Privileged account management method and system

Abstract

The present invention provides a privileged account management method and system, which relates to the technical field of account management. The method includes: obtaining the owner information of the privileged account; obtaining the log record information of the privileged account; determining the account risk coefficient according to the owner information and the log record information; obtaining the password change information of the privileged account through the account password modification center; determining whether it is necessary to change the privileged account password according to the password change information and the account risk coefficient; obtaining the privileged account's permission list through the account identification hosting platform; determining whether it is necessary to modify the privileged account's permissions according to the permission list and the owner information. According to the present invention, it can ensure that all privileged account accesses and operations have log records, and manage the identity authentication information and permission lists of all privileged accounts, thereby improving the efficiency and effect of privileged account management and enhancing the security of privileged accounts.

Description

Technical Field

[0001] The present invention relates to the technical field of account management, and in particular to a privileged account management method and system. Background Art

[0002] In the related art, CN109934726A discloses an institutional account management system; the institutional account management system includes a sub-account establishment module, an information release module, a sub-account assessment module, and a sub-account processing module. This solution provides a new institutional account management system, which can select sub-accounts for publishing information according to the activity index of the information, and can perform assessment management on sub-accounts under the main account, and disable, unbind, and other processing for sub-accounts that fail the assessment, so as to ensure the quality of each sub-account under the main account, and further ensure the popularity and activity of information released through the sub-account.

[0003] CN118172014A discloses a platform and method for cloud host account management, wherein the account management module supports personalized customization of account sets for managed users, and users can independently match account sets online, thereby satisfying the personalized configuration of cloud host accounts; further, the template management module supports users to independently configure account creation templates, and the host account management module supports the execution of account creation tasks, monitors the progress of account creation tasks, and provides progress display in a visual operation interface, so that users can use templates to create accounts even if they do not log in to the cloud host through an administrator account. In addition, users can easily view the specific situation of the cloud host account in the visual operation interface, thereby improving the efficiency and quality of account management and reducing the error probability of account management.

[0004] Based on the above related technologies, the technical problem of high error probability in account management can be solved. However, the related technologies do not take into account the security status and authority status of the account during the account management process, that is, it is impossible to comprehensively manage the account based on the security status and authority status of the account.

[0005] The information disclosed in the background technology section of this application is only intended to deepen the understanding of the general background technology of this application, and should not be regarded as an admission or any form of suggestion that the information constitutes the prior art already known to those skilled in the art. Summary of the invention

[0006] The present invention provides a privileged account management method and system, which can solve the technical problem that related technologies cannot comprehensively manage accounts according to the security status and authority status of the accounts.

[0007] According to a first aspect of the present invention, there is provided a privileged account management method, comprising:

[0008] Obtaining owner information of the privileged account through the account identification hosting platform, wherein the owner information includes: owner working hours and owner work requirements;

[0009] Obtaining log information of privileged accounts during the management period through the account identification hosting platform, wherein the log information includes: number of account login failures, account login time, account login IP address, account login location, account operation frequency, and account operation failure information;

[0010] Determining an account risk factor based on the owner information and the log record information;

[0011] Obtain password change information for privileged accounts through the account password change platform;

[0012] Determining whether the privileged account password needs to be changed based on the password change information and the account risk factor;

[0013] Obtaining a list of permissions for a privileged account through an account identification hosting platform, wherein the list of permissions includes: accessible systems, accessible data, accessible resources, and executable operations;

[0014] Determine whether the privileged account permissions need to be modified based on the permission list and the owner information.

[0015] According to a second aspect of the present invention, there is provided a privileged account management system, comprising:

[0016] An owner information module, used to obtain owner information of a privileged account through an account identification hosting platform, wherein the owner information includes: owner working hours and owner work requirements;

[0017] A log recording module, used to obtain log recording information of privileged accounts within a management period through an account identification hosting platform, wherein the log recording information includes: number of account login failures, account login time, account login IP address, account login location, account operation frequency, and account operation failure information;

[0018] An account risk module, used to determine an account risk coefficient based on the owner information and the log record information;

[0019] The password change module is used to obtain the password change information of the privileged account through the account password change platform;

[0020] A change determination module, used to determine whether the privileged account password needs to be changed according to the password change information and the account risk factor;

[0021] A permission list module is used to obtain a permission list of a privileged account through an account identification hosting platform, wherein the permission list includes: accessible systems, accessible data, accessible resources, and executable operations;

[0022] The permission modification module is used to determine whether the privileged account permissions need to be modified based on the permission list and the owner information.

[0023] Technical effect: According to the present invention, it is possible to ensure that all privileged account access and operations are logged, and manage the identity authentication information and permission lists of all privileged accounts. Further, based on the log records and identity authentication information, the security risk status of the privileged account can be accurately analyzed, and according to the security risk status and password change information of the privileged account, an automated password change function can be provided for the privileged account. At the same time, based on the permission list and identity authentication information, it can ensure that the account owner only obtains the minimum permissions required to complete his work, thereby improving the efficiency and effectiveness of privileged account management and enhancing the security of privileged accounts. When determining the account login risk coefficient, the account login risk coefficient can be determined based on the owner's working hours, account login time, account login failure times, regular login vectors, and login vectors. During the calculation process, the security risk status of the privileged account can be comprehensively evaluated based on the login location and login IP address, the login failure times, and the login time, thereby improving the comprehensiveness and accuracy of the account login risk coefficient. When determining the account operation risk coefficient, the account operation risk coefficient can be determined based on the number of account access resource failures, the number of account operation failures, the account operation frequency, the resource access failure time identification result, the resource access failure IP address identification result, the operation failure time identification result and the operation failure IP address identification result. During the calculation process, the security risk of the privileged account can be comprehensively assessed from the operation frequency and operation failure status of the privileged account. Furthermore, when analyzing the operation failure status of the privileged account, it can be determined in the form of conditional functions whether the operation failure status under abnormal conditions occurs, thereby improving the comprehensiveness and accuracy of the account operation risk coefficient.

[0024] It should be understood that the above general description and the following detailed description are exemplary and explanatory only and do not limit the present invention. Other features and aspects of the present invention will become more apparent from the following detailed description of exemplary embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other embodiments can be obtained based on these drawings without creative work.

[0026] Figure 1 A schematic diagram of a process flow of a privileged account management method according to an embodiment of the present invention is exemplarily shown;

[0027] Figure 2 A block diagram of a privileged account management system according to an embodiment of the present invention is exemplarily shown. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0030] Figure 1 A flowchart of a privileged account management method according to an embodiment of the present invention is exemplarily shown, and the method includes:

[0031] Step S101, obtaining owner information of a privileged account through an account identification hosting platform, wherein the owner information includes: owner working hours and owner work requirements;

[0032] Step S102, obtaining log record information of the privileged account within the management period through the account identification hosting platform, wherein the log record information includes: the number of account login failures, account login time, account login IP address, account login location, account operation frequency and account operation failure information;

[0033] Step S103, determining the account risk factor according to the owner information and the log record information;

[0034] Step S104, obtaining password change information of the privileged account through the account password change platform;

[0035] Step S105, determining whether the privileged account password needs to be changed according to the password change information and the account risk factor;

[0036] Step S106, obtaining a permission list of the privileged account through the account identification hosting platform, wherein the permission list includes: accessible systems, accessible data, accessible resources, and executable operations;

[0037] Step S107, determining whether the privileged account permissions need to be modified based on the permission list and the owner information.

[0038] According to the privileged account management method of the embodiment of the present invention, it is possible to ensure that the access and operations of all privileged accounts are logged, and to manage the identity authentication information and permission lists of all privileged accounts. Furthermore, based on the log records and identity authentication information, the security risk status of the privileged accounts can be accurately analyzed, and an automated password changing function can be provided for the privileged accounts based on the security risk status and password change information of the privileged accounts. At the same time, based on the permission list and identity authentication information, it can be ensured that the account owners only obtain the minimum permissions required to complete their work, thereby improving the efficiency and effectiveness of privileged account management and enhancing the security of privileged accounts.

[0039] According to an embodiment of the present invention, in step S101, the owner information of the privileged account is obtained through the account identification hosting platform, wherein the owner information includes: the owner's working hours and the owner's work requirements.

[0040] For example, the account identification hosting platform is responsible for managing and hosting the authentication information of all privileged accounts. The authentication information includes the working hours of the owner of the privileged account (for example, the owner's working hours are 9:00-17:00) and the owner's work requirements (for example, which systems the privileged account owner needs to access and which operations he needs to perform).

[0041] According to one embodiment of the present invention, in step S102, the log record information of the privileged account during the management period is obtained through the account identification hosting platform, wherein the log record information includes: the number of account login failures, account login time, account login IP address, account login location, account operation frequency and account operation failure information.

[0042] For example, the account identification hosting platform ensures that all access and operations of privileged accounts are logged. Through the account identification hosting platform, the log record information of the privileged accounts during the management cycle can be obtained. The log record information includes: number of account login failures, account login time, account login IP address, account login location, account operation frequency and account operation failure information.

[0043] According to an embodiment of the present invention, in step S103, the account risk coefficient is determined based on the owner information and the log record information.

[0044] According to one embodiment of the present invention, step S103 includes:

[0045] Obtaining historical log record information of the privileged account within a historical management period, wherein the historical log record information includes: historical account login IP addresses and historical account login locations;

[0046] Determine the regular account login IP address based on the historical account login IP address;

[0047] Determine the regular account login location based on the historical account login location;

[0048] Determining a regular login vector according to the regular account login IP address and the regular account login location;

[0049] Determine a login vector according to the account login IP address and the account login location;

[0050] Determining an account login risk coefficient according to the owner's working hours, the account login time, the number of account login failures, the conventional login vector and the login vector;

[0051] Determine the number of failed resource access attempts and failed operations of the account based on the failed operation information;

[0052] According to the operation failure information, determine the IP address where the account fails to access the resource, the time when the account fails to access the resource, the IP address where the account operation fails, and the time when the account operation fails;

[0053] Determine a resource access failure time identification result according to the owner's working hours and the account's resource access failure time;

[0054] Determine the identification result of the IP address that failed to access the resource according to the regular account login IP address and the IP address that failed to access the resource by the account;

[0055] Determine the operation failure time identification result according to the owner's working time and the account operation failure time;

[0056] Determine the operation failure IP address identification result according to the regular account login IP address and the account operation failure IP address;

[0057] Determine the account operation risk coefficient according to the number of failed resource access attempts, the number of failed account operation attempts, the account operation frequency, the resource access failure time identification result, the resource access failure IP address identification result, the operation failure time identification result, and the operation failure IP address identification result;

[0058] An account risk coefficient is determined based on the account login risk coefficient and the account operation risk coefficient.

[0059] For example, obtain historical log record information of a privileged account during a historical management period in which its owner has not changed, determine the regular account login IP address and regular account login location based on the historical login IP address and historical login location most commonly used by the privileged account in the historical log record information, convert the regular account login IP address and regular account login location into vector form, and determine the regular login vector; determine the login vector based on the account login IP address and account login location of the privileged account in the current management period; evaluate the security risk of the privileged account based on the owner's working hours, account login time, number of account login failures, regular login vectors and login vectors, and determine the account login risk coefficient, which represents the account security risk status determined based on the account login status; the operation failure information in the log record information includes: the number of account access resource failures, the number of account operation failures, the account access resource failure IP address (the IP address when the privileged account fails to access the resource), the account access resource failure time (the specific time of the resource access failure), the account operation failure IP address (the IP address when the privileged account fails to operate) and the account operation failure time (the specific time of the operation failure); conduct an operation based on the owner's working hours and the account access resource failure time of the privileged account owner By comparing the IP address of the regular account login and the IP address of the account failure to access resources, it is determined whether the IP address used when the account fails to access resources belongs to the regular account login IP address, and the identification result of the IP address of the failed access resource is determined; by comparing the working hours of the owner of the privileged account and the time of the account operation failure, it is determined whether the time point of the account operation failure is within the working hours, and the identification result of the operation failure time is determined; by comparing the regular account login IP address and the account operation failure IP address, it is determined whether the IP address used when the account operation fails belongs to the regular account login IP address, and the identification result of the operation failure IP address is determined; according to the number of account access resource failures, the number of account operation failures, the account operation frequency, the identification result of the time of the failed access resource, the identification result of the IP address of the failed access resource, the identification result of the failed access resource IP address, the identification result of the failed operation time, and the identification result of the failed operation IP address, the security risk of the account is evaluated to determine the account operation risk coefficient, which represents the account security risk status determined according to the operation status of the privileged account; the account login risk coefficient and the account operation risk coefficient are weighted and summed to determine the account risk coefficient.

[0060] According to an embodiment of the present invention, the account login risk coefficient is determined according to the owner's working hours, the account login time, the number of account login failures, the conventional login vector and the login vector, including: determining the account login risk coefficient of the kth privileged account according to formula (1): ,

[0061] (1)

[0062] in, , and is the preset weight, if is the conditional function, min is the minimum value function, is the preset similarity threshold, is the login time of the kth privileged account during the management period. The IP address of the account login for the i-th login of the k-th privileged account within the management period. is the account login location of the kth privileged account during the i-th login period, is the login vector of the kth privileged account during the management period. for The transposed vector of Working hours for the owner of the k-th privileged account, The regular account login IP address of the kth privileged account, is the regular account login location of the kth privileged account, is the regular login vector of the kth privileged account, The number of login failures of the kth privileged account within the management period, is the threshold of the number of failed login attempts for a preset account, n is the number of login attempts of the kth privileged account within the management period, i≤n, and both i and n are positive integers.

[0063] According to one embodiment of the present invention, is the cosine similarity between the login vector of the kth privileged account during the i-th login within the management cycle and the regular login vector of the kth privileged account. The smaller the cosine similarity, the greater the difference between the account login IP address and account login location of the kth privileged account during the i-th login within the management cycle and the regular account login IP address and regular account login location. If the login location and login IP address do not match the regular login location and regular login IP address of the privileged account owner, it means that there is a security risk in the privileged account. The greater the login security risk of the kth privileged account during the i-th login within the management cycle, The minimum value of the cosine similarity between the login vector of the kth privileged account that logged in n times during the management period and the regular login vector of the kth privileged account is taken. The above-mentioned minimum value-taking process can be used to determine the situation in which the kth privileged account has the greatest login security risk during the management period. In formula (1), the conditional function The value of includes the following two cases, when satisfying When the condition is met, the minimum value of the cosine similarity between the login vector of the kth privileged account during the management period and the regular login vector of the kth privileged account is less than the preset similarity threshold, indicating that the login security risk of the kth privileged account during the management period is relatively high. The value of this condition function is 1. When the condition is met, it means that the login security risk of the k-th privileged account during the i-th login in the management cycle is relatively small, and the value of the condition function is 0. is the relative difference between the preset account login failure threshold and the account login failure count of the kth privileged account in the management cycle. The smaller the ratio, The larger the value of , the more login failures the kth privileged account has during the management cycle. If a privileged account has multiple failed login attempts in a short period of time, it means that someone may be trying to illegally access the privileged account, and the security risk of the privileged account is relatively high.

[0064] According to one embodiment of the present invention, Working hours for the owner of the k-th privileged account, In the form of a set, in formula (1), the conditional function The value of includes the following two cases, when satisfying When the condition is met, the login time of the kth privileged account during the management period is within the owner's working hours, indicating that the login security risk of the privileged account is small, and the value of the condition function is 0. When the condition is met, the login time of the i-th login of the k-th privileged account during the management period is not within the owner's working hours. Login attempts during non-working hours may indicate that the account is at risk of illegal access. The login security risk of the privileged account is relatively high, and the value of the condition function is 1. It is the ratio of the number of logins with abnormal login time to the total number of logins within the management cycle. The larger the ratio is, the greater the security risk of the kth privileged account within the management cycle.

[0065] In this way, the account login risk coefficient is determined based on the owner's working hours, account login time, number of account login failures, regular login vectors and login vectors. During the calculation process, the security risk status of the privileged account can be comprehensively evaluated based on the login location and login IP address, number of login failures and login time, thereby improving the comprehensiveness and accuracy of the account login risk coefficient.

[0066] According to an embodiment of the present invention, the account operation risk coefficient is determined according to the number of failed access resource accesses by the account, the number of failed operation operations by the account, the frequency of the operation of the account, the time identification result of the failed access resource access, the IP address identification result of the failed access resource, the time identification result of the failed operation, and the IP address identification result of the failed operation, including: determining the account operation risk coefficient of the kth privileged account according to formula (2): ,

[0067] (2)

[0068] Among them, if is a conditional function, min is a minimum value function, and or is a logical operator of "or". is the account operation frequency of the kth privileged account in the management cycle, To preset the account operation frequency threshold, is the number of failed resource access attempts by the kth privileged account within the management cycle, The threshold for the number of failed resource access attempts for a preset account. The IP address identification result of the failed resource access for the jth time that the kth privileged account failed to access the resource within the management cycle. , The resource access failure time identification result of the jth failed resource access failure of the kth privileged account within the management cycle, , is the number of failed account operations of the kth privileged account within the management cycle, To set the threshold for failed account operations, The IP address identification result of the failed operation of the k-th privileged account during the management cycle. , The operation failure time identification result of the k-th privileged account in the management cycle for the r-th operation failure, , m is the number of times the privileged account fails to access resources, R is the number of times the privileged account fails to operate, j≤m, r≤R, j, m, r and R are all positive integers.

[0069] According to one embodiment of the present invention, is the relative difference between the account operation frequency of the kth privileged account in the management period and the preset account operation frequency threshold. The smaller the ratio, The larger the value of , the greater the account operation frequency of the k-th privileged account during the management cycle. An abnormally high operation frequency indicates that the privileged account may be used for illegal activities, indicating that the security risk of the k-th privileged account during the management cycle is greater.

[0070] According to one embodiment of the present invention, in formula (2), the conditional function The value of includes the following two cases, when satisfying When the condition is met, the number of failed accesses to resources by the kth privileged account in the management cycle is greater than the preset number of failed accesses to resources threshold. Frequent failures to access resources indicate that the privileged account may be illegally misused and the security risk of the privileged account is high. The value of the condition function is 1. When the condition is , the value of the condition function is the inner condition function The value of the inner conditional function includes the following two cases: When the condition is true, the value of the inner condition is 1. Indicates that the IP address of the resource access failure for the jth time during the management cycle does not belong to the regular account login IP address. Indicates taking the minimum value of the IP address identification results of m failed resource accesses within the management period. The above minimum value process can be used to determine whether an IP address anomaly occurs when a resource access failure occurs within the management period. The time of the jth failed access to a resource within the management cycle does not belong to the owner's working time. Indicates taking the minimum value of the time identification results of the m failed access resource failures within the management cycle. The above processing of taking the minimum value can be used to determine whether a time anomaly occurs when the access to the resource fails within the management cycle. Indicates that when access to resources fails during the management cycle, an abnormal IP address or time occurs. The security risk of the privileged account is high. When the condition is met, it means that no IP address anomaly or time anomaly occurs when access to resources fails within the management cycle. The value of this inner condition function is 0, and the security risk of the privileged account is small.

[0071] According to one embodiment of the present invention, in formula (2), the conditional function The value of includes the following two cases, when satisfying When the condition is met, the number of account operation failures of the kth privileged account in the management cycle is greater than the set account operation failure threshold. Frequent operation failures indicate that the privileged account may be illegally stolen and the security risk of the privileged account is relatively large. The value of this condition function is 1. When the condition is, the value of the condition function is the inner condition function The value of the inner condition function The value of includes the following two cases, when satisfying When the condition is true, the value of the inner condition is 1. Indicates that the IP address of the operation failure for the rth operation failure within the management cycle does not belong to the regular account login IP address. Indicates taking the minimum value of the IP address identification results of R failed operations within the management cycle. The above minimum value processing can be used to determine whether an IP address abnormality occurs when an operation fails within the management cycle. The operation failure time of the rth operation failure in the management cycle does not belong to the owner's working time. Indicates taking the minimum value of the time identification results of R operation failures within the management cycle. The above processing of taking the minimum value can be used to determine whether a time anomaly occurs when an operation fails within the management cycle. Indicates that an IP address anomaly or time anomaly occurs when an operation fails within the management cycle. The security risk of the privileged account is high. When the condition is met, it means that no IP address anomaly or time anomaly occurs when the operation fails within the management cycle. The value of this inner condition function is 0, and the security risk of the privileged account is small.

[0072] In this way, the account operation risk coefficient can be determined based on the number of account access resource failures, the number of account operation failures, the account operation frequency, the access resource failure time identification result, the access resource failure IP address identification result, the operation failure time identification result and the operation failure IP address identification result. During the calculation process, the security risk of the privileged account can be comprehensively evaluated from the operation frequency and operation failure status of the privileged account. Furthermore, when analyzing the operation failure status of the privileged account, it can be determined in the form of conditional functions whether the operation failure status under abnormal conditions occurs, thereby improving the comprehensiveness and accuracy of the account operation risk coefficient.

[0073] According to an embodiment of the present invention, in step S104, the password change information of the privileged account is obtained through the account password change platform.

[0074] For example, the account password change platform can provide automated password change and management functions to help maintain account security and prevent passwords from being leaked or cracked. In addition, the account password change platform can obtain password change information of privileged accounts (for example, password change frequency and password change time).

[0075] According to an embodiment of the present invention, in step S105, it is determined whether the privileged account password needs to be changed based on the password change information and the account risk factor.

[0076] According to one embodiment of the present invention, step S105 includes:

[0077] According to the password change information, determine the last password change time and set the password change time interval;

[0078] Determine a password change recognition result according to the last password change time and the set password change time interval;

[0079] If the password change identification result is 1, or the account risk coefficient is greater than the set risk coefficient threshold, it is determined to change the privileged account password through the account password change platform.

[0080] For example, based on the password change information, determine the last password change time and set the password change interval (for example, to enhance the security of the account, set the password to be changed every thirty days, then set the password change interval to thirty days); based on the last password change time and the set password change interval, evaluate whether the deadline for changing the password has been reached, and determine the password change recognition result; if the password change recognition result is 1, it means that the password change deadline has been reached or exceeded and the password needs to be changed; if the account risk factor is greater than the set risk factor threshold, it means that there is a security risk in the account and the password needs to be changed, and the staff is notified.

[0081] According to an embodiment of the present invention, determining the password change recognition result according to the last password change time and the set password change time interval includes:

[0082] Determine the password change time difference based on the date of the current management cycle and the last password change time;

[0083] If the password change time difference is greater than or equal to the set password change time interval, determine that the password change recognition result is 1;

[0084] If the password change time difference is less than the set password change time interval, it is determined that the password change recognition result is 0.

[0085] For example, the password change time difference is determined based on the date of the current management cycle and the time when the password was last changed (for example, if the date of the current management cycle is January 30 and the password was last changed on January 25, then the password change time difference is 5 days). If the password change time difference is greater than or equal to the set password change time interval, it means that the password change period has been exceeded and the password needs to be changed. The password change recognition result is 1. If the password change time difference is less than the set password change time interval, it means that the password change period has not been exceeded and the password does not need to be changed. The password change recognition result is 0.

[0086] According to an embodiment of the present invention, in step S106, a permission list of the privileged account is obtained through the account identification hosting platform, wherein the permission list includes: accessible systems, accessible data, accessible resources, and executable operations.

[0087] For example, in the process of managing accounts, the account identification hosting platform follows the principle of minimizing permissions to ensure that users only obtain the minimum permissions necessary to complete their work when using privileged accounts. Through the account identification hosting platform, the system, data, resources that each privileged account can access and the operations that can be performed are determined.

[0088] According to an embodiment of the present invention, in step S107, it is determined whether the privileged account permissions need to be modified based on the permission list and the owner information.

[0089] According to one embodiment of the present invention, step S107 includes:

[0090] According to the owner's work requirements, determining the work requirement access system, work requirement access data, work requirement access resources and work requirement operations;

[0091] Determining a work requirement permission set according to the work requirement access system, the work requirement access data, the work requirement access resources, and the work requirement operation;

[0092] Determining an existing permission set according to the accessible system, the accessible data, the accessible resources, and the executable operations;

[0093] If the work requirement permission set is not equal to the existing permission set, it is determined to modify the privileged account permission.

[0094] For example, the specific job responsibilities and tasks of the privileged account owner are determined through the owner's work requirements. Based on the specific job responsibilities and tasks of the privileged account owner, it is clear which systems the privileged account owner needs to access at work, which specific operations need to be performed (for example, configuring system parameters, installing software, and managing user accounts), which data need to be accessed, and the operating permissions for this data (for example, viewing, modifying, and deleting), and the work requirement permission set is determined; based on the privileged account's accessible systems, accessible data, accessible resources, and executable operations, the existing permission set is determined; if the work requirement permission set is not equal to the existing permission set, it means that the privileged account cannot meet the privileged account owner's work requirements, or when assigning permissions to the privileged account, it is not ensured that the user only obtains the minimum permissions required to complete his or her job. The permissions of the privileged account need to be modified so that the modified work requirement permission set is equal to the existing permission set.

[0095] According to the privileged account management method of the embodiment of the present invention, it is possible to ensure that all privileged account accesses and operations are logged, and to manage the identity authentication information and permission lists of all privileged accounts. Further, based on the log records and identity authentication information, the security risk status of the privileged account is accurately analyzed, and according to the security risk status and password change information of the privileged account, an automated password change function is provided for the privileged account. At the same time, based on the permission list and identity authentication information, it is possible to ensure that the account owner only obtains the minimum permissions required to complete his work, thereby improving the efficiency and effectiveness of privileged account management and enhancing the security of the privileged account. When determining the account login risk coefficient, the account login risk coefficient can be determined based on the owner's working hours, account login time, account login failure times, regular login vectors, and login vectors. During the calculation process, the security risk status of the privileged account can be comprehensively evaluated based on the login location and login IP address, login failure times, and login time, thereby improving the comprehensiveness and accuracy of the account login risk coefficient. When determining the account operation risk coefficient, the account operation risk coefficient can be determined based on the number of account access resource failures, the number of account operation failures, the account operation frequency, the resource access failure time identification result, the resource access failure IP address identification result, the operation failure time identification result and the operation failure IP address identification result. During the calculation process, the security risk of the privileged account can be comprehensively assessed from the operation frequency and operation failure status of the privileged account. Furthermore, when analyzing the operation failure status of the privileged account, it can be determined in the form of conditional functions whether the operation failure status under abnormal conditions occurs, thereby improving the comprehensiveness and accuracy of the account operation risk coefficient.

[0096] Figure 2 A block diagram of a privileged account management system according to an embodiment of the present invention is exemplarily shown, the system comprising:

[0097] An owner information module, used to obtain owner information of a privileged account through an account identification hosting platform, wherein the owner information includes: owner working hours and owner work requirements;

[0098] A log recording module, used to obtain log recording information of privileged accounts within a management period through an account identification hosting platform, wherein the log recording information includes: number of account login failures, account login time, account login IP address, account login location, account operation frequency, and account operation failure information;

[0099] An account risk module, used to determine an account risk coefficient based on the owner information and the log record information;

[0100] The password change module is used to obtain the password change information of the privileged account through the account password change platform;

[0101] A change determination module, used to determine whether the privileged account password needs to be changed according to the password change information and the account risk factor;

[0102] A permission list module is used to obtain a permission list of a privileged account through an account identification hosting platform, wherein the permission list includes: accessible systems, accessible data, accessible resources, and executable operations;

[0103] The permission modification module is used to determine whether the privileged account permissions need to be modified based on the permission list and the owner information.

[0104] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0105] It should be understood by those skilled in the art that the embodiments of the present invention described above and shown in the accompanying drawings are only examples and do not limit the present invention. The purpose of the present invention has been fully and effectively achieved. The functional and structural principles of the present invention have been demonstrated and explained in the embodiments, and the embodiments of the present invention may be deformed or modified in any way without departing from the principles.

Claims

1. A privileged account management method, characterized in that: include: Obtaining owner information of the privileged account through the account identification hosting platform, wherein the owner information includes: owner working hours and owner work requirements; Obtaining log information of privileged accounts during the management period through the account identification hosting platform, wherein the log information includes: number of account login failures, account login time, account login IP address, account login location, account operation frequency, and account operation failure information; Determining an account risk factor based on the owner information and the log record information; Obtain password change information for privileged accounts through the account password change platform; Determining whether the privileged account password needs to be changed based on the password change information and the account risk factor; Obtaining a list of permissions for a privileged account through an account identification hosting platform, wherein the list of permissions includes: accessible systems, accessible data, accessible resources, and executable operations; Determining whether it is necessary to modify privileged account permissions based on the permission list and the owner information; Determining the account risk factor according to the owner information and the log record information includes: Obtaining historical log record information of the privileged account within a historical management period, wherein the historical log record information includes: historical account login IP addresses and historical account login locations; Determine the regular account login IP address based on the historical account login IP address; Determine the regular account login location based on the historical account login location; Determining a regular login vector according to the regular account login IP address and the regular account login location; Determine a login vector according to the account login IP address and the account login location; Determining an account login risk coefficient according to the owner's working hours, the account login time, the number of account login failures, the conventional login vector and the login vector; Determine the number of failed resource access attempts and failed operations of the account based on the failed operation information; According to the operation failure information, determine the IP address where the account fails to access the resource, the time when the account fails to access the resource, the IP address where the account operation fails, and the time when the account operation fails; Determine a resource access failure time identification result according to the owner's working hours and the account's resource access failure time; Determine the identification result of the IP address that failed to access the resource according to the regular account login IP address and the IP address that failed to access the resource by the account; Determine an operation failure time identification result according to the owner's working time and the account operation failure time; Determine the operation failure IP address identification result according to the regular account login IP address and the account operation failure IP address; Determine the account operation risk coefficient according to the number of failed resource access attempts, the number of failed account operation attempts, the account operation frequency, the resource access failure time identification result, the resource access failure IP address identification result, the operation failure time identification result, and the operation failure IP address identification result; Determining an account risk coefficient according to the account login risk coefficient and the account operation risk coefficient; Determining the account operation risk coefficient according to the number of failed access resource counts of the account, the number of failed operation counts of the account, the frequency of account operation, the time identification result of failed access resource counts, the IP address identification result of failed access resource counts, the time identification result of failed operation counts, and the IP address identification result of failed operation counts, including: According to the formula ， Determine the account operation risk coefficient of the kth privileged account , where if is a conditional function, min is a minimum value function, and or is a logical operator of "or". is the account operation frequency of the kth privileged account in the management cycle, To preset the account operation frequency threshold, is the number of failed resource access attempts by the kth privileged account within the management cycle, The threshold for the number of failed resource access attempts by a preset account. The IP address identification result of the failed resource access for the jth time that the kth privileged account failed to access the resource within the management cycle. , The resource access failure time identification result of the jth failed resource access failure of the kth privileged account within the management cycle, , is the number of failed account operations of the kth privileged account within the management cycle, To set the threshold for failed account operations, The IP address identification result of the failed operation of the k-th privileged account during the management cycle. , The operation failure time identification result of the k-th privileged account in the management cycle for the r-th operation failure, , m is the number of times the privileged account fails to access resources, R is the number of times the privileged account fails to operate, j≤m, r≤R, j, m, r and R are all positive integers.

2. The privileged account management method according to claim 1, characterized in that: Determining the account login risk coefficient according to the owner's working hours, the account login time, the number of account login failures, the conventional login vector and the login vector, including: According to the formula ， Determine the account login risk factor of the kth privileged account ,in, , and is the preset weight, if is the conditional function, min is the minimum value function, is the preset similarity threshold, is the login time of the kth privileged account during the management period. The IP address of the account login for the i-th login of the k-th privileged account within the management period. is the account login location of the kth privileged account during the i-th login period, is the login vector of the kth privileged account during the management period. for The transposed vector of Working hours for the owner of the k-th privileged account, The regular account login IP address of the kth privileged account, is the regular account login location of the kth privileged account, is the regular login vector of the kth privileged account, The number of login failures of the kth privileged account within the management period, is the threshold of the number of failed login attempts for a preset account, n is the number of login attempts of the kth privileged account within the management period, i≤n, and both i and n are positive integers.

3. The privileged account management method according to claim 1, characterized in that: Determining whether the privileged account password needs to be changed according to the password change information and the account risk factor includes: According to the password change information, determine the last password change time and set the password change time interval; Determine a password change recognition result according to the last password change time and the set password change time interval; If the password change identification result is 1, or the account risk coefficient is greater than the set risk coefficient threshold, it is determined to change the privileged account password through the account password change platform.

4. The privileged account management method according to claim 3, characterized in that: Determining a password change recognition result according to the last password change time and the set password change time interval includes: Determine the password change time difference based on the date of the current management cycle and the last password change time; If the password change time difference is greater than or equal to the set password change time interval, determine that the password change recognition result is 1; If the password change time difference is less than the set password change time interval, it is determined that the password change recognition result is 0.

5. The privileged account management method according to claim 1, characterized in that: Determine whether the privileged account permissions need to be modified based on the permission list and the owner information, including: According to the owner's work requirements, determining the work requirement access system, work requirement access data, work requirement access resources and work requirement operations; Determining a work requirement permission set according to the work requirement access system, the work requirement access data, the work requirement access resources, and the work requirement operation; Determining an existing permission set according to the accessible system, the accessible data, the accessible resources, and the executable operations; If the work requirement permission set is not equal to the existing permission set, it is determined to modify the privileged account permissions.

6. A privileged account management system for executing the method according to any one of claims 1 to 5, characterized in that: include: An owner information module, used to obtain owner information of a privileged account through an account identification hosting platform, wherein the owner information includes: owner working hours and owner work requirements; A log recording module, used to obtain log recording information of privileged accounts within a management period through an account identification hosting platform, wherein the log recording information includes: number of account login failures, account login time, account login IP address, account login location, account operation frequency, and account operation failure information; An account risk module, used to determine an account risk coefficient based on the owner information and the log record information; The password change module is used to obtain the password change information of the privileged account through the account password change platform; A change determination module, used to determine whether the privileged account password needs to be changed according to the password change information and the account risk factor; A permission list module is used to obtain a permission list of a privileged account through an account identification hosting platform, wherein the permission list includes: accessible systems, accessible data, accessible resources, and executable operations; The permission modification module is used to determine whether the privileged account permissions need to be modified based on the permission list and the owner information.

Images