A method for hosting AccessKey and changing its password

Abstract

The present invention discloses a method for hosting and re-encrypting an AccessKey, comprising an AccessKey configuration module, an AccessKey re-encryption module, an AccessKey result query module, and an AccessKey diary query module. The AccessKey configuration module fills in AccessKey related information by filling in a record A. The information filled in by A is parsed by B to correspond to AccessKey information. B parses the corresponding AccessKey information and sends it to the AccessKey re-encryption module. The AccessKey re-encryption module obtains the re-encrypted AccessKey information by filling in the obtained information C. The re-encrypted AccessKey information obtained by C is stored in a safe and a database. The method for hosting and re-encrypting an AccessKey has the advantages of better managing these AccessKeys, greatly reducing costs, ensuring the safe and rational use of these AccessKeys, and preventing them from being illegally used.

Description

Technical Field

[0001] The present invention relates to the field of database application technology, and in particular to a method for hosting and changing the encryption of an AccessKey. Background Art

[0002] With the advent of the big data era, vast amounts of data need to be analyzed and processed. To accelerate digital transformation, various industries are turning to cloud computing. Remote work and online classes during the pandemic have clearly demonstrated the power of cloud computing. However, the rise of cloud computing has also brought with it numerous cloud security issues, the most prominent of which is AccessKey leakage. AccessKeys are used to authenticate users using cloud computing services. They consist of two parts: AccessKeyID and AccessKeySecret. The AccessKeyID identifies the user, while the AccessKeySecret is the key used to verify the user's identity. Many users, lacking security awareness or seeking convenience, simply write AccessKeys in plain text into code scripts that call services or store them on online code hosting platforms. This makes AccessKeys highly susceptible to leakage, allowing attackers to easily gain access to cloud computing instances and maliciously perform add, query, and modify operations, causing serious losses to enterprises. Therefore, the best solution is to encrypt and manage AccessKeys and to periodically renew them. However, some account hosting tools currently available only support traditional OS and DB accounts and cannot encrypt, store, or renew AccessKeys. This, coupled with users' lack of security awareness, leads to the security issue of AccessKeys being easily leaked and exploited.

[0003] To address the aforementioned technical issues, the present application provides a framework logic mechanism for encrypting and escrowing AccessKeys and implementing periodic replacement. This framework mechanism, part of a privileged account management system, is used to encrypt and escrow AccessKeys, periodically replace them, and thereby ensure the compliance management and storage of AccessKeys. This automated process significantly reduces the operational and security audit costs of enterprises or organizations, while also enabling the appropriate management of these AccessKeys. Summary of the Invention

[0004] The purpose of the present invention is to provide a method for hosting and decrypting AccessKeys, which allows the security audit department of an enterprise or organization to better manage these AccessKeys, greatly reducing costs, and ensuring the safe and rational use of these AccessKeys to avoid illegal use, thereby solving the problems in the prior art.

[0005] To achieve the above-mentioned object, the present invention provides the following technical solution: a method for hosting and rekeying an AccessKey, comprising an AccessKey configuration module, an AccessKey rekeying module, an AccessKey result query module, and an AccessKey log query module. The AccessKey configuration module fills in AccessKey related information in step A, and parses the filled information into corresponding AccessKey information in step B. The parsed information is sent to the AccessKey rekeying module. The AccessKey rekeying module obtains the rekeyed AccessKey information in step C, stores the obtained information in a safe and a database, and executes step D to return the rekeying result. The returned rekeying result is sent to the AccessKey result query module. The AccessKey result query module checks the rekeying result in step E1, and the returned rekeying result is also sent to the AccessKey log query module. The AccessKey log query module records log information generated during the AccessKey replacement process. In step E2, the rekeying log is checked and presented on a front-end page for query by users. If the rekeying fails, corresponding troubleshooting can be performed based on the log-related information.

[0006] Preferably, the AccessKey configuration module executes step A, filling in AccessKey related information and step B, parsing the corresponding AccessKey information. The parsing of the corresponding AccessKey information involves filling in AccessKey related information through the front end. The main information includes user name, AccessKeyID and AccessKeySecret, and then parsing the information. The AccessKeyID and AccessKeySecret are encrypted and stored in the privileged account safe, and the remaining information is stored in the database.

[0007] Preferably, when the privileged account management system initiates a password change on the AccessKey, the AccessKey password change module retrieves the AccessKeyID and AccessKeySecret from the safe, retrieves the user name and other related information from the database, calls the official OpenAPI, creates a new AccessKey and deletes the old AccessKey, and finally verifies whether the new AccessKey calls the OpenAPI successfully, thereby completing the replacement.

[0008] Preferably, the AccessKey result query module returns the encrypted result of the AccessKey information obtained in step C to the privileged account management system and stores it in the safe and the database. The AccessKey result query module retrieves the encrypted result stored in the safe and the database and presents it to the front-end page for viewing and retrieval.

[0009] Preferably, the AccessKey log query module provides step E2, checking the password change log, which is responsible for recording the log information generated during the AccessKey replacement process and presenting it on the front-end page for users to query. If the password change fails, corresponding troubleshooting can be performed based on the log-related information.

[0010] Compared with the prior art, the present invention has the following beneficial effects:

[0011] 1. The present invention adopts a framework logic mechanism for encrypting and hosting AccessKey and changing its encryption, supports real-time and scheduled encryption and updating of AccessKey, and can update the encrypted AccessKey information to the business code file or script that uses AccessKey, to ensure that the business will not be interrupted after the AccessKey is updated. In addition, the history of users using AccessKey will be recorded, for example, a user checked the password, changed the encryption, etc. at a certain moment, so that there will be traces to follow after an accident occurs. Therefore, through this invention, the security audit department of an enterprise or organization can better manage these AccessKeys, greatly reduce costs, and ensure the safe and rational use of these AccessKeys to avoid illegal use. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a schematic diagram of the working principle of a method for hosting AccessKey and changing its encryption according to the present invention. DETAILED DESCRIPTION

[0013] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0014] In the description of the present invention, it should be understood that the terms "upper", "lower", "front", "back", "left", "right", "top", "bottom", "inside", "outside", etc., indicating directions or positional relationships, are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as limiting the present invention. Example 1

[0015] See also Figure 1 A method for hosting and rekeying an AccessKey includes an AccessKey configuration module, an AccessKey rekeying module, an AccessKey result query module, and an AccessKey log query module. The AccessKey configuration module fills in AccessKey related information through step A, and the filled information parses the corresponding AccessKey information through step B, and the parsed information is sent to the AccessKey rekeying module. The AccessKey rekeying module obtains the rekeyed AccessKey information through step C, stores the obtained information in a safe and a database, and executes step D to return the rekeying result. The returned rekeying result is sent to the AccessKey result query module. The AccessKey result query module checks the rekeying result through step E1, and the returned rekeying result is also sent to the AccessKey log query module. The AccessKey log query module records log information generated during the AccessKey replacement process. The rekeying log is checked through step E2 and presented on a front-end page for users to query. If the rekeying fails, corresponding troubleshooting can be performed based on the log-related information.

[0016] Specifically, relevant information of the AccessKey, including AccessKeyID, AccessKeySecret, etc., is filled in on the front-end page, and the AccessKey configuration module is used to receive the values ​​returned by the front-end page for parsing, wherein the AccessKeyID and AccessKeySecret are encrypted and stored in the safe, and the remaining values ​​are stored in the database. After the AccessKey decryption module is used, the decryption module takes out the corresponding values ​​from the safe and the database and calls the corresponding OpenAPI to verify and replace the AccessKey. The decryption result in step C, obtaining the decrypted AccessKey information, is returned to the privileged account management system and stored in the safe and the database. The AccessKey result query module is used to take out the decryption result stored in the safe and the database and put it on the front-end page for presentation for viewing and retrieval. The AccessKey log query module is used to record the success and failure event logs generated during the entire AccessKey decryption process and put them on the front-end page for viewing, so as to facilitate corresponding troubleshooting when the decryption fails.

[0017] Working principle:

[0018] The present invention provides a method for hosting AccessKey and changing its encryption. The method configures relevant information of AccessKey including AccessKeyID, AccessKeySecret, etc., and then receives the values ​​returned by the front-end page through the AccessKey configuration module for parsing, wherein the AccessKeyID and AccessKeySecret are encrypted and stored in a safe, and the remaining values ​​are stored in a database. After passing through the AccessKey encryption module, the encryption module retrieves the corresponding values ​​from the safe and the database and calls the corresponding OpenAPI to verify and replace the AccessKey, and then returns the encryption result of the obtained AccessKey information after encryption to the privileged account management system and stores it in the safe and the database. Then, the AccessKey result query module retrieves the encryption result stored in the safe and the database and displays it on the front-end page for viewing and retrieval. Finally, the AccessKey log query module records the event logs of success and failure generated in the entire AccessKey encryption process and displays them on the front-end page for viewing, so as to facilitate corresponding troubleshooting when the encryption fails.

[0019] The basic principles, main features and advantages of the present invention are shown and described above. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is limited by the appended claims rather than the above description. Therefore, it is intended that all changes that fall within the meaning and scope of the equivalent elements of the claims are included in the present invention, and any figure signs in the claims should not be regarded as limiting the claims involved.

[0020] In addition, it should be understood that although this specification is described in terms of implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form a technical solution for those skilled in the art.

Claims

1. A method for hosting an AccessKey and changing its encryption, characterized by: The system includes an AccessKey configuration module, an AccessKey rekeying module, an AccessKey result query module, and an AccessKey log query module. The AccessKey configuration module fills in AccessKey related information through step A, and the filled information is parsed into corresponding AccessKey information through step B. The parsed information is sent to the AccessKey rekeying module. The AccessKey rekeying module obtains the rekeyed AccessKey information through step C, stores the obtained information in the safe and the database, and executes step D to return the rekeying result. The returned rekeying result is sent to the AccessKey result query module. The AccessKey result query module checks the rekeying result through step E1, and the returned rekeying result is also sent to the AccessKey log query module. The AccessKey log query module records the log information generated during the AccessKey replacement process. The rekeying log is checked through step E2 and presented on the front-end page for users to query. If the rekeying fails, corresponding troubleshooting can be performed based on the log related information. When the AccessKey rekeying module initiates a rekeying of the AccessKey through the privileged account management system, it retrieves the AccessKeyID and AccessKeySecret from the safe, retrieves the user name from the database, calls the official OpenAPI, creates a new AccessKey and deletes the old AccessKey, and finally verifies whether the new AccessKey successfully calls the OpenAPI to complete the replacement.

2. The method for hosting and re-encrypting AccessKey according to claim 1, characterized in that: The AccessKey configuration module executes step A, filling in AccessKey related information and step B, parsing the corresponding AccessKey information. The parsing of the corresponding AccessKey information involves filling in AccessKey related information through the front end. The main information includes user name, AccessKeyID and AccessKeySecret, and then parsing the information. The AccessKeyID and AccessKeySecret are encrypted and stored in the privileged account safe. The remaining information is stored in the database.

3. The method for hosting and re-encrypting AccessKey according to claim 1, characterized in that: The AccessKey result query module returns the encrypted result of the AccessKey information obtained in step C to the privileged account management system and stores it in the safe and database. The AccessKey result query module retrieves the encrypted result stored in the safe and database and displays it on the front-end page for viewing and retrieval.

4. The method for hosting and re-encrypting AccessKey according to claim 1, characterized in that: The AccessKey log query module provides step E2, checking the password change log, which is responsible for recording the log information generated during the AccessKey replacement process and presenting it on the front-end page for users to query. If the password change fails, corresponding troubleshooting can be performed based on the log-related information.

Images