Authorization authentication method for asset operation and maintenance login

Abstract

The invention aims to provide an authorization authentication method for asset operation and maintenance login, an operation and maintenance platform is configured with a corresponding relationship among an operation and maintenance role, an asset and an authorization approver and a corresponding approval rule in advance, when the operation and maintenance role selects a target device needing secondary authorization, a secondary authorization application is automatically initiated, and application information is sent to the approver, so that the approval rule is automatically approved; and after approval is passed, the authorization password is returned to the applicant, and the applicant can log in authorized equipment. The authorization process is automatically realized on the operation and maintenance platform, so that the authorization efficiency can be effectively improved; moreover, the authorization password is static and dynamic, has one-time and effective duration, is high in safety, avoids infinite authorization, and can further improve the controllability of the operation and maintenance operation. The whole scheme has positive significance for quickly positioning the equipment problem of the user and improving the operation and maintenance efficiency.

Description

Technical Field

[0001] The present invention belongs to the technical field of safe operation and maintenance, and in particular relates to an authorization and authentication method for operation and maintenance asset login requiring secondary authorization. Background Art

[0002] With the in-depth application of computer information technology, the data security of large and complex systems of enterprises and institutions has become increasingly important, and the risks of operation, maintenance and management of related IT equipment have also continued to increase. Directly connecting to equipment for operation and maintenance cannot guarantee the security of the equipment. Therefore, adding a bastion host between the operation and maintenance personnel and the server equipment can effectively control the legality of the operation and maintenance operations. The security operation and maintenance management system (also known as the bastion host) is a network security device that performs operation audits on the management and maintenance of hosts, servers, network equipment, security equipment, etc.; operation and maintenance users can only see and perform authorized operations, and unauthorized operation and maintenance users cannot jump to other IT equipment.

[0003] In reality, the security operation and maintenance management system has such a situation that for operation and maintenance personnel who are not familiar with the business, or when performing more complex and high-authority operations, it is necessary to re-authorize the operation and maintenance role to determine whether it is necessary to request assistance from more familiar business or more senior technical personnel to quickly solve the problem and improve operation and maintenance efficiency. However, when obtaining authorization applications through telephone communication, especially when performing low-level professional operations on target devices, it is difficult to clearly describe the reasons for the application, resulting in an inability to quickly determine whether to authorize the applicant or transfer it to a high-level role for operation and maintenance, resulting in low efficiency. Summary of the invention

[0004] In view of the above background, the present invention aims to provide an authorization and authentication method for asset operation and maintenance login, to achieve secondary authorization and authentication of specific assets, so as to improve the controllability of operation and maintenance operations.

[0005] An authorization and authentication method for asset operation and maintenance login, comprising: initiating an asset login application according to the login approval rules of roles and / or assets, returning an authorization password according to preset password rules, the applicant initiating authorization within a preset validity period, authenticating the authorization application, and successfully logging into the asset if the authentication passes.

[0006] The authorization authentication method includes secondary authentication, where the operation and maintenance role first logs in to the operation and maintenance platform to initiate an asset login application, and the asset login application includes initiating an authorization application to a preset approver.

[0007] Preferably, the login approval rules include role rules or asset rules, wherein the asset rules include configuring different approval rules according to the importance of assets or services, and the asset rules also include the authorized approver corresponding to the login application; After the operation and maintenance role logs in to the operation and maintenance platform, he selects the target asset to be logged in to initiate a login application, and automatically calls the preset authorizer of the asset rule item to send the login application information.

[0008] Preferably, the above-mentioned role login approval rules are enabled through the login policy of the preset operation and maintenance role; the login approval rules include the rule name, whether to enable, the approval method and the authorized approver.

[0009] The above authorization password includes a static password in front and a dynamic password in the back, and the dynamic password is one-time and has a validity period.

[0010] When the authorization is returned as above, the contact information of the authorizer is also returned, including the user name, real name and phone number on the operation and maintenance platform.

[0011] Preferably, the authorization and authentication process of the method includes: The administrator configures the operation and maintenance roles, the corresponding operation and maintenance assets that require secondary authorization, and the corresponding authorized approvers on the operation and maintenance platform; The operation and maintenance user uses an existing account to log in to the operation and maintenance platform; Select the asset that needs secondary authorization and the corresponding approver to be logged in, and initiate the authorization application; The approver approves or rejects the authorization. If the authorization is approved, the applicant is provided with the authorization password. Otherwise, a rejection message is returned. The applicant uses the authorization password to log in to the corresponding asset and start operation and maintenance operations.

[0012] The above authorization password has a preset validity period. When the operation and maintenance platform detects that the validity period has been exceeded, it will prompt the applicant and disconnect the applicant from the asset after the prompt period has passed.

[0013] The embodiment of the present invention using the above technical solution has at least the following beneficial effects: the operation and maintenance platform pre-configures the correspondence between operation and maintenance roles, assets and authorized approvers, as well as the corresponding approval rules. When the operation and maintenance role selects a target device that requires secondary authorization, it automatically initiates a secondary authorization application and sends the application information to the approver. After approval, the authorization password is returned to the applicant, and the applicant can log in to the authorized device. This authorization process is automatically implemented on the operation and maintenance platform, which can effectively improve the authorization efficiency; and the authorization password is static and dynamic, and has both one-time and valid duration, high security, and avoids unlimited authorization, which can further improve the controllability of operation and maintenance operations. The entire solution has positive significance for quickly locating user equipment problems and improving operation and maintenance efficiency. Implementation

[0014] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with embodiments.

[0015] First, the technical terms involved in the embodiments are briefly explained.

[0016] The security operation and maintenance management system (also known as the bastion host system, for ease of description, hereinafter referred to as the operation and maintenance platform) conducts safe, effective and intuitive operation audits on the management and maintenance of hosts, servers, network equipment, security equipment, etc., and keeps detailed records of policy configuration, system maintenance, internal access, etc., to provide audit means for organizations in terms of IT operation risk control, internal control security and compliance. Before operation and maintenance, log in to the security operation and maintenance management platform in a unified manner, and then log in to various servers from the platform. All operations and maintenance are actually remote logins to the server, and all operations and data are stored on the server.

[0017] The operation and maintenance platform provides authorization functions based on the combination of operation and maintenance users, operation and maintenance protocols, target hosts, operation and maintenance time periods, operation and maintenance session durations, and operation and maintenance client IPs. The administrator matches the operation and maintenance users with asset authorizations to limit the permissions of different users; and configures the user name and password to the operation and maintenance platform. For ease of management, the corresponding user name id and password id can also be configured separately. After the operation and maintenance user passes the authentication and authorization of the operation and maintenance platform, he can automatically log in with the corresponding user name and password to perform operation and maintenance.

[0018] When the operation and maintenance personnel log in to the user system of the operation and maintenance platform, they can view all the operation and maintenance assets that the current user role has the right to operate and maintain. The content of the operation and maintenance assets includes the device name, device IP, operation and maintenance rules, access protocol, and available operations. When the access protocol of the operation and maintenance assets is SSH, the target device to be operated and maintained can be connected through the embedded connection tool. After the connection is successful, you can log in to the device on the interface of the connection tool and start operation and maintenance.

[0019] First, an embodiment of an authorization and authentication method for asset operation and maintenance login includes: initiating an asset login application according to the login approval rules of the role and / or asset, returning the authorization password according to the preset password rules, the applicant initiating authorization within the preset validity period, authenticating the authorization application, and successfully logging into the asset if the authentication passes.

[0020] The authorization authentication method includes secondary authentication, where the operation and maintenance role first logs in to the operation and maintenance platform to initiate an asset login application, and the asset login application includes initiating an authorization application to a preset approver.

[0021] Preferably, the login approval rules include role rules or asset rules, wherein the asset rules include configuring different approval rules according to the importance of assets or services, and the asset rules also include the authorized approver corresponding to the login application; After the operation and maintenance role logs in to the operation and maintenance platform, he selects the target asset to be logged in to initiate a login application, and automatically calls the preset authorizer of the asset rule item to send the login application information.

[0022] Preferably, the above-mentioned role login approval rules are enabled through the login policy of the preset operation and maintenance role; the login approval rules include the rule name, whether to enable, the approval method and the authorized approver.

[0023] The above authorization password includes a static password in front and a dynamic password in the back, and the dynamic password is one-time and has a validity period.

[0024] When the authorization is returned as above, the contact information of the authorizer is also returned, including the user name, real name and phone number on the operation and maintenance platform.

[0025] Preferably, the authorization and authentication process of the method includes: The administrator configures the operation and maintenance roles, the corresponding operation and maintenance assets that require secondary authorization, and the corresponding authorized approvers on the operation and maintenance platform; The operation and maintenance user uses an existing account to log in to the operation and maintenance platform; Select the asset that needs secondary authorization and the corresponding approver to be logged in, and initiate an authorization application. As a better implementation method, you can fill in a sufficiently detailed reason when applying for authorization; The approver approves or rejects the authorization. If the authorization is approved, the applicant is provided with the authorization password. Otherwise, a rejection message is returned. The applicant uses the authorization password to log in to the corresponding asset and start operation and maintenance operations.

[0026] The above authorization password has a preset validity period. When the operation and maintenance platform detects that the validity period has been exceeded, it will prompt the applicant and disconnect the applicant from the asset after the prompt period has passed.

[0027] In the embodiment of the present invention using the above technical solution, the operation and maintenance platform pre-configures the corresponding relationship between operation and maintenance roles, assets and authorized approvers, as well as the corresponding approval rules. When the operation and maintenance role selects the target device that requires secondary authorization, it automatically initiates a secondary authorization application and sends the application information to the approver. After approval, the authorization password is returned to the applicant, and the applicant can log in to the authorized device. This authorization process is automatically implemented on the operation and maintenance platform, which can effectively improve the authorization efficiency; and the authorization password is static and dynamic, and has both one-time and valid duration, high security, and avoids unlimited authorization, which can further improve the controllability of operation and maintenance operations. The entire solution has positive significance for quickly locating user equipment problems and improving operation and maintenance efficiency.

[0028] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.

[0029] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.

Claims

1. An authorization and authentication method for asset operation and maintenance login, characterized in that: include: According to the login approval rules of roles and / or assets, an asset login application is initiated, and the authorization password is returned according to the preset password rules. The applicant initiates authorization within the preset validity period and authenticates the authorization application. If the authentication is passed, the asset is successfully logged in.

2. The authorization authentication method according to claim 1, characterized in that: The authorization authentication method includes secondary authentication, where the operation and maintenance role first logs in to the operation and maintenance platform to initiate an asset login application, and the asset login application includes initiating an authorization application to a preset approver.

3. The authorization authentication method according to claim 2, characterized in that: The login approval rules include role rules or asset rules, wherein the asset rules include configuring different approval rules according to the importance of assets or services, and the asset rules also include the authorized approver corresponding to the login application; After the operation and maintenance role logs in to the operation and maintenance platform, he selects the target asset to be logged in to initiate a login application, and automatically calls the preset authorizer of the asset rule item to send the login application information.

4. The authorization authentication method according to claim 3, characterized in that: The role login approval rule is enabled through the login policy of the preset operation and maintenance role; the login approval rule includes the rule name, whether it is enabled, the approval method and the authorized approver.

5. The authorization authentication method according to claim 1, characterized in that: The authorization password includes a static password in front and a dynamic password in the back, and the dynamic password is one-time and has a validity period.

6. The authorization authentication method according to claim 1, characterized in that: When the authorization is returned, the contact information of the authorizer is also returned, including the user name, real name and phone number on the operation and maintenance platform.

7. The authorization and authentication method according to any one of claims 1 to 6, characterized in that: The authorization and authentication process of this method includes: The administrator configures the operation and maintenance roles, the corresponding operation and maintenance assets that require secondary authorization, and the corresponding authorized approvers on the operation and maintenance platform; The operation and maintenance user uses an existing account to log in to the operation and maintenance platform; Select the asset that needs secondary authorization and the corresponding approver to be logged in, and initiate the authorization application; The approver approves or rejects the authorization. If the authorization is approved, the applicant is provided with the authorization password. Otherwise, a rejection message is returned. The applicant uses the authorization password to log in to the corresponding asset and start operation and maintenance operations.

8. The authorization authentication method according to claim 7, characterized in that: The authorization password has a preset validity period. When the operation and maintenance platform detects that the validity period has been exceeded, it will prompt the applicant and disconnect the applicant from the asset after the prompt period has passed.