A privilege account authentication method and system based on a dynamic security environment

Abstract

The application discloses a kind of privilege account authentication methods based on dynamic security environment, comprising: S1, application scene information is collected and the security environment level of application scene is determined;S2, determine account category, account category includes privilege account, dangerous account and ordinary account;S3, for the account category of account category, privilege account authentication is carried out based on security environment level.The application also discloses a kind of privilege account authentication systems based on dynamic security environment, comprising: background management portal, resource management module and log management module, centralized identity authentication module, data safe, encryption machine and client comprising dynamic password plug-in, and corresponding electronic equipment and computer readable storage medium are also disclosed.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer security authentication and dynamic password authentication, and in particular relates to a privileged account authentication method and system based on a dynamic security environment. Background Art

[0002] With the development of the internet, dynamic password authentication system projects have emerged to meet the identity security authentication needs of operators, financial companies, and other organizations. These projects primarily focus on online banking, online gaming, mobile payment, internal enterprise login, and telecommunications self-operated business authentication. Dynamic password authentication is built on top of web applications, utilizing the HTTP protocol for communication. The web server uses Tomcat, and the database server uses Oracle. The dynamic password authentication system is based on the J2EE architecture and is complex. OTP (One-time Password, also known as dynamic password) includes three dynamic password algorithms: time-based, counter-based, and challenge-response-based. Regardless of the authentication method, the user's corresponding information, including seed information, integrated circuit card number, and other data, must first be retrieved from the database before a hash operation is performed. Therefore, for a large number of concurrent requests, the IPT system must perform extensive database operations to query and update data. In addition, the number of users of the OTP system is still relatively limited. They are more concerned about the correctness and security of password authentication operations, but have not given much consideration to whether the system can still maintain efficient operation when there are a large number of users, different account privileges, frequent concurrent requests, and a dynamically changing security environment. There is currently no OTP system for multiple application environments with different security levels. Under the premise of ensuring high security of user authentication, an efficient solution with excellent privileged account authentication security, throughput, and response speed in the case of high concurrent requests has been designed. Summary of the Invention

[0003] The purpose of the present invention is to provide a privileged account authentication method and system based on a dynamic security environment. It is a server privileged account and password management tool for server administrators, designed with operating system privileged account and password management as the design goal. It can help server administrators efficiently and safely sort out privileged accounts and permissions across the entire network while ensuring excellent privileged account authentication security, throughput, and response speed, distinguish between privileged accounts, dangerous accounts, and ordinary accounts, grasp privileged account login activities, and use dynamic password technology to solve the daily operation and maintenance efficiency and security issues of privileged account passwords.

[0004] The present invention provides a privileged account authentication method based on a dynamic security environment, comprising:

[0005] S1, collect application scenario information and determine the security environment level of the application scenario;

[0006] S2, determining the account category, which includes privileged accounts, dangerous accounts, and ordinary accounts;

[0007] S3: Perform privileged account authentication on the account type that is a privileged account based on the security environment level.

[0008] Preferably, the security environment level of S1 includes: application scenarios of high security level environment and application scenarios of medium and low security level environment; the application scenarios of high security level environment include online banking login and mobile payment authentication; the application scenarios of medium and low security level environment include online game login authentication, internal enterprise login and Wi-Fi access login authentication.

[0009] Preferably, the step of performing privileged account authentication based on the security environment level in S3 includes:

[0010] S31, loading a one-to-many password generation algorithm. The one-to-many password generation algorithm is designed based on an encrypted seed key. The same account can have different dynamic passwords on different servers.

[0011] S32, generating a dynamic password based on the token;

[0012] S33, selecting a dynamic password generation factor as a dynamic password weight based on the security level;

[0013] S34, establish a multi-factor secure identity authentication mechanism, including a combination of a static password memorized by the user and a dynamic password generated based on a token in S32, to achieve multiple identity authentication insurance for privileged accounts;

[0014] S35, after receiving the authentication, a temporary session key is generated for each comprehensive password, and is timestamped and stored in the disaster recovery server for later audit and verification.

[0015] Preferably, the one-to-many password generation algorithm includes:

[0016] (1) Generate a seed key: The client generates a seed key using a true random number method. In this embodiment, the seed key is preferably 160 bits.

[0017] (2) Encrypt the seed key: The client uses the seed key encryption tool to encrypt and sign the seed key file using a digital certificate. After encryption, only the corresponding token holder can decrypt it;

[0018] (3) Seed key decryption: The token holder completes the decryption and signature verification of the seed key file. After the seed file is decrypted, it is imported into the token holder's generation system;

[0019] (4) Writing the seed key into the token: This is done by the token holder, and the digital certificate is also used to ensure the security of the seed key;

[0020] (5) Seed key is imported into the authentication system: it becomes effective after being imported into the unified authentication system through the seed import tool. The imported seed key uses SM4 encryption to ensure the security of the seed key;

[0021] (6) Performing a secondary transformation of the seed key in the authentication system: using an activation code or random number to operate with the original seed key, thereby causing the seed key to be changed to form a new seed key, which serves as the working key of the token. The activation code or random number is generated by the authentication system, and the authentication system's seed key is updated at the same time as the token's seed key or earlier than the latter;

[0022] (7) Secondary update of token seed key: This is completed by the client access user, and is based on the same activation code or random number to update the authentication system seed key to ensure that the working seed key remains consistent after the token and authentication system seed keys are updated;

[0023] Preferably, the step S32 of generating a dynamic password based on a token includes:

[0024] (1) For high-security environment applications, use the SM3OTP algorithm or SM4OTP algorithm issued by the National Cryptography Administration as the basic encryption and decryption authentication algorithm to generate dynamic passwords;

[0025] (2) For application scenarios with medium and low security levels, use the HMAC-SHA-1 algorithm released by the Open AuThentication (oath) organization to generate dynamic passwords;

[0026] Preferably, the step S33 of selecting a dynamic password generation factor as a dynamic password weight based on the security level includes:

[0027] (1) For application scenarios with a higher security level, the password factor based on the UIM card, i.e. the integrated circuit card number ICCID, application ID and current time, is used as the dynamic password generation factor, and the dynamic password generation factor is used as the dynamic password weight;

[0028] (2) For application scenarios with medium or low security levels, the integrated circuit card number or IMSI number of the UIM card, the application ID and the current value of the counter are used as dynamic password generation factors.

[0029] Preferably, the S34 establishes a multi-factor security identity authentication mechanism, including combining the static password memorized by the user and the dynamic password generated based on the token in S32, to achieve multiple identity authentication insurance for privileged accounts, including:

[0030] (1) Receive the static password entered by the user and verify again whether it belongs to a privileged account;

[0031] (2) For privileged accounts, a static password weight is assigned to the static password, and the static password is multiplied by the static password weight to obtain a first product;

[0032] (3) Multiplying the dynamic password in S32 and the dynamic password weight in S33 to obtain a second product;

[0033] (4) The first product and the second product are added together to obtain a final comprehensive password, and privileged account authentication is performed based on comparison and identification of the comprehensive password.

[0034] A second aspect of the present invention provides a privileged account authentication system based on a dynamic security environment, comprising:

[0035] Backend management portal, used to collect application scenario information and determine the security environment level of the application scenario;

[0036] Among them: Backend management portal: provides functions such as the full life cycle management process of privileged accounts and global policy management. System administrators in the operation and maintenance team manage important stages such as the activation, change, and destruction of privileged accounts through the full life cycle management process, and help server administrators use password policies such as the length, strength, period, and replacement frequency of privileged account passwords.

[0037] The resource management module and the log management module are used to determine the account categories, which include privileged accounts, dangerous accounts and ordinary accounts;

[0038] The resource management module manages all managed servers and privileged account asset information. It also uses a scanning engine combined with operating system kernel technology to detect account information, account permissions, weak account passwords, and account intrusions.

[0039] The log management module is used to manage network-wide server login logs, system audit logs, and privileged account compliance scan logs.

[0040] A centralized identity authentication module, a data safe, an encryption machine, and a client including a dynamic password plug-in are used to perform privileged account authentication based on the security environment level for the account category of the privileged account; wherein,

[0041] The centralized identity authentication module is used to perform centralized identity authentication on the dynamic passwords of the managed servers;

[0042] The data safe adopts domestic encryption algorithm to encrypt global sensitive data, including dynamic tokens, account information and administrator's personal privacy information;

[0043] The encryption machine supports hardware encryption, which is connected to the encryption machine for key management; or supports pure software encryption, with the key managed by software;

[0044] The dynamic password plug-in is configured in the managed server or client and is used to generate and authenticate dynamic passwords.

[0045] A third aspect of the present invention provides an electronic device, comprising a processor and a memory, wherein the memory stores a plurality of instructions, and the processor is configured to read the instructions and execute the method described in the first aspect.

[0046] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a plurality of instructions, and the plurality of instructions can be read by a processor to execute the method described in the first aspect.

[0047] The method, device, electronic device, and computer-readable storage medium provided by the present invention have the following beneficial technical effects:

[0048] (1) Highly targeted

[0049] The design goal is to address the business needs of server administrators. Similar implementations, both domestically and internationally, often cover too many functions, lack specificity, and require significant implementation effort. This implementation, however, is highly targeted, specifically addressing the password management needs of server administrators. It offers high security, ease of implementation, and excellent results.

[0050] (2) Actively manage privileged accounts

[0051] It helps operations teams manage the entire lifecycle of privileged accounts, providing complete visibility into server and network device accounts. It proactively discovers accounts with various attributes and uses across the entire network, identifies potential abnormal accounts, proactively detects destructive behavior by hackers after intrusion using accounts, and proactively reports user login logs.

[0052] (3) Efficiently manage account passwords

[0053] Dynamic password technology simplifies password management. It centrally manages operating system account passwords for all servers on the network, ensuring compliance and one-time password support. System administrators can use a simple interface to manage temporary passwords, batch-change passwords across the network, automatically change passwords regularly, and restrict server administrators' access to managed servers. Traditional manual management of these tasks would be labor-intensive and prone to errors or omissions.

[0054] (4) Adopting domestic cryptographic algorithms

[0055] It supports domestic encryption algorithms SM3 and SM4, can meet domestic level protection and password use security management regulations, and has a wide range of applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 The figure is a flow chart of a privileged account authentication method based on a dynamic security environment according to a preferred embodiment of the present invention.

[0057] Figure 2 1 is a model structure diagram of a privileged account authentication method based on a dynamic security environment according to a preferred embodiment of the present invention.

[0058] Figure 3 The figure is a schematic diagram showing the principle of overcoming the centralized storage of bastion host passwords according to a preferred embodiment of the present invention.

[0059] Figure 4 The figure is a flow chart showing a method of providing unified dynamic password authentication for an application system according to a preferred embodiment of the present invention.

[0060] Figure 5 This is a structural diagram of an embodiment of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0061] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention but are not intended to limit the scope of the present invention.

[0062] A privileged account authentication method and system based on a dynamic security environment, a server privileged account and password management tool for server administrators designed with operating system privileged account and password management as the design goal, can help server administrators efficiently and securely sort out privileged accounts and permissions across the entire network while maintaining excellent privileged account authentication security, throughput, and response speed, distinguish between privileged accounts, dangerous accounts, and ordinary accounts, grasp privileged account login activities, and use dynamic password technology to solve the daily operation and maintenance efficiency and security issues of privileged account passwords.

[0063] This embodiment is designed to manage operating system account passwords and is aimed at password management for server administrators. The meanings of the technical terms used are as follows:

[0064] Backend management system: responsible for the system management of this embodiment, providing functions such as user management, token management, policy management, and audit management;

[0065] System Administrator: Use the backend management system to manage system users, tokens, policies, and audit functions.

[0066] System user: Usually a server administrator, who uses an operating system account and password generated by the account management system to log in to the managed server.

[0067] Managed server: a server in the computer room that requires password management;

[0068] Server administrator: the administrator of the managed server, that is, the user of this embodiment, who logs in to the managed server using an operating system account and a dynamic password generated by the account management system;

[0069] OS account: This is the account in the managed server's operating system. The server administrator uses this account and the dynamic password generated by the account management system to log in to the managed server.

[0070] Privileged account: A privileged account is a subset of OS accounts and is an account with super permissions in the managed server operating system.

[0071] OS account password: The account password of the managed server's operating system, which consists of a PIN code and a dynamic password. The password format is: PIN code + dynamic password.

[0072] Dynamic password: The password of the managed server is dynamically generated by a cryptographic algorithm.

[0073] PIN: A static password that protects the dynamic password. It is set by the server administrator and requires the server administrator to enter the PIN. The PIN is memorized by the server administrator.

[0074] Token: Tokens are maintained by the backend management system. Each user has one corresponding token. Token parameters include the user's master key, password change interval, and password length. The backend management system uses token parameters to generate the OS account password for the managed server managed by the user.

[0075] Example 1

[0076] See also Figure 1-4 , a privileged account authentication method based on a dynamic security environment, comprising:

[0077] S1: Collect application scenario information and determine the security environment level of the application scenario; this step is implemented through the system's backend management portal; the backend management portal provides functions such as the full lifecycle management process for privileged accounts and global policy management. System administrators in the operation and maintenance team manage important stages such as the activation, modification, and termination of privileged accounts through the full lifecycle management process, and help server administrators implement password policies such as the length, strength, expiration, and frequency of privileged account passwords.

[0078] S2, determine the account category, which includes privileged accounts, dangerous accounts, and ordinary accounts; this step is implemented by the system's resource management module and log management module; wherein:

[0079] Resource Management Module: Responsible for managing all managed servers and privileged account asset information, and through the scanning engine combined with operating system kernel technology, detects account information, account permissions, weak account passwords, and account intrusion.

[0080] Log management module: manages network-wide server login logs, system audit logs, and privileged account compliance scan logs.

[0081] In this embodiment,

[0082] (1) Obtaining information about privileged accounts across the entire network, including:

[0083] Discover all privileged accounts, including uid=0, gid=0, root, and sudo accounts. Discover all normal accounts and locked accounts.

[0084] Discover all accounts with empty passwords, including ssh and su accounts with empty passwords. Discover non-compliant accounts, such as test accounts and zombie accounts.

[0085] Export reports provided:

[0086] Serial number Report 1 List of privileged accounts 2 Test Account Details 3 Empty Password Account Details 4 User privilege escalation log

[0087] (2) Perform OS account environment health check through the resource management module

[0088] This embodiment helps IT operations teams check network-wide OS account configurations to avoid risks to OS account security due to non-compliant configurations, such as checking / etc / passwd, / etc / shadow, / etc / group permissions, / etc / ssh / sshd_config content, and password policy compliance.

[0089] (3) OS account log management through the log management module

[0090] Record all administrator login logs to the server, including: login time, source IP, password login method, attack account, weak passwords attempted, and other detailed logs.

[0091] S3. For account categories that are privileged accounts, privileged account authentication is performed based on the security environment level. This step ensures that the authentication scheme can be used for identity authentication modules for Web logins of various websites, and can be used as a verification system in networks that do not use HTTPS (secure hypertext transfer protocol) to reduce the cost spent at the authentication center. Network devices or mobile communication network devices working in a series of insecure network channels can protect the authentication passwords of privileged accounts from being cracked during the transmission process.

[0092] From a network management perspective, the technical guarantees for improving authentication security in a dynamic security environment include:

[0093] (1) Two-way authentication: implement two-way authentication between the server and the client;

[0094] (2) Communication confidentiality: All communications between the two parties are transmitted in ciphertext over an insecure network channel;

[0095] (3) Information integrity: ensuring that information is not maliciously modified, replaced, or timed out in an insecure network channel;

[0096] (4) Security: Able to resist typical attack methods such as guessing, replay, and impersonation.

[0097] Dynamic passwords for managed servers are generated through algorithms, ensuring that password complexity and periodic replacement meet the Level 4 requirements of GBT 22239-2008 Basic Requirements for Information System Security Level Protection. This eliminates manual password recording in Excel and the resulting loss of passwords.

[0098] This step is implemented by the centralized identity authentication module, data safe, encryption machine and client including dynamic password plug-in; wherein,

[0099] Centralized identity authentication module: responsible for centralized identity authentication of dynamic passwords of managed servers.

[0100] Data safe: uses domestic encryption algorithms to encrypt global sensitive data, including dynamic tokens, account information, administrator's personal privacy information, etc.

[0101] Encryption machine: supports hardware encryption and can be connected to the encryption machine for key management; it also supports pure software encryption, with keys managed by software.

[0102] Dynamic password plug-in: configured in the managed server (client) and used to generate and authenticate dynamic passwords.

[0103] In this embodiment, step S3 implements:

[0104] (1) OS account weak password detection

[0105] In traditional password management methods, weak passwords and illegal OS accounts are detected through means such as database collision and guessing, which is inefficient. This embodiment can detect weak passwords in real time, efficiently and accurately.

[0106] With the prevalence of protocol encryption, traditional methods for detecting brute force password guessing are becoming increasingly ineffective. This embodiment can effectively and in real time determine whether brute force password guessing is occurring, as well as provide detailed logs of the time the guessing occurred, the source IP address, the password login method, the attacking account, and the weak passwords attempted.

[0107] (2) OS account intrusion and privilege escalation detection

[0108] Use cryptographic technologies such as hash algorithms and digital signatures to perform integrity checks on operating system directories and files to detect abnormal file changes. Combined with process information, account login logs, file permissions, and file modification behavior, it can be determined whether the account has any file privilege escalation intrusion behavior.

[0109] (3) Administrator authority management

[0110] In IT operations and maintenance management, it is required to minimize the permissions assigned to server administrators. However, in a centralized management model, the only way to do this is to restrict the server administrator's login IP address and account number. This embodiment can further refine the server administrator's login permissions, including: restricting the IP address and account number that the administrator can use to log in to the server. Restricting the date range or time range within a day that the administrator can log in. Restricting the number of times the administrator can log in. Restricting the methods that the administrator can use to log in, such as telnet, ssh, and ftp. Restricting the methods that the administrator can use to elevate permissions, such as su and sudo.

[0111] (4) Bastion Host Bypass Detection

[0112] IT security operations require logging into the bastion host before logging into the target server. However, due to the strict or complex restrictions, there is currently no convenient and effective way to prevent logins bypassing the bastion host. This embodiment captures all logins made by OS accounts and, based on the source IP address, determines whether the user bypassed 4A or the bastion host. If the user logs in using a dynamic password, this embodiment effectively blocks the login attempt.

[0113] (V) Analysis of OS account activity trends

[0114] Analyze whether all OS accounts on the entire network have signs of activity: accounts in use on the entire network; accounts with the most frequent activities on the entire network and new accounts added in the past month; accounts with abnormal activity time; accounts with no signs of activity in the past three months.

[0115] (VI) Analysis of OS account and password usage

[0116] Analyze password usage for OS accounts across the entire network: accounts with passwords about to expire; daily traffic of weak passwords; and statistics on sources of brute force guessing of weak passwords.

[0117] (VII) Analysis of OS account login status

[0118] Analyze the login behavior of OS accounts across the entire network: statistics on devices logged in across the entire network; statistics on the source IP addresses of the entire network, and statistics on the number of devices logged in by abnormal source IP addresses.

[0119] (8) System security audit

[0120] This embodiment performs security audits on user login behaviors to the managed server and intercepts abnormal login behaviors.

[0121] (IX) Integrated interface management

[0122] This embodiment provides an integrated interface (generating a dynamic password) for a third-party operation and maintenance system, so that the third-party system obtains the authority to log in to the managed server.

[0123] As a preferred embodiment, the security environment level in S1 includes:

[0124] Application scenarios in high-security environments, such as online banking login and mobile payment authentication, require the use of the SM3 OTP algorithm issued by the State Cryptography Administration as the basic encryption and decryption authentication algorithm. This algorithm is more complex and takes a relatively longer time to compute, but it offers high security and is an efficient basic algorithm solution in terms of security. In other implementations, the SM4 OTP algorithm can also be used as the basic encryption and decryption authentication algorithm, and its principle is similar to that of the SM3 OTP algorithm as the basic encryption and decryption authentication algorithm.

[0125] Application scenarios in low- to medium-security environments, such as online game login authentication, internal enterprise login, and Wi-Fi access login authentication, require the use of the HMAC-SHA-1 algorithm released by the OpenAuthentication (oath) organization as the basic encryption and decryption authentication algorithm. This algorithm balances the computational complexity and security level requirements of the password algorithm. While ensuring authentication security, it reduces the algorithm's computational complexity, thereby shortening the algorithm's operation time. It serves as an efficient basic algorithm solution in terms of security and operation speed.

[0126] As a preferred embodiment, the privileged account authentication based on the security environment level in S3 includes:

[0127] S31, load a one-to-many password generation algorithm. The one-to-many password generation algorithm is designed based on an encrypted seed key. To meet the needs of a server administrator managing multiple servers and improve concurrency, the present invention designs a one-to-many dynamic password generation algorithm. That is, the same account can have different dynamic passwords on different servers. The one-to-many password generation algorithm includes:

[0128] (1) Generate a seed key: The client generates a seed key using a true random number method. In this embodiment, the seed key is preferably 160 bits.

[0129] (2) Encrypt the seed key: The client uses the seed key encryption tool to encrypt and sign the seed key file using a digital certificate. After encryption, only the corresponding token holder can decrypt it;

[0130] (3) Seed key decryption: The token holder completes the decryption and signature verification of the seed key file. After the seed file is decrypted, it is imported into the token holder's generation system;

[0131] (4) Writing the seed key into the token: This is done by the token holder, and the digital certificate is also used to ensure the security of the seed key;

[0132] (5) Seed key is imported into the authentication system: it becomes effective after being imported into the unified authentication system through the seed import tool. The imported seed key uses SM4 encryption to ensure the security of the seed key;

[0133] (6) Performing a secondary transformation of the seed key in the authentication system: using an activation code or random number to operate with the original seed key, thereby causing the seed key to be changed to form a new seed key, which serves as the working key of the token. The activation code or random number is generated by the authentication system, and the authentication system's seed key is updated at the same time as the token's seed key or earlier than the latter;

[0134] (7) Secondary update of token seed key: This is completed by the client access user, and is based on the same activation code or random number to update the authentication system seed key to ensure that the working seed key remains consistent after the token and authentication system seed keys are updated;

[0135] S32, generating a dynamic password based on the token, wherein:

[0136] (1) For high-security application scenarios, such as online banking login and mobile payment authentication, it is necessary to use the SM3 OTP algorithm issued by the State Cryptography Administration as the basic encryption and decryption authentication algorithm to generate dynamic passwords;

[0137] (2) For application scenarios in low- to medium-security environments, such as online game login authentication, enterprise internal login, and Wi-Fi access login authentication, it is necessary to use the HMAC-SHA-1 algorithm released by the Open AuThentication (oath) organization to generate dynamic passwords;

[0138] S33, selecting a dynamic password generation factor as a dynamic password weight based on the security level, including:

[0139] (1) For application scenarios that require a higher level of security, such as online banking applications and mobile payments, since the Android system source code is open source, its security level is lower than that of UIM / SIM cards, which is prone to security risks. Therefore, the password factor based on the UIM card, that is, the integrated circuit card number ICCID, application ID and current time, is used as the dynamic password generation factor, and the dynamic password generation factor is used as the dynamic password weight;

[0140] (2) For applications such as online game login and telecommunications self-operated business identity authentication, since the number of privileged account users is large and the security level requirements are medium to low, the integrated circuit card number or IMSI number of the UIM card, the application ID and the current value of the counter are used as dynamic password generation factors, thereby facilitating the application of the password pre-generation algorithm in the subsequent multi-factor security identity authentication mechanism;

[0141] S34, establish a multi-factor secure identity authentication mechanism, including a combination of a static password memorized by the user and a dynamic password generated based on a token in S32, to implement multiple identity authentication insurance for privileged accounts, including:

[0142] (1) Receive the static password entered by the user and verify again whether it belongs to a privileged account;

[0143] (2) For privileged accounts, a static password weight is assigned to the static password, and the static password is multiplied by the static password weight to obtain a first product;

[0144] (3) Multiplying the dynamic password in S32 and the dynamic password weight in S33 to obtain a second product;

[0145] (4) The first product and the second product are added together to obtain a final comprehensive password, and privileged account authentication is performed based on comparison and identification of the comprehensive password.

[0146] As a preferred embodiment, the S3 further includes:

[0147] S35, after receiving the authentication, a temporary session key is generated for each comprehensive password, and is timestamped and stored in the disaster recovery server for later audit and verification.

[0148] As a preferred embodiment, the generation and encrypted storage of the comprehensive password includes: the sensitive data involved in the password generation process on the server side and the mobile port is encrypted and stored, and the password generation process on the server side is performed in the encryption machine, which effectively ensures the security of sensitive data on the mobile side.

[0149] Example 2

[0150] See also Figure 2 , a privileged account authentication system based on a dynamic security environment, comprising:

[0151] Backend management portal, used to collect application scenario information and determine the security environment level of the application scenario;

[0152] Among them: Backend management portal: provides functions such as the full life cycle management process of privileged accounts and global policy management. System administrators in the operation and maintenance team manage important stages such as the activation, change, and destruction of privileged accounts through the full life cycle management process, and help server administrators use password policies such as the length, strength, period, and replacement frequency of privileged account passwords.

[0153] The resource management module and the log management module are used to determine the account categories, which include privileged accounts, dangerous accounts and ordinary accounts;

[0154] The resource management module manages all managed servers and privileged account asset information. It also uses a scanning engine combined with operating system kernel technology to detect account information, account permissions, weak account passwords, and account intrusions.

[0155] The log management module is used to manage network-wide server login logs, system audit logs, and privileged account compliance scan logs.

[0156] A centralized identity authentication module, a data safe, an encryption machine, and a client including a dynamic password plug-in are used to perform privileged account authentication based on the security environment level for the account category of the privileged account; wherein,

[0157] The centralized identity authentication module is used to perform centralized identity authentication on the dynamic passwords of the managed servers;

[0158] The data safe adopts domestic encryption algorithm to encrypt global sensitive data, including dynamic tokens, account information and administrator's personal privacy information;

[0159] The encryption machine supports hardware encryption, which is connected to the encryption machine for key management; or supports pure software encryption, with the key managed by software;

[0160] The dynamic password plug-in is configured in the managed server or client and is used to generate and authenticate dynamic passwords.

[0161] Application scenarios of this embodiment include: managing privileged accounts and passwords of servers and network devices, and integrating with third-party operation and maintenance systems.

[0162] (I) Scenario 1: Enabling the IT security team to manage privileged accounts across the entire network

[0163] Through this embodiment, the IT security team can clearly sort out the privileged accounts on the entire network and distinguish the various attributes of the accounts.

[0164] Through this embodiment, the IT security team can perform account sorting, permission control, abnormal permission account discovery, compliance detection, weak password discovery, password brute force guessing detection, and file integrity detection on the privileged account configuration of the entire network.

[0165] (II) Scenario 2: Implementing privileged account password management for IT operations teams

[0166] This embodiment allows IT operations teams to improve the efficiency and security of privileged account password management. This allows for centralized batch replacement of privileged accounts across the network, regular password changes, temporary password issuance and recovery, strong password policy management, and protection against password loss.

[0167] (3) Scenario 3: Separate management of privileged and ordinary accounts

[0168] In traditional password management methods, privileged accounts (such as root) are usually managed by server administrators, while ordinary accounts are managed by business department operations and maintenance personnel. This embodiment supports separate management of privileged and ordinary accounts. For example, privileged accounts are managed using this embodiment, while ordinary accounts still use the original operating system password to log in.

[0169] (IV) Scenario 4: Overcoming the Drawbacks of Centralized Storage of Bastion Host Passwords

[0170] like Figure 3 As shown, when the bastion host manages the password of the account, the password is centrally stored in the bastion host database. However, once the database is hacked, the hacker will have access to the passwords of all accounts on the entire network. In this embodiment, the account passwords of the managed server are generated by an algorithm. Therefore, this embodiment can be used as a slave account password database, avoiding the risks brought by the bastion host centrally storing the slave account passwords. The application process is as follows: When the server administrator logs in to the managed server through the bastion host, the bastion host calculates the slave account password in real time through the interface and fills in the password on behalf of the server administrator, thereby enabling the server administrator to log in to the managed server without a password.

[0171] (V) Scenario 5: Providing unified dynamic password authentication for application systems

[0172] See also Figure 4This embodiment provides a secure and reliable dynamic password authentication function, providing the application system with unified account management, unified authentication management, and unified authority management capabilities. When in use:

[0173] The system administrator first assigns each user the permission to log in to the subsystem. For example, Zhang San can log in to the OA, mailbox, and reimbursement system, but cannot log in to other systems.

[0174] Zhang San requests to log into the application system using a dynamic password.

[0175] The application system calls the interface of this embodiment to verify the user's identity. After the dynamic password is verified by this embodiment, the user can complete the identity authentication and log in to the application system.

[0176] The successful application cases of the above two embodiments are as follows:

[0177] Case 1: Guangdong Telecom

[0178] The Oriental Zhongtai Privileged Account System is deployed in Guangdong Telecom's core computer room, which hosts its core business systems. The managed devices include BSS equipment, totaling approximately 8,000 units.

[0179] 1) Type of managed equipment

[0180] Unix systems include HP-UX and AIX;

[0181] Linux systems include SUSE, CentOS, and Redhat;

[0182] Windows systems include Win2003 and Win2008.

[0183] 2) Problem Solving

[0184] A: Account information collection: There are a large number of accounts and a wide variety of devices; there is a lack of quick access to account lists for data support; manual information collection is time-consuming and labor-intensive.

[0185] B: All types of devices have weak passwords and there is no human resources to regularly reset account passwords; there is no secure storage or effective backup mechanism for data after password changes.

[0186] C: After the password is changed, the password copies of various applications need to be synchronized; the database connection pool related applications need to be restarted; each password change is high-risk and there is a fear of omission.

[0187] 3) Customer benefits:

[0188] A: Identify various account risks (weak passwords, zombie accounts, ghost accounts, permission changes, long-term password retention, etc.); refine internal control management; achieve rapid compliance; and provide complete data support in the red-blue confrontation.

[0189] B: Eliminate "weak passwords"; quickly comply with the requirements of the "Information Security Protection" and regulatory agencies for account passwords; comply with the requirements of the National Password Law; and provide password backup protection.

[0190] C: Solve the long-standing problem of difficult-to-modify application-related accounts, prevent data leaks and database tampering, and address the "last mile" of account and password management.

[0191] Case 2: Tianjin Telecom

[0192] The managed equipment is deployed in Tianjin Telecom's core computer room, which hosts its core business systems. The managed equipment includes BSS and OSS devices, totaling approximately 2,000 units.

[0193] 1) Type of managed equipment

[0194] Unix systems include HP-UX and AIX;

[0195] Linux systems include SUSE, CentOS, and Redhat;

[0196] Windows systems include Win2003 and Win2008;

[0197] Network equipment includes routers and switches from Huawei and Cisco.

[0198] 2) Problem Solving

[0199] Solve the problem of automatic discovery of privileged accounts on all devices;

[0200] Solve the password replacement problem for all device privileged accounts;

[0201] Solve the problem of real-time discovery of weak passwords for all devices;

[0202] Solve all device account security configuration and environment detection issues;

[0203] Resolve the issue of requesting temporary passwords for all devices.

[0204] Case 3: Daocheng Yading Smart Tourism Project

[0205] The Daocheng Yading Smart Tourism Project computer room deploys a privileged account management system to solve the problems of automatic discovery of privileged accounts, weak password detection, and daily password management.

[0206] 1) Type of managed equipment

[0207] Linux systems include SUSE, CentOS, and Redhat;

[0208] Windows systems include Win2003 and Win2008.

[0209] 2) Problem Solving

[0210] Solve the problem of automatic discovery of privileged accounts on all devices;

[0211] Solve the password replacement problem for all device privileged accounts;

[0212] Solve the problem of real-time detection of weak passwords for all devices.

[0213] Case 4: Ganzi Prefecture Digital Forestry and Grassland Project

[0214] The equipment in the computer room of the Ganzi Digital Forestry and Grassland Project is classified as Level 2 security assets. The project deployed a privileged account management system to automatically discover privileged accounts, identify weak passwords, and manage passwords on a daily basis. This helps prevent management risks such as password leaks that could threaten project data security.

[0215] 1) Type of managed equipment

[0216] Linux systems include CentOS and Redhat;

[0217] Windows systems include Win2008.

[0218] 2) Problem Solving

[0219] Solve the problem of automatic discovery of privileged accounts on all devices;

[0220] Solve the password replacement problem for all device privileged accounts;

[0221] Solve the problem of real-time detection of weak passwords for all devices.

[0222] like Figure 5 As shown, the present invention also provides an electronic device, including a processor 301 and a memory 302 connected to the processor 301, wherein the memory 302 stores multiple instructions, which can be loaded and executed by the processor to enable the processor to execute the method described in Example 2.

[0223] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the invention. Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the invention. Thus, the present invention is intended to include such changes and modifications as fall within the scope of the claims and their equivalents.

Claims

1. A privileged account authentication method based on a dynamic security environment, characterized in that: include: S1, collect application scenario information and determine the security environment level of the application scenario; S2, determining the account category, which includes privileged accounts, dangerous accounts, and ordinary accounts; S3, performing privileged account authentication on the account category of the privileged account based on the security environment level; The security environment level in S1 includes: application scenarios of high security level environment and application scenarios of medium and low security level environment; The privileged account authentication based on the security environment level in S3 includes: S31, loading a one-to-many password generation algorithm. The one-to-many password generation algorithm is designed based on an encrypted seed key. The same account can have different dynamic passwords on different servers. S32, generating a dynamic password based on the token; S33, selecting a dynamic password generation factor as a dynamic password weight based on the security level; S34, establishing a multi-factor secure identity authentication mechanism, including combining the user's memorized static password with the token-based dynamic password generated in step S32 to implement multiple identity authentication insurance for privileged accounts; S35, after receiving the authentication, a temporary session key is generated for each comprehensive password, and is timestamped and stored in the disaster recovery server for later audit and verification; The one-to-many password generation algorithm includes: (1) Generate seed key: The client generates the seed key using a true random number method. The seed key is 160 bits. (2) Encrypt the seed key: The client uses the seed key encryption tool to encrypt and sign the seed key file using a digital certificate. After encryption, only the corresponding token holder can decrypt it; (3) Seed key decryption: The token holder completes the decryption and signature verification of the seed key file. After the seed file is decrypted, it is imported into the token holder's generation system; (4) Writing the seed key into the token: This is done by the token holder, and the digital certificate is also used to ensure the security of the seed key; (5) Seed key is imported into the authentication system: it becomes effective after being imported into the unified authentication system through the seed import tool. The imported seed key uses SM4 encryption to ensure the security of the seed key; (6) Performing a secondary transformation of the seed key in the authentication system: using an activation code or random number to operate with the original seed key, thereby causing the seed key to change and form a new seed key as the working key of the token. The activation code or random number is generated by the authentication system, and the authentication system's seed key is updated at the same time as the token's seed key or earlier than the latter; (7) Secondary update of token seed key: completed by the client access user, based on the same activation code or random number of the authentication system seed key update, to ensure that the working seed key remains consistent after the token and authentication system seed key are updated.

2. A privileged account authentication method based on a dynamic security environment according to claim 1, characterized in that: The step S32 of generating a dynamic password based on the token includes: (1) For application scenarios in high-security environments, the SM3 OTP algorithm or SM4 OTP algorithm issued by the State Cryptography Administration is used as the basic encryption and decryption authentication algorithm to generate dynamic passwords; the application scenarios in high-security environments include online banking login and mobile payment authentication; (2) For application scenarios in medium and low security environments, the HMAC-SHA-1 algorithm released by the Open AuThentication organization is used to generate dynamic passwords; the application scenarios in medium and low security environments include online game login authentication, enterprise internal login, and Wi-Fi access login authentication.

3. A privileged account authentication method based on a dynamic security environment according to claim 2, characterized in that: The step S33, selecting a dynamic password generation factor as a dynamic password weight based on the security level, includes: (1) For application scenarios with a higher security level, the password factor based on the UIM card, that is, the integrated circuit card number ICCID, application ID and current time, is used as the dynamic password generation factor, and the dynamic password generation factor is used as the dynamic password weight; (2) For application scenarios with medium or low security levels, the integrated circuit card number or IMSI number of the UIM card, the application ID and the current value of the counter are used as factors for generating dynamic passwords.

4. A privileged account authentication method based on a dynamic security environment according to claim 3, characterized in that: The S34 establishes a multi-factor security identity authentication mechanism, which includes combining the static password memorized by the user and the dynamic password generated based on the token in S32, to achieve multiple identity authentication insurance for privileged accounts, including: (1) Receive the static password entered by the user and verify again whether it belongs to a privileged account; (2) For privileged accounts, assign a static password weight to the static password, and multiply the static password by the static password weight to obtain the first product; (3) Multiplying the dynamic password in S32 and the dynamic password weight in S33 to obtain a second product; (4) The first product and the second product are added together to obtain the final comprehensive password, and privileged account authentication is performed based on the comparison and identification of the comprehensive password.

5. A privileged account authentication system based on a dynamic security environment, used to implement the authentication method according to any one of claims 1 to 4, characterized in that: include: Backend management portal, used to collect application scenario information and determine the security environment level of the application scenario; The backend management portal provides a full lifecycle management process for privileged accounts and global policy management capabilities. System administrators in the operations and maintenance team manage the important stages of privileged account activation, modification, and termination through this full lifecycle management process. The resource management module and the log management module are used to determine the account categories, which include privileged accounts, dangerous accounts and ordinary accounts; The resource management module manages all managed servers and privileged account asset information. It also uses a scanning engine combined with operating system kernel technology to detect account information, account permissions, weak account passwords, and account intrusions. The log management module is used to manage network-wide server login logs, system audit logs, and privileged account compliance scan logs; A centralized identity authentication module, a data safe, an encryption machine, and a client including a dynamic password plug-in are used to perform privileged account authentication based on the security environment level for the account category of the privileged account; wherein, The centralized identity authentication module is used to perform centralized identity authentication on the dynamic passwords of the managed servers; The data safe adopts domestic encryption algorithm to encrypt global sensitive data, including dynamic tokens, account information and administrator's personal privacy information; The encryption machine supports hardware encryption, which is connected to the encryption machine for key management; or supports pure software encryption, with the key managed by software; The dynamic password plug-in is configured in the managed server or client and is used to generate and authenticate dynamic passwords.

6. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a plurality of instructions, and the processor is configured to read the instructions and execute the method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the plurality of instructions can be read by a processor to execute the method according to any one of claims 1 to 4.

Images