A method and system for access control of privileged accounts

Abstract

The present application relates to an access control method and system for privileged accounts, which belongs to the field of network security technology. The method includes: binding a privileged account and an account password, wherein the privileged account and the account password are set in different databases; determining a risk level according to the privileged account and the account password, wherein the risk level is used to reflect the access rights and access risks of the privileged account and the account password after binding; and generating an access control policy according to the risk level. The present application has the effect of improving the control of privileged accounts and enhancing network information security.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an access control method and system for privileged accounts. Background Art

[0002] Privileged accounts refer to accounts with higher access rights on assets such as hosts, network devices, and databases within the data center, and are derived from accounts with access rights on all assets. Since privileged accounts in operation and maintenance have higher permissions than ordinary accounts, privileged accounts have become the preferred target of attackers. According to incomplete statistics, 80% to "almost all" of the serious network attacks investigated used privileged accounts at some point in the attack process.

[0003] Therefore, the management of privileged accounts has become an extremely critical link in data asset protection. So how to effectively control access to privileged accounts and improve network information security has become an issue of concern to enterprises. Summary of the invention

[0004] In order to improve the control over privileged accounts and enhance network information security, the present application provides an access control method and system for privileged accounts.

[0005] In a first aspect of the present application, a method for access control of a privileged account is provided. The method comprises: binding a privileged account and an account password, wherein the privileged account and the account password are set in different databases;

[0006] Determine a risk level according to the privileged account and the account password, the risk level being used to reflect the access rights and access risks of the privileged account and the account password after binding;

[0007] An access control policy is generated according to the risk level.

[0008] By adopting the above technical solution, on the one hand, the privileged account and account password are stored separately to reduce the probability of privileged account and account password being attacked, and when the user has access needs, the privileged account and account password are obtained from different databases. By setting different verification methods on the database, the identity security of users who use privileged accounts for access can be guaranteed, and the compliance and security of access can be guaranteed. On the other hand, based on the bound privileged account and account password, the overall access rights and overall access risks of the bound privileged account and account password are determined, so as to facilitate the formulation of targeted access control strategies to control the access process of privileged accounts to ensure information security in applications.

[0009] In a possible implementation: a first risk value is obtained according to historical access data of the privileged account, wherein the historical access data refers to data obtained after audit processing of a video recording, and the video recording is a video recording generated when the privileged account performs access;

[0010] Obtaining a second risk value according to the number of bindings between the privileged account and the account password;

[0011] Obtaining a third risk value according to the attribute information of the account password;

[0012] Obtaining a total risk value according to the first risk value, the second risk value and the third risk value, wherein the total risk value corresponds to a risk level;

[0013] A risk level corresponding to the total risk value is determined.

[0014] By adopting the above technical solution, based on the bound privileged account and account password, the risk level is determined by comprehensively considering factors such as the historical access data of the privileged account, the number of binding times of the privileged account and account password, and the attribute information of the account password, thereby ensuring the accuracy of the obtained risk level, and providing data support for the subsequent targeted formulation of access control strategies.

[0015] In a possible implementation, the historical access data includes an interface name, an IP address, an access duration, and response data, wherein the interface name is the name of the interface called by the privileged account, the IP address is the IP address of the application accessed by the privileged account, the access duration is the duration of the privileged account accessing the application, and the response data is the data returned by the application;

[0016] The obtaining a first risk value according to the historical access data of the privileged account includes:

[0017] Obtaining a first basic score according to the interface name matching;

[0018] Obtaining a second basic score according to the IP address matching;

[0019] Calculate a weight according to the access duration and the response data;

[0020] A first risk value is calculated based on the first basic score, the second basic score and the weight.

[0021] By adopting the above technical solution, the influencing factors of the first risk value include interface name, IP address, access duration and response data. The influencing factors cover a wide range, ensuring the accuracy of the obtained first risk value.

[0022] In a possible implementation manner, the step of calculating the weight according to the access duration and the response data includes:

[0023] Calculate the ideal duration according to the amount of the response data;

[0024] Calculating the difference between the access duration and the ideal duration;

[0025] The difference and the proportion of the access duration are calculated to obtain a weight.

[0026] In a possible implementation, the attribute information includes password strength, number of matches, and survival time, wherein the password strength is related to the length, complexity, and unpredictability of the account password, the number of matches refers to the number of times the account password is bound to all privileged accounts, the all privileged accounts refer to all privileged accounts in a database storing privileged accounts, and the survival time refers to the time the account password is imported into the database storing the account password;

[0027] The obtaining a third risk value according to the attribute information of the account password includes:

[0028] Obtaining a first strength score according to the password strength matching;

[0029] Obtaining a second strength score according to the matching number;

[0030] Obtaining a third strength score according to the survival time matching;

[0031] A third risk value is calculated based on the first strength score, the second strength score and the third strength score.

[0032] By adopting the above technical solution, the influencing factors of the third risk value include password strength, number of matches and survival time. The influencing factors cover a wide range, ensuring the accuracy of the obtained third risk value.

[0033] In a possible implementation, the binding of the privileged account and the account password includes:

[0034] Get privileged accounts;

[0035] Obtaining an account password according to the privileged account;

[0036] Bind the privileged account and account password.

[0037] In a possible implementation, the step of obtaining an account password according to the privileged account includes:

[0038] Outputting a key when the privileged account is determined;

[0039] Determine whether the API interface enters a trigger state according to the key, the API interface is used to retrieve the account password in the second database, and the second database is used to store the account password;

[0040] If yes, then within the validity period of the API interface, if an account and password request is received, the account and password are output, and the output account and password is an account and password that is not occupied and has the least number of binding times with the privileged account;

[0041] Otherwise, the output account password is empty.

[0042] In a possible implementation: the API interface has a corresponding privileged account and IP address, and the privileged account and IP address corresponding to the API interface have the calling authority to call the API interface;

[0043] Outputting the key when determining the privileged account includes:

[0044] Receive a trigger instruction, wherein the trigger instruction includes the privileged account and the IP address of the application accessed by the privileged account; when the privileged account in the trigger instruction is the same as the privileged account corresponding to the API interface, and the IP address in the trigger instruction is the same as the IP address corresponding to the API interface, determine the privileged account.

[0045] By adopting the above technical solution, in the process of obtaining the account password based on the privileged account obtained, it is necessary to go through multiple layers of management and control such as privileged account verification, key verification, and API interface validity time limit to ensure the identity security of users who use privileged accounts to access, and to ensure the compliance and security of access.

[0046] In a second aspect of the present application, an access control system for privileged accounts is provided. The system includes: a data processing module for binding a privileged account and an account password, wherein the privileged account and the account password are set in different databases;

[0047] A data determination module, used to determine a risk level according to the privileged account and the account password, wherein the risk level is used to reflect the access rights and access risks of the privileged account and the account password after binding;

[0048] A data generation module is used to generate an access control policy according to the risk level.

[0049] In summary, the present application includes the following beneficial technical effects:

[0050] On the one hand, the privileged account and account password are stored separately to reduce the probability of privileged account and account password being attacked. When the user has access needs, the privileged account and account password are obtained from different databases. Through multiple layers of management and control such as privileged account verification, key verification, and API interface validity time limit, the identity security of users who use privileged accounts for access is guaranteed, and the compliance and security of access are guaranteed. On the other hand, based on the bound privileged account and account password, the historical access data of the privileged account, the number of binding times of the privileged account and account password, and the attribute information of the account password are comprehensively considered to determine the risk level, thereby ensuring the accuracy of the obtained risk level, and then providing data support for the subsequent targeted formulation of access control strategies, and then using access control strategies to control the access process of privileged accounts to ensure information security in applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a flowchart of an access control method for a privileged account according to an embodiment of the present application.

[0052] Figure 2 It is a block diagram of an access control system for privileged accounts according to an embodiment of the present application.

[0053] Explanation of the accompanying drawings: 1. Data processing module; 2. Data determination module; 3. Data generation module. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0055] In order to improve the control of privileged accounts, this application proposes an access control method for privileged accounts. Figure 1 As shown, the main process of the access control method for privileged accounts is described as follows.

[0056] Step S1: Bind the privileged account and the account password, where the privileged account and the account password are set in different databases.

[0057] The privileged account and the account password are stored in different databases in advance. For the convenience of distinction, the database storing the privileged account is called the first database, and the database storing the account password is called the second database. In the first database, multiple privileged accounts are sorted in order of access rights from large to small, and the corresponding relationship between the privileged account and the application is set according to the confidentiality level of each application, that is, the privileged account corresponding to the application is required to access the application. It should be noted that an application can have a corresponding relationship with multiple privileged accounts. When the access rights of the privileged account are higher, the number of applications with corresponding relationships is greater. In the second database, an API interface for calling the account password is set, and different encryption algorithms are set for different API interfaces, such as the advanced encryption standard (AES), the triple data encryption algorithm (3DES) and the encryption algorithm of the SM series, etc., and a corresponding effective time and calling method are set for each API interface. The effective time means that after the API interface is triggered, an instruction to request the account password needs to be initiated within the effective time, otherwise the API interface is closed after the effective time is exceeded, and the API interface needs to be retriggered. The calling methods of the API interface include REST, WebService, SDK, etc. In addition, parameters such as IP addresses and privileged accounts with call permissions are set for each API interface. Only IP addresses and privileged accounts with call permissions can retrieve account passwords from the second database. It should also be noted that each API interface has a corresponding application, and the corresponding API interface can be triggered by accessing the application.

[0058] When users access data with high confidentiality, they need to obtain a privileged account and account password with access rights, and then bind the privileged account and account password. However, the privileged account and account password are stored in different databases, so they need to obtain the privileged account and account password separately. The following is the specific acquisition process:

[0059] First, obtain a privileged account. The user requests a privileged account from the first database through the user terminal. In a specific example, the user sends a privileged account request to the first database through the user terminal, and the first database randomly returns a privileged account corresponding to the application to the user. In another specific example, the user sends a privileged account request on the web page of the application, and multiple privileged accounts corresponding to the application are obtained. The user randomly selects a privileged account as the privileged account for accessing the application. After the user completes the selection, the other privileged accounts are automatically hidden to avoid the user from repeatedly changing the privileged account.

[0060] Then, the account password is obtained according to the privileged account. After the user enters the privileged account on the web page of the application, he clicks to download the key. The web page generates a trigger instruction according to the user's operation. The trigger instruction includes the privileged account entered by the user and the IP address of the web page. After the second database receives the trigger instruction, it suspends the API interface corresponding to the application. When the privileged account and IP address in the trigger instruction are verified, the second database returns a key to the web page. The key corresponds to the encryption algorithm of the API interface and is used to decrypt the API interface. After the user receives the key, he enters the key in the web page. At this time, the API interface and the application are connected, that is, the API interface is in the triggered state. When the API interface enters the triggered state, the second database starts timing. Within the valid time of the API interface, if the second database receives an account password request, and the account password request is also an instruction entered by the user through the web page of the application, then the second database retrieves an account password according to the calling method supported by the API interface and returns it to the web page. The returned account password is an account password that is not currently occupied and has the least number of binding times with the requested privileged account. If there are still multiple accounts and passwords with the least number of binding times, then an account and password with the least number of matches is selected and returned to the user. The number of matches refers to the number of times the account and password are bound to all privileged accounts in the first database.

[0061] Of course, if the verification fails in any process of obtaining the account and password, the account and password output by the second database will be empty. For example, the privileged account or IP address verification in the trigger instruction fails, or the second database does not receive the key or the time of receiving the account and password exceeds the validity period of the API interface, then the output account and password will be empty. At this time, you need to return to the step of obtaining the privileged account.

[0062] Finally, bind the privileged account and account password. Specifically, enter the privileged account and account password on the application's web page and click the bind button on the web page to establish the binding relationship between the privileged account and account password.

[0063] Step S2: Determine a risk level based on the privileged account and account password. The risk level is used to reflect the access rights and access risks of the privileged account and account password after binding.

[0064] After the privileged account and the account password are bound, the user can click the Continue button or the Confirm button on the web page to determine the risk level, so that the control strategy for controlling the access behavior of the privileged account can be determined based on the risk level. It should be noted that the various types of buttons set on the Web are virtual and are a program for capturing user operations. Of course, for the privileged account and account password that have established a binding relationship, the application can also automatically analyze the risk level corresponding to the privileged account and account password.

[0065] Specifically, the process of determining the risk level is shown in step S21 to step S24:

[0066] Step S21: Obtain a first risk value according to historical access data of the privileged account.

[0067] The historical access data includes the interface name, IP address, access duration, and response data, wherein the interface name refers to the name of the interface called by the privileged account through the application, which is used to determine the interface called by the privileged account. It should be noted that the interface here is not the API interface in the second database mentioned above. The interface here refers to the interface that can automatically retrieve the data required by the user based on the keyword by entering the keyword in the web page of the application during the past access process. For example, there are multiple virtual interfaces between the employee management APP of enterprise A and the employee database. User a can enter the keyword in the web page of the employee management APP, and then one or more interfaces automatically retrieve the data in the employee database. This application records the name of the interface that can retrieve the data required by the user. The IP address refers to the IP address of the application accessed by the privileged account, which is used to determine the application accessed by the privileged account. The access duration refers to the duration of the user's access to the application, which is the time period between the user logging in and exiting the application. Response data refers to the data returned by the application when the user accesses the application.

[0068] It should be noted that the process of obtaining historical access data is as follows: in the past access process, when the user uses the privileged account and account password to access the application, the recording plug-in set in the application records all the user's operation processes, and then performs audit processing based on the recording to obtain historical access data. In the historical access data, the privileged account used by the user is the same, but the account password used each time may be different, that is, the historical access data generated for the privileged account.

[0069] The process of obtaining the first risk value based on the historical access data of the privileged account is as follows:

[0070] First, the first basic score is obtained by matching the interface name. Since the data retrieved by different interfaces may be different, and the data has different confidentiality requirements, different first basic scores are set for different interfaces, and the higher the confidentiality of the data that the interface can retrieve, the larger the first basic score corresponding to the interface. When the historical access data contains multiple interfaces, the average of the first basic scores corresponding to the multiple interfaces is calculated, and the average is used as the first basic score of the privileged account. Then, the second basic score is obtained by matching the IP address. Since the information involved in the application has different confidentiality requirements, and some applications even require privileged accounts with higher permissions to access, this example also sets different second basic scores for different applications, and the higher the confidentiality of the information involved in the application, the higher the second basic score corresponding to the application. Similarly, when the historical access data contains multiple applications, the average of the second basic scores corresponding to the multiple applications is calculated, and the average is used as the second basic score of the privileged account. In addition, the weight is calculated based on the access time and response data. Specifically, the ideal time is calculated based on the amount of response data. The larger the amount of data, the longer the time consumed to retrieve, retrieve, and transmit the response data, and the longer the access time, that is, the longer the calculated ideal time; when the amount of data is smaller, the shorter the time consumed to retrieve, retrieve, and transmit the response data, the shorter the calculated ideal time. After obtaining the ideal time, calculate the difference between the access time and the ideal time, and then calculate the ratio of the difference to the access time to obtain the weight. Similarly, when the historical access data contains multiple weights, calculate the average of the multiple weights, and use the average as the weight of the privileged account.

[0071] Finally, the sum of the first basic score and the second basic score is calculated, and then the value of the weight part is added to the sum, so that the first risk value is obtained as follows:

[0072] First risk value=(first basic score+second basic score)*(1+weight).

[0073] Step S22: Obtain a second risk value according to the number of bindings between the privileged account and the account password.

[0074] The more times the same privileged account and account password are bound, the greater the possibility of being cracked. Therefore, different second risk values ​​are set for different binding times. The higher the binding times, the greater the corresponding second risk value. For example, the second risk value is n times the binding times, n≥1.

[0075] Step S23: Obtain a third risk value according to the attribute information of the account password.

[0076] The attribute information of the account password includes password strength, number of matches and survival time. Among them, password strength refers to the effectiveness of the account password against guessing or brute force cracking, and the password strength is related to the length, complexity and unpredictability of the account password. In this example, different first strength scores are set for account passwords with different password strengths, and the higher the password strength belongs to a strong password, the higher the corresponding first strength score; and the lower the password strength belongs to a weak password, the lower the corresponding first strength score. The number of matches refers to the number of times the account password is bound to all privileged accounts in the first database. The more binding times, the more times the account password is used, and the higher the possibility of being cracked. Therefore, different second strength scores are set for account passwords with different matching times, and the higher the matching times, the larger the corresponding second strength score. Survival time refers to the length of time the account password exists in the second database. In the initial stage of account password setting, it is imported into the second database and managed by the second database, so the length of time the account password exists in the second database is also the survival time of the account password. The longer the account password is alive, the higher the risk of it being cracked, or it has become a zombie password and is difficult to be used. Therefore, different third strength scores are set for accounts and passwords with different survival times, and the longer the survival time, the larger the corresponding third strength score.

[0077] Finally, the sum of the first intensity score, the second intensity score and the third intensity score is calculated, and the sum is used as the third risk value.

[0078] It should be noted that the attribute information of the account and password is data obtained by periodically scanning the second database, or is data that the second database synchronously pushes to the user's mailbox after retrieving the account and password.

[0079] Step S24: Obtain a total risk value according to the first risk value, the second risk value, and the third risk value, and determine a risk level corresponding to the total risk value.

[0080] Based on the first risk value, the second risk value and the third risk value obtained in step S21-step S23, the sum of the three is calculated, and the sum is used as the total risk value. It should be noted that this example sets a risk level corresponding to the total risk value in advance. The larger the total risk value, the higher the corresponding risk level. The higher the risk level, the greater the access rights of the bound privileged account and account password, the wider the range of accessible information, and the higher the risk when accessing.

[0081] Step S3: Generate an access control policy based on the risk level.

[0082] For different risk levels, corresponding access time periods, access permissions, access times and other elements are set, so that after obtaining the risk level, the corresponding access time period, access permissions and access times can be determined, and finally the process of privileged accounts accessing applications can be controlled based on the determined access time period, access permissions and access times to ensure information security in the application. For example, in the early access time period, users can only access part of the application information through privileged accounts, and in the middle and late access time period, the scope of information that users can access through privileged accounts becomes larger. For example, if a user enters a privileged account or account password incorrectly for multiple times, the application's Web page will be locked and the user will be prohibited from accessing the application, or if the privileged account accesses the application too many times within a day, the application's Web page will be locked and the user will be prohibited from accessing the application after reaching a certain number of times.

[0083] It should be noted that the higher the risk level of the privileged account and account password, the shorter the access time period, the higher the access permission, and the fewer the number of accesses. In the actual management and control process, if the privileged account exceeds any requirement, such as not accessing within the access time period, the access permission exceeds the range, or the number of accesses exceeds the threshold, the application's web page will be automatically locked and the user will be prohibited from accessing the application.

[0084] To summarize, the implementation principle of an access control method for privileged accounts in an embodiment of the present application is as follows: first, the privileged account and account password are obtained from different databases respectively. Since different databases have different verification methods, the identity security of users who use privileged accounts for access can be guaranteed, and the compliance and security of access can be guaranteed; then, the historical access data of the privileged account, the number of binding times of the privileged account and account password, and the attribute information of the account password are comprehensively considered to determine the risk level, that is, to determine the overall access rights of the bound privileged account and account password, as well as the overall access risk, so as to facilitate the formulation of targeted access control strategies to manage the access process of the privileged account to ensure information security in the application.

[0085] Figure 2 A block diagram of an access control system for privileged accounts according to an embodiment of the present application is shown. The system includes a data processing module 1 , a data determination module 2 and a data generation module 3 .

[0086] The data processing module 1 is used to bind the privileged account and the account password, and the privileged account and the account password are set in different databases.

[0087] The data determination module 2 is used to determine the risk level according to the privileged account and account password, and the risk level is used to reflect the access rights and access risks of the privileged account and account password after binding.

[0088] The data generation module 3 is used to generate access control policies according to risk levels.

[0089] The modules involved in the embodiments described in the present application may be implemented by software or hardware. The modules described may also be set in a processor, for example, it may be described as: a processor includes a data processing module 1, a data determination module 2, and a data generation module 3. The names of these modules do not constitute a limitation on the modules themselves in some cases, for example, the data processing module 1 may also be described as a "module for binding privileged accounts and account passwords".

[0090] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0091] In order to better execute the program of the above method, the present application also provides an access control device for privileged accounts, and the device includes a memory and a processor.

[0092] The memory may be used to store instructions, programs, codes, code sets or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the above-mentioned access control method for privileged accounts, etc.; the data storage area may store data involved in the above-mentioned access control method for privileged accounts, etc.

[0093] The processor may include one or more processing cores. The processor calls the data stored in the memory by running or executing the instructions, programs, code sets or instruction sets stored in the memory, performs various functions of the present application and processes data. The processor may be at least one of a special purpose integrated circuit, a digital signal processor, a digital signal processing device, a programmable logic device, a field programmable gate array, a central processing unit, a controller, a microcontroller and a microprocessor. It is understandable that for different devices, the electronic device used to implement the above-mentioned processor function can also be other, and the embodiments of the present application are not specifically limited.

[0094] The present application also provides a computer-readable storage medium, for example, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc., which can store program codes. The computer-readable storage medium stores a computer program that can be loaded by a processor and execute the above-mentioned access control method for privileged accounts.

[0095] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A method for access control of privileged accounts, characterized in that: include: Binding a privileged account and an account password, wherein the privileged account and the account password are set in different databases; Determine a risk level according to the privileged account and the account password, the risk level being used to reflect the access rights and access risks of the privileged account and the account password after binding; generating an access control policy based on the risk level; The determining of the risk level according to the privileged account and the account password includes: Obtaining a first risk value according to historical access data of the privileged account, wherein the historical access data refers to data obtained after audit processing of a video recording, and the video recording is a video recording generated when the privileged account performs an access; Obtaining a second risk value according to the number of bindings between the privileged account and the account password; Obtaining a third risk value according to the attribute information of the account password; Obtaining a total risk value according to the first risk value, the second risk value and the third risk value, wherein the total risk value corresponds to a risk level; A risk level corresponding to the total risk value is determined.

2. The method for access control of privileged accounts according to claim 1, characterized in that: The historical access data includes an interface name, an IP address, an access duration, and response data, wherein the interface name is the name of the interface called by the privileged account, the IP address is the IP address of the application accessed by the privileged account, the access duration is the duration of the privileged account accessing the application, and the response data is the data returned by the application; The obtaining a first risk value according to the historical access data of the privileged account includes: Obtaining a first basic score according to the interface name matching; Obtaining a second basic score according to the IP address matching; Calculate a weight according to the access duration and the response data; A first risk value is calculated based on the first basic score, the second basic score and the weight.

3. The method for access control of privileged accounts according to claim 2, characterized in that: The weight is calculated according to the access duration and the response data, including: Calculate the ideal duration according to the amount of the response data; Calculating the difference between the access duration and the ideal duration; The difference and the proportion of the access duration are calculated to obtain a weight.

4. The method for access control of privileged accounts according to claim 1, characterized in that: The attribute information includes password strength, number of matches and survival time. The password strength is related to the length, complexity and unpredictability of the account password. The number of matches refers to the number of times the account password is bound to all privileged accounts. The all privileged accounts refer to all privileged accounts in the database storing privileged accounts. The survival time refers to the time the account password is imported into the database storing the account password. The obtaining a third risk value according to the attribute information of the account password includes: Obtaining a first strength score according to the password strength matching; Obtaining a second strength score according to the matching number; Obtaining a third strength score according to the survival time matching; A third risk value is calculated based on the first strength score, the second strength score and the third strength score.

5. The method for controlling access to privileged accounts according to claim 1, characterized in that: The binding of privileged account and account password includes: Get privileged accounts; Obtaining an account password according to the privileged account; Bind the privileged account and the account password.

6. The method for controlling access to privileged accounts according to claim 5, characterized in that: The obtaining the account password according to the privileged account includes: Outputting a key when the privileged account is determined; Determine whether the API interface enters a trigger state according to the key, the API interface is used to retrieve the account password in the second database, and the second database is used to store the account password; If yes, then within the validity period of the API interface, if an account and password request is received, the account and password are output, and the output account and password is an account and password that is not occupied and has the least number of binding times with the privileged account; Otherwise, the output account password is empty.

7. The method for controlling access to privileged accounts according to claim 6, characterized in that: The API interface has a corresponding privileged account and IP address, and the privileged account and IP address corresponding to the API interface have the calling authority to call the API interface; Outputting the key when determining the privileged account includes: receiving a trigger instruction, the trigger instruction including the privileged account and an IP address of an application accessed by the privileged account; When the privileged account in the trigger instruction is the same as the privileged account corresponding to the API interface, and the IP address in the trigger instruction is the same as the IP address corresponding to the API interface, the privileged account is determined.

8. An access control system for privileged accounts, characterized in that: include: A data processing module (1) is used to bind a privileged account and an account password, wherein the privileged account and the account password are set in different databases; A data determination module (2), used to determine a risk level according to the privileged account and the account password, wherein the risk level is used to reflect the access rights and access risks of the privileged account and the account password after binding; A data generation module (3), used for generating an access control policy according to the risk level; The determining of the risk level according to the privileged account and the account password includes: Obtaining a first risk value according to historical access data of the privileged account, wherein the historical access data refers to data obtained after audit processing of a video recording, and the video recording is a video recording generated when the privileged account performs an access; Obtaining a second risk value according to the number of bindings between the privileged account and the account password; Obtaining a third risk value according to the attribute information of the account password; Obtaining a total risk value according to the first risk value, the second risk value and the third risk value, wherein the total risk value corresponds to a risk level; A risk level corresponding to the total risk value is determined.

Images