The method according to claim 1, characterized in that The obtaining of the privilege escalation request for the privilege escalation triggering operation corresponding to the target privilege includes: A privilege escalation trigger operation corresponding to a user requesting the target privilege is detected.

3. The method according to claim 1, characterized in that The method further comprises: After the user privilege escalation account is created, information of the user privilege escalation account is sent to the domain control server, so that the domain control server verifies the ciphertext parameter according to the information of the user privilege escalation account.

4. The method according to claim 1, characterized in that: The method further comprises: The user privilege escalation account is maintained according to the privilege escalation status information obtained from the domain control server.

5. The method according to claim 4, characterized in that The maintaining of the user privilege escalation account according to the privilege escalation status information obtained from the domain control server includes: If the privilege escalation status information indicates that the user device is prohibited from performing privilege escalation operations, the user privilege escalation account is deleted.

6. The method according to claim 4, characterized in that The maintaining of the user privilege escalation account according to the privilege escalation status information obtained from the domain control server also includes: If the privilege escalation status information indicates that the user privilege escalation account is prohibited from performing privilege escalation operations, the user privilege escalation account is deleted, and a new user privilege escalation account is created for the user device.

7. The method according to claim 4, characterized in that The maintaining of the user privilege escalation account according to the privilege escalation status information obtained from the domain control server also includes: If the privilege escalation status information indicates that the user privilege escalation account is allowed to perform privilege escalation operations, the password of the user privilege escalation account is reset at a preset time period, and the password is encrypted and stored.

8. A privilege escalation processing device, characterized in that: include: An interaction module, configured to send a device identification of a user device to a domain control server, so that the domain control server determines whether the user device is a trusted device based on the device identification; An account creation module, configured to receive a domain controller administrator account sent by the domain controller server when determining that the user device is a trusted device, and create a user privilege escalation account for the user device based on the domain controller administrator account; A verification initiation module is used to initiate a verification request to the domain control server in response to obtaining a privilege escalation trigger operation corresponding to the target permission, so that the domain control server verifies the privilege escalation trigger operation corresponding to the target permission according to the verification request, and receives a verification result corresponding to the verification request returned by the domain control server; A privilege escalation execution module, used for allowing the user privilege escalation account to perform the operation corresponding to the target permission if the verification result is passed; The verification initiation module is configured as follows: When it is detected that the user initiates the privilege escalation trigger operation in the target software, a ciphertext parameter is generated based on the characteristic parameter corresponding to the target software, and the ciphertext parameter is added to the verification request, wherein the characteristic parameter includes information of the user privilege escalation account; The target software refers to the user-side carrier of the target permission accessed; Sending the verification request to the domain control server, so that the domain control server verifies the ciphertext parameter in the verification request; Receive the verification result returned by the domain control server, the verification result including whether the user privilege escalation account is allowed to perform privilege escalation operations and whether the target software is legal.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 7 by executing the executable instructions.

Images