User access account identification method and device, computer device, and storage medium

Abstract

Embodiments of the present application disclose a user access account identification method and device, computer equipment and a storage medium. The method comprises: using code instrumentation technology to monitor the interface input parameters of an application system to obtain input parameter information; determining whether the application system is a local authentication mode according to the input parameter information; if the application system is not a local authentication mode, monitoring the interface input parameter information of the application server by using code instrumentation technology to obtain user access account information; obtaining a user access token corresponding to the user access account information; monitoring the interface output parameters of the application system by using code instrumentation technology to obtain output parameter information; determining whether the output parameter information matches the user access token; and if the output parameter information matches the user access token, outputting the user access account information. The method of the embodiments of the present application can realize no need for burying points, improve the user abnormal behavior identification ability, reduce the data security risk, and has high reliability.

Description

TECHNICAL FIELD

[0001] The present application relates to data security, more particularly to a user access account identification method and device, a computer device and a storage medium. BACKGROUND

[0002] With the deepening of enterprise digital transformation, information leakage incidents occur from time to time, and the confidentiality, availability and integrity of enterprise data assets are threatened, which has become a major threat to security management in various enterprises. User entity behavior analysis, as an important technical means, starts from the user's perspective, discovers and warns of abnormal user behavior, and eliminates security risks in a timely manner. In this process, the application system is a mainstream means to obtain user access accounts through application system point modification. However, this method has certain problems. The application system point modification is costly and time-consuming, and requires a large amount of manpower and resources to modify the full application system. Moreover, as the application system is continuously iterated, the point modification work will continue. It is difficult to modify the point of the purchased application system, as the purchased application system is relatively closed, and the user cannot directly carry out point modification work. The monitoring blind spot of this part of the application system leads to an increase in data security risks. Multiple authentication methods coexist, and the modification standard is difficult to unify. Since enterprise informatization construction is a continuous work, the authentication methods of application systems in different periods are not completely unified. Some application systems are locally authenticated, and some application systems are centrally authenticated. The difference in authentication methods is a great challenge to the acquisition of user access accounts. Manual work is unreliable due to non-standard work or human negligence, and point modification errors or forgetting to modify points often occur.

[0003] Therefore, it is necessary to design a method that does not require point modification, improves user abnormal behavior identification capability, reduces data security risks, and has high reliability. SUMMARY

[0004] The present application aims to overcome the defects of the prior art and provide a user access account identification method, device, computer device and storage medium.

[0005] To achieve the above-mentioned purpose, the following technical solutions are adopted: a user access account identification method, comprising:

[0006] The code instrumentation technology is used to monitor the interface parameters of the application system to obtain the parameter information;

[0007] According to the parameter information, it is judged whether the application system is a local authentication method;

[0008] If the application system is not a local authentication method, the code instrumentation technology is used to monitor the interface parameter information of the application server to obtain the user access account information;

[0009] obtain a user access token corresponding to the user access account information;

[0010] An interface output parameter monitoring is performed on the application system by using a code insertion technology to obtain the output parameter information.

[0011] It is judged whether the output parameter information matches the user access token.

[0012] If the output parameter information matches the user access token, the user access account information is output.

[0013] Further technical solutions are as follows: after judging whether the application system is a local authentication mode according to the input parameter information, the method further comprises:

[0014] If the application system is a local authentication mode, keyword matching is performed on the input parameter information by using a dictionary to obtain user access account information, and the user access account information is output.

[0015] Further technical solutions are as follows: the user access account information comprises account password field information.

[0016] Further technical solutions are as follows: after obtaining the user access token corresponding to the user access account information, the method further comprises:

[0017] The user access account information and the user access token are stored in a user authentication cache pool.

[0018] Further technical solutions are as follows: the output parameter information comprises a user access token in the application system.

[0019] The application further provides a user access account identification device, comprising:

[0020] An input parameter monitoring unit is configured to perform interface input parameter monitoring on the application system by using a code insertion technology to obtain input parameter information.

[0021] A mode judging unit is configured to judge whether the application system is a local authentication mode according to the input parameter information.

[0022] An information obtaining unit is configured to, if the application system is not a local authentication mode, monitor interface input parameter information of an application server by using a code insertion technology to obtain user access account information.

[0023] A token obtaining unit is configured to obtain a user access token corresponding to the user access account information.

[0024] An output parameter monitoring unit is configured to perform interface output parameter monitoring on the application system by using a code insertion technology to obtain output parameter information.

[0025] A matching judging unit is configured to judge whether the out-parameter information matches the user access token.

[0026] An output unit is configured to output the user access account information if the out-parameter information matches the user access token.

[0027] Further technical solutions of the application are as follows:

[0028] A local authentication unit is configured to, if the application system is a local authentication mode, perform keyword matching on the in-parameter information by using a dictionary to obtain user access account information, and execute the output of the user access account information.

[0029] Further technical solutions of the application are as follows:

[0030] A storage unit is configured to store the user access account information and the user access token in a user authentication cache pool.

[0031] The application further provides a computer device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the method described above when executing the computer program.

[0032] The application further provides a storage medium, which stores a computer program, and the computer program can implement the method described above when executed by a processor.

[0033] Compared with the prior art, the application has the following beneficial effects: the application monitors the interface in-parameter of the application system by using the code instrumentation technology, determines the authentication mode of the application system by using the monitoring result, for the non-local authentication mode, automatically monitors the in-parameter information of the authentication server and the in-parameter information of the application system by using the code instrumentation technology, and thus can identify the user access account, does not need to be modified by burying points, improves the user abnormal behavior identification capability, reduces the data security risk, and has high reliability.

[0034] The application will be further described below in combination with the drawings and specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0036] Figure 1 An application scenario diagram of the user access account identification method provided by the embodiments of the application is shown in the figure.

[0037] Figure 2 A flowchart of a user access account identification method provided by an embodiment of the present application is shown in FIG. 1.

[0038] Figure 3 A flowchart of a user access account identification method provided by another embodiment of the present application is shown in FIG. 2.

[0039] Figure 4 A schematic block diagram of a user access account identification device provided by an embodiment of the present application is shown in FIG. 3.

[0040] Figure 5 A schematic block diagram of a user access account identification device provided by another embodiment of the present application is shown in FIG. 4.

[0041] Figure 6 A schematic block diagram of a computer device provided by an embodiment of the present application is shown in FIG. 5. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0043] It should be understood that the terms “comprise” and “include” as used in the specification and the appended claims indicate the presence of the described features, integers, steps, operations, elements, and / or components but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0044] It should also be understood that the terms used in the present application specification are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the present application specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0045] It should be further understood that the term “and / or” as used in the present application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations thereof, and includes these combinations.

[0046] Please refer to Figure 1 and Figure 2 , Figure 1 An application scenario diagram of a user access account identification method provided by an embodiment of the present application is shown in FIG. 6. Figure 2A schematic flowchart of a user access account identification method provided by an embodiment of the present application is shown. The user access account identification method is applied to a server. The server interacts with an application system and an authentication server, and the application system or the authentication server does not need to be modified by embedding points, and based on code instrumentation technology, the in and out parameter information is automatically monitored, the user authentication information cache pool is automatically maintained without manual intervention, the interface in and out parameter monitoring is used, the coverage is wider, the accuracy is higher, not only the unreliable factors of manual work can be eliminated, but also the identification accuracy is higher.

[0047] Figure 2 A flowchart of a user access account identification method provided by an embodiment of the present application is shown. As shown in Figure 2 , the method comprises the following steps S110 to S150.

[0048] S110, interface in parameter monitoring of the application system is performed by using code instrumentation technology to obtain in parameter information.

[0049] In this embodiment, the in parameter information refers to user login authentication information, including authentication mode and user account and password.

[0050] Specifically, the interface of the application system is monitored by using code instrumentation technology, and the in parameter information is monitored.

[0051] S120, whether the application system is a local authentication mode is determined according to the in parameter information.

[0052] In this embodiment, whether the application system is a local authentication is determined based on the user login authentication information, and specifically, whether the application system is a local authentication mode is determined by using the authentication mode in the user login authentication information.

[0053] S130, if the application system is not a local authentication mode, the interface in parameter information of the application server is monitored by using code instrumentation technology to obtain user access account information.

[0054] In this embodiment, the user access account information refers to user access account and password information and the like.

[0055] If the application system is not a local authentication but a centralized authentication, the interface in parameter information of the authentication server is monitored by using code instrumentation technology, and the monitoring content mainly includes the account and password field information submitted by the user.

[0056] S140, a user access token corresponding to the user access account information is obtained.

[0057] In the embodiment, the user needs to submit an account password when initiating authentication to the authentication server, and therefore the user access account information is obtained through the authentication server interface input parameter; the authentication server issues a user access token to the user after completing user authentication, the user access token represents a string of characters of the user identity, and the user can carry the user access token in Cookie or Header; the user access token is obtained by monitoring the authentication server interface output parameter information.

[0058] S150, interface output parameter monitoring is performed on the application system by using code instrumentation technology to obtain the output parameter information.

[0059] In the embodiment, the output parameter information includes a user access token in the application system.

[0060] Specifically, the application system interface output parameter information is continuously monitored, because the application system forwards the user access token information to the authentication server for verification after the user submits the authentication, and judges whether the user can pass the authentication, and the user access token in the application system can be obtained at this time.

[0061] S160, it is judged whether the output parameter information matches the user access token;

[0062] S170, if the output parameter information matches the user access token, the user access account information is output.

[0063] In the embodiment, the application system user access Token is matched with the Token information of the user authentication information cache pool, if the matching is consistent, the corresponding user access account is output.

[0064] If the output parameter information does not match the user access token, the execution ends.

[0065] S180, if the application system is a local authentication mode, the input parameter information is matched by using a dictionary to obtain user access account information, and the step S170 is executed.

[0066] In the embodiment, it is judged whether the application system is a local authentication based on user login authentication information, if the authentication process does not appear other application jump interface, and the system directly returns an authentication result as a success identifier, it can be judged as a local authentication. If it is a local authentication, the interface input parameter information is monitored, and the keyword matching is performed by using a dictionary, for example, whether the interface input parameter includes id, user, name, pass or the like field, and then the user access account is obtained, and the account is output, and the process ends.

[0067] The method in this embodiment is based on code instrumentation technology, which can automatically adapt to complex application architectures with multiple authentication systems coexisting, accurately obtain user access accounts, provide a solid foundation for user entity behavior analysis, improve the ability to identify abnormal user behavior, and reduce data security risks. It has strong generalization ability, automatically adapting and effectively compatible with both single and multiple authentication systems; it has low investment cost, requiring no modification to the application system or authentication server, automatically monitoring input and output parameter information based on code instrumentation technology, and automatically maintaining the user authentication information cache pool without manual intervention; it has high recognition accuracy, with a higher degree of automation than the instrumentation modification method, monitoring interface input and output parameters, providing wider coverage and higher accuracy, not only eliminating unreliable human factors but also achieving higher recognition precision.

[0068] In this embodiment, code instrumentation is one of the key technologies for achieving coverage testing, and efficient instrumentation is crucial for testing embedded software. Based on research into instrumentation techniques in CodeTest, a new instrumenter was applied and implemented using GCC as the development platform. This new instrumenter improves instrumentation efficiency by adding a lexical analyzer. Experiments have demonstrated that the new instrumenter has advantages such as low code bloat and fast instrumentation speed, achieving efficient instrumentation to a certain extent.

[0069] The aforementioned user access account identification method uses code instrumentation technology to monitor the interface input parameters of the application system. The monitoring results are used to determine the authentication method of the application system. For non-local authentication methods, code instrumentation technology is used to automatically monitor the input parameter information of the authentication server and the input parameter information of the application system, thereby identifying user access accounts. This method achieves high reliability, improves the ability to identify abnormal user behavior, reduces data security risks, and eliminates the need for code instrumentation modifications.

[0070] Figure 3 This is a flowchart illustrating a user access account identification method according to another embodiment of the present invention. Figure 3 As shown, the user access account identification method in this embodiment includes steps S210-S290. Steps S210-S240 are similar to steps S110-S140 in the above embodiment, and steps S250-S290 are similar to steps S150-S180 in the above embodiment, and will not be described again here. The following details the added step S250 in this embodiment.

[0071] S250. Store the user access account information and user access token in the user authentication cache pool.

[0072] User access accounts and user access tokens are temporarily stored in the user authentication cache pool. When a user access token expires, the user access account and user access token are automatically deleted.

[0073] Figure 4 is a schematic block diagram of a user access account identification device 300 provided by an embodiment of the present application. As shown, corresponding to the above user access account identification method, the present application further provides a user access account identification device 300. The user access account identification device 300 comprises units for performing the above user access account identification method, and the device can be configured in a server. Specifically, referring to Figure 4 , the user access account identification device 300 comprises a parameter monitoring unit 301, a mode judging unit 302, an information obtaining unit 303, a token obtaining unit 304, a parameter monitoring unit 306, a matching judging unit 307, and an output unit 308. Figure 4

[0074] The parameter monitoring unit 301 is configured to monitor the interface parameters of an application system by using a code instrumentation technology to obtain parameter information. The mode judging unit 302 is configured to judge whether the application system is a local authentication mode according to the parameter information. The information obtaining unit 303 is configured to monitor the interface parameter information of an application server by using a code instrumentation technology to obtain user access account information if the application system is not a local authentication mode. The token obtaining unit 304 is configured to obtain a user access token corresponding to the user access account information. The parameter monitoring unit 306 is configured to monitor the interface parameters of an application system by using a code instrumentation technology to obtain parameter information. The matching judging unit 307 is configured to judge whether the parameter information matches the user access token. The output unit 308 is configured to output the user access account information if the parameter information matches the user access token.

[0075] In an embodiment, the user access account identification device 300 further comprises:

[0076] The local authentication unit 309 is configured to perform keyword matching on the parameter information by using a dictionary to obtain user access account information and perform the output of the user access account information if the application system is a local authentication mode.

[0077] Figure 5 is a schematic block diagram of a user access account identification device 300 provided by another embodiment of the present application. As shown, the user access account identification device 300 of the present embodiment is based on the above-mentioned embodiment and further comprises a storage unit 305. Figure 5

[0078] The storage unit 305 is configured to store the user access account information and the user access token in a user authentication cache pool.

[0079] ​​It should be noted that the specific implementation process of the user access account identification device 300 and each unit can be clearly understood by those skilled in the art, and can refer to the corresponding description in the foregoing method embodiments. For the convenience and brevity of description, it will not be repeated here.

[0080] The user access account identification device 300 described above can be implemented in the form of a computer program, which can run on a computer device as shown in the figure. Figure 6

[0081] Please refer to Figure 6 , Figure 6 is a schematic block diagram of a computer device provided by an embodiment of the present application. The computer device 500 can be a server, wherein the server can be a stand-alone server or a server cluster composed of multiple servers.

[0082] Referring to Figure 6 , the computer device 500 includes a processor 502, a memory, and a network interface 505 connected through a system bus 501, wherein the memory can include a non-volatile storage medium 503 and an internal memory 504.

[0083] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, which when executed, can cause the processor 502 to perform a user access account identification method.

[0084] The processor 502 is configured to provide computing and control capabilities to support the operation of the entire computer device 500.

[0085] The internal memory 504 provides an environment for the running of the computer program 5032 in the non-volatile storage medium 503, which when executed by the processor 502, can cause the processor 502 to perform a user access account identification method.

[0086] The network interface 505 is configured to perform network communication with other devices. Those skilled in the art can understand that Figure 6 the structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device 500 to which the scheme of the present application is applied. The specific computer device 500 can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0087] The processor 502 is configured to run the computer program 5032 stored in the memory to implement the following steps:

[0088] ​The code instrumentation technology is used to monitor the interface input parameter of the application system to obtain input parameter information; whether the application system is a local authentication mode is judged according to the input parameter information; if the application system is not the local authentication mode, the code instrumentation technology is used to monitor the interface input parameter information of the application server to obtain user access account information; user access token corresponding to the user access account information is obtained; the code instrumentation technology is used to monitor the interface output parameter of the application system to obtain output parameter information; whether the output parameter information matches the user access token is judged; if the output parameter information matches the user access token, the user access account information is output.

[0089] The user access account information includes account password field information.

[0090] The output parameter information includes user access token in the application system.

[0091] In an embodiment, the processor 502, after implementing the step of judging whether the application system is the local authentication mode according to the input parameter information, further implements the following steps:

[0092] If the application system is the local authentication mode, the input parameter information is matched with keywords in a dictionary to obtain user access account information, and the user access account information is output.

[0093] In an embodiment, the processor 502, after implementing the step of obtaining the user access token corresponding to the user access account information, further implements the following steps:

[0094] The user access account information and the user access token are stored in a user authentication cache pool.

[0095] It should be understood that, in the embodiments of the present application, the processor 502 can be a central processing unit (CPU), and the processor 502 can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0096] Those skilled in the art can understand that all or part of the processes in the method of the above-mentioned embodiments can be completed by instructing the relevant hardware by a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer readable storage medium. The program instructions are executed by at least one processor in the computer system to realize the process steps of the above-mentioned embodiment of the method.

[0097] Therefore, the application further provides a storage medium. The storage medium can be a computer readable storage medium. The storage medium stores a computer program, wherein the computer program is executed by a processor to make the processor execute the following steps:

[0098] The application system is monitored by using code instrumentation technology to obtain input parameter information; whether the application system is a local authentication mode is determined according to the input parameter information; if the application system is not the local authentication mode, the interface input parameter information of the application server is monitored by using code instrumentation technology to obtain user access account information; a user access token corresponding to the user access account information is obtained; the application system is monitored by using code instrumentation technology to obtain output parameter information; whether the output parameter information matches the user access token is determined; and if the output parameter information matches the user access token, the user access account information is output.

[0099] The user access account information includes account password field information.

[0100] The output parameter information includes a user access token in the application system.

[0101] In an embodiment, after the processor executes the computer program to realize the step of determining whether the application system is the local authentication mode according to the input parameter information, the processor further realizes the following steps:

[0102] If the application system is the local authentication mode, the input parameter information is matched by using a dictionary to obtain user access account information, and the user access account information is output.

[0103] In an embodiment, after the processor executes the computer program to realize the step of obtaining the user access token corresponding to the user access account information, the processor further realizes the following steps:

[0104] The user access account information and the user access token are stored in a user authentication cache pool.

[0105] The storage medium can be a U disk, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk, and various computer readable storage media that can store program codes.

[0106] Those skilled in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been described in the above description in a general manner. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0107] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of each unit is only a logical functional division, and actual implementation can have another division manner. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0108] The steps in the method embodiments of the present application can be adjusted, combined and deleted in sequence according to actual needs. The units in the device embodiments of the present application can be combined, divided and deleted according to actual needs. In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit.

[0109] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a terminal or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present application.

[0110] The above description is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of identifying a user access account, characterized by, The application comprises the following steps: interface parameter monitoring is performed on the application system by using code instrumentation technology to obtain parameter information; whether the application system is a local authentication mode is determined according to the parameter information; if the application system is not a local authentication mode, interface parameter information monitoring is performed on the application server by using code instrumentation technology to obtain user access account information; a user access token corresponding to the user access account information is obtained; interface parameter monitoring is performed on the application system by using code instrumentation technology to obtain parameter information; whether the parameter information matches the user access token is determined; if the parameter information matches the user access token, the user access account information is outputted; the parameter information comprises a user access token in the application system; after determining whether the application system is a local authentication mode according to the parameter information, the following steps are further included: if the application system is a local authentication mode, keyword matching is performed on the parameter information by using a dictionary to obtain user access account information, and the user access account information is outputted.

2. The user access account identification method of claim 1, wherein, the user access account information comprises account password field information.

3. The user access account identification method of claim 1, wherein, after obtaining the user access token corresponding to the user access account information, the following steps are further included: the user access account information and the user access token are stored in a user authentication cache pool.

4. A user access account identification device, characterized by, The application comprises the following steps: a parameter monitoring unit is configured to perform interface parameter monitoring on the application system by using code instrumentation technology to obtain parameter information; a mode determination unit is configured to determine whether the application system is a local authentication mode according to the parameter information; an information obtaining unit is configured to perform interface parameter information monitoring on the application server by using code instrumentation technology to obtain user access account information if the application system is not a local authentication mode; a token obtaining unit is configured to obtain a user access token corresponding to the user access account information; a parameter monitoring unit is configured to perform interface parameter monitoring on the application system by using code instrumentation technology to obtain parameter information; a matching determination unit is configured to determine whether the parameter information matches the user access token; an output unit is configured to output the user access account information if the parameter information matches the user access token; the parameter information comprises a user access token in the application system; a local authentication unit is configured to perform keyword matching on the parameter information by using a dictionary to obtain user access account information if the application system is a local authentication mode, and the user access account information is outputted.

5. The user access account identification apparatus of claim 4, wherein, The application further comprises the following steps: a storage unit is configured to store the user access account information and the user access token in a user authentication cache pool.

6. A computer device, comprising: The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method of any one of claims 1 to 3 when executing the computer program.

7. A storage medium, characterized by The storage medium stores a computer program, and the computer program can implement the method of any one of claims 1 to 3 when executed by a processor.

Images