Equipment authority management method and device, medium, electronic equipment and program product

Abstract

The invention relates to an equipment authority management method and device, a medium, electronic equipment and a program product, belongs to the field of equipment authority management, can meet equipment authority management requirements in various equipment use environments, and has universality and very high flexibility. The equipment authority management method comprises the steps that a target authority management strategy for target equipment is acquired from authority management strategies pre-configured by a server side, and the target equipment belongs to equipment subjected to authority management by the server side; the pre-configured authority management strategy is an authority management strategy pre-configured by the server for each device subjected to authority management; and according to the target authority management strategy, performing authority management on the administrator authority on the target equipment, and creating a customized token with the administrator authority to perform authority improvement of the target equipment.

Description

Technical Field

[0001] The present disclosure relates to the field of device authority management, and in particular, to a device authority management method, apparatus, medium, electronic device and program product. Background Art

[0002] In today's digital age, device management has become the key to achieving efficient operations and ensuring security. In related technologies, large-scale enterprises may have tens of thousands or even hundreds of thousands of office devices. These enterprises generally use Microsoft's local domain (Active Directory, AD) or cloud domain (Azure Active Directory, AzureAD) to manage devices, that is, adding office devices to the local domain / cloud domain, unifying the device operating environment through the local domain / cloud domain group policy, and implementing permission management through the permission management of local domain / cloud domain accounts.

[0003] However, the above device permission management methods are not universal enough. That is, the local domain group policy is only applicable to permission management in the local domain scenario, and the cloud domain group policy is only applicable to permission management in the cloud domain scenario. They are not universally applicable to device permission management in local account scenarios, local domain scenarios, and cloud domain scenarios. Summary of the invention

[0004] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, the present disclosure provides a device permission management method, comprising: obtaining a target permission management policy for a target device from a permission management policy pre-configured by a server, wherein the target device belongs to a device for which permission management is performed by the server, and the pre-configured permission management policy is a permission management policy pre-configured by the server for each device for which permission management is performed; performing permission management on the administrator permission on the target device according to the target permission management policy, and creating a customized token with administrator permission to elevate the permission of the target device.

[0006] In a second aspect, the present disclosure provides a device permission management apparatus, comprising: an acquisition module, used to acquire a target permission management policy for a target device from a permission management policy pre-configured by a server, wherein the target device belongs to a device for which permission management is performed by the server, and the pre-configured permission management policy is a permission management policy pre-configured by the server for each device for which permission management is performed; a management module, used to perform permission management on the administrator permission on the target device according to the target permission management policy, and to create a customized token with administrator permission to elevate the permission of the target device.

[0007] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which implements the steps of any one of the methods described in the first aspect when the computer program is executed by a processing device.

[0008] In a fourth aspect, the present disclosure provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of any one of the methods in the first aspect.

[0009] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0010] By adopting the above technical solution, the target permission management policy for the target device is obtained from the pre-configured permission management policy on the server, and then according to the target permission management policy, the administrator permissions on the target device are managed and a customized token with administrator permissions is created to enhance the permissions of the target device. This permission management method is limited by the target permission management policy on the server, but not limited to the device account system. Therefore, it can widely support possible device account systems, including local accounts, local domain accounts, cloud domain accounts, etc., so as to meet the device permission management needs in various device usage environments, have universality and strong flexibility, and can meet the user's personalized device permission management needs. In addition, by performing permission management on the target device in the cloud, the privileges of the local administrator of the target device can be revoked and the permission management of the target device can be performed locally on the target device according to the target permission management policy, which can reduce the risk of the target device operating environment being damaged, greatly reduce the attack surface, resist attacks, and flexibly meet the permission demands in specific scenarios. From the perspective of enterprise operations, it can also unify the device operating environment and improve enterprise operation efficiency.

[0011] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 The present invention is a flowchart of a device authority management method according to an embodiment of the present invention.

[0013] Figure 2 It is a schematic diagram of a self-service rights application window according to an embodiment of the present disclosure.

[0014] Figure 3 It is a schematic diagram of a self-service privilege escalation rejection window according to an embodiment of the present disclosure.

[0015] Figure 4 It is a schematic block diagram of a device authority management apparatus according to an embodiment of the present disclosure.

[0016] Figure 5 It is a schematic diagram of a device permission management architecture according to an embodiment of the present disclosure.

[0017] Figure 6 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0019] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0020] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0021] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0022] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0023] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0024] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0025] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0026] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0027] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0028] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0029] Figure 1 1 is a flow chart of a device permission management method according to an embodiment of the present disclosure. The device permission management method can be generally applied to device permission management in various scenarios such as local account scenarios, local domain scenarios, and cloud domain scenarios. Figure 1As shown, the device authority management method may include the following steps S11 and S12.

[0030] In step S11, a target permission management policy for a target device is obtained from the permission management policies pre-configured by the server, wherein the target device is a device for which permission management is performed by the server, and the pre-configured permission management policy is a permission management policy pre-configured by the server for each device for which permission management is performed.

[0031] The server can be located in the cloud. The server can manage all or part of the devices of an enterprise in a unified manner, for example, manage various permissions on the devices in a unified manner. For various permissions on each device, the server can pre-configure corresponding permission management policies so that the permission management policies can be used to manage permissions on the device.

[0032] The target permission management policy may include at least one of the following: administrator permission recovery rules, default permission escalation rules, self-service permission escalation rules, etc. "Personality escalation" in the present disclosure refers to permission escalation, that is, escalation to administrator permissions.

[0033] Administrator privilege recovery rules can be used to indicate whether administrator privilege recovery is enabled and the administrator whitelist when administrator privilege recovery is enabled. The administrator whitelist can be used to indicate accounts with administrator privileges, that is, accounts on the target device that are in the administrator whitelist can have administrator privileges, while accounts that are not in the administrator whitelist cannot have administrator privileges.

[0034] The default privilege escalation rule can be used to indicate that when the program specified in the default privilege escalation rule is started, the process running the program specified in the default privilege escalation rule will be elevated to administrator privileges by default. The default privilege escalation rule can manage privileges from any dimension related to the device, for example, the dimension of program file attributes, the dimension of time window, the dimension of device account, etc. The dimension of program file attributes may include at least one of the following: program name, program path, directory where the program is located, program process, program signature, etc. The dimension of time window may include, for example, the time period in which default privilege management is performed. The account dimension of the device may include, for example, under which device accounts default privilege management is performed, etc. For example, the default privilege escalation rule can indicate in which time periods, for which programs, and for which accounts of the target device, the permissions of the process running the program specified in the default privilege escalation rule will be elevated to administrator permissions by default. For example, in time period 1, for program 1 under path 1, the permissions of the process running program 1 will be elevated to administrator permissions by default. In time period 2, for program 2 of publisher 2, the permissions of the process running program 2 will be elevated to administrator permissions by default. In time period 3, for program 3 with a hash value of hash value 3, the permissions of the process running program 3 will be elevated to administrator permissions by default, and so on.

[0035] Self-service privilege escalation rules can be used to indicate whether self-service privilege escalation is enabled and the rules for self-service privilege escalation of the process running the program to administrator privileges when self-service privilege escalation is enabled. The difference between self-service privilege escalation rules and default privilege escalation rules is that self-service privilege escalation can be applied for when running any program and interaction is required, for example, entering a reason for self-service privilege escalation, while default privilege escalation rules do not require any interaction, but default privilege escalation can only be performed for the program specified in the default privilege escalation rule. Self-service privilege escalation rules can manage permissions from any dimension related to the device, such as the dimension of the time window, the dimension of the device account, and so on. The dimension of the time window may include, for example, the time period during which self-service privilege management is performed. The account dimension of the device may include, for example, under which device accounts self-service privilege management is performed, etc. For example, a self-service privilege escalation rule may indicate the time period during which a self-service application can be made to elevate the permissions of the process running the program to administrator privileges.

[0036] In the present disclosure, the account of the device may include a local account, a local domain account, a cloud domain account, and the like.

[0037] In step S12, according to the target permission management policy, the administrator's permission on the target device is managed, and a customized token with administrator's permission is created to elevate the permission of the target device. For example, it can be determined whether the permission of the process running the application on the target device needs to be elevated to the administrator's permission according to various rules included in the target permission management policy, and if necessary, the permission of the corresponding process is elevated.

[0038] By adopting the above technical solution, the target permission management policy for the target device is obtained from the pre-configured permission management policy on the server side, and then according to the target permission management policy, the administrator permissions on the target device are managed and a customized token with administrator permissions is created to enhance the permissions of the target device. This permission management method is limited by the target permission management policy on the server side, but not limited to the device account system. Therefore, it can provide extensive support for possible device account systems, including local accounts, local domain accounts, cloud domain accounts, etc., so as to meet the device permission management requirements in various device usage environments and have universal applicability. In addition, since the permission rules in the target permission management policy can achieve more fine-grained permission management, such as specific time periods, specific programs, specific directories, specific processes, specific signatures and other dimensions, it has strong flexibility and can meet the user's personalized device permission management needs. In addition, by managing the permissions of the target device in the cloud, it is possible to revoke the privileges of the local administrator of the target device and manage the permissions of the target device locally according to the target permission management policy. This can not only reduce the risk of the target device's operating environment being damaged, significantly reduce the attack surface, and resist attacks, but also flexibly meet the permission requirements in specific scenarios. From the perspective of enterprise operations, it can also unify the device operating environment and improve enterprise operating efficiency.

[0039] In some embodiments, the permission management of administrator permissions on the target device in step S12 may include: matching the administrator whitelist in the target permission management policy with the permissions of each account of the target device, wherein the administrator whitelist is used to indicate the accounts with administrator permissions on the target device; based on the matching results, reclaiming the administrator permissions of accounts that are not in the administrator whitelist but currently have administrator permissions, and granting administrator permissions to accounts that are in the administrator whitelist but have had their administrator permissions revoked previously.

[0040] For example, it is possible to periodically check whether the permissions of all accounts (eg, local accounts, local domain accounts, cloud domain accounts, etc.) of the target device match the administrator whitelist in the target permission management policy.

[0041] For example, you can periodically check the accounts in the user group (Users) of local accounts, local domain accounts, and cloud domain accounts based on the administrator whitelist. If there is an account in the user group that is in the administrator whitelist but is currently recorded in the reclaimed list, it means that the account originally had administrator privileges but the administrator privileges were previously reclaimed. In this case, restore the administrator privileges of the account, for example, add or transfer the account to the administrator group. The reclaimed list is a list used to record accounts whose administrator privileges have been reclaimed.

[0042] For another example, the accounts in the administrator group (Administrators) in the local account, local domain account, and cloud domain account can be periodically checked based on the administrator whitelist. If there is an account in the administrator group that is in the administrator whitelist and currently has administrator privileges, the administrator privileges of the account will continue to be maintained. If there is an account in the administrator group that is not in the administrator whitelist but currently has administrator privileges, the administrator privileges of the account will be revoked. For example, the account can be transferred to the user group and recorded in the reclaimed list.

[0043] By adopting the above technical solution, it is possible to provide extensive support for possible device account systems, including local accounts, local domain accounts, cloud domain accounts, etc., and can flexibly manage the local administrator permissions of the target device. Therefore, it can meet the device permission management needs in various device usage environments. It is not only universal, but also can meet the personalized needs of users.

[0044] In some embodiments, creating a custom token with administrator privileges to elevate privileges of the target device in step S12 may include: intercepting the startup process of the target program on the target device; matching the program information of the target program with the default privilege escalation rule in the target privilege management policy, wherein the default privilege escalation rule is used to indicate that when the program specified in the default privilege escalation rule is started, the privileges of the process running the program specified in the default privilege escalation rule are elevated to administrator privileges by default; if the program information of the target program matches the default privilege escalation rule in the target privilege management policy, creating a custom token with administrator privileges based on the token of the current account of the target device, and starting the target program through the custom token.

[0045] The target program may be any program on the target device, for example, any program that a user wants to run.

[0046] For example, the startup process of the target program on the target device can be intercepted by injecting the target permission management policy into the host process responsible for starting the target program and hooking the application program interface used to create an instance of the target program. Injecting the target permission management policy into the host process can be achieved by dynamic link library (DLL) injection. Hooking the application program interface used to create an instance of the target program can be achieved by application programming interface (API) hook.

[0047] For example, the step of matching the program information of the target program with the default privilege escalation rule in the target permission management policy can be performed before the startup process of the target program enters the User Account Control (UAC) pop-up window, so that the default privilege escalation is completed before the UAC pop-up window, ensuring the smooth operation of the target program that requires administrator privileges to run. The main function of the UAC pop-up window is to pop up a prompt box when a user or program tries to perform a task that requires administrator privileges, requiring the currently logged-in user with administrator privileges to confirm or the currently logged-in user without administrator privileges to provide administrator credentials.

[0048] For example, the operation of intercepting the startup process of the target program on the target device and matching the program information of the target program with the default privilege escalation rule in the target permission management policy can be performed through Endpoint Privilege Management (EPM). The operation of creating a custom token with administrator privileges based on the token of the current account of the target device and starting the target program through the custom token can be performed through a dedicated privilege escalation process. EPM can send a privilege escalation request for the target program to the privilege escalation process through a local remote procedure call (RPC), and the privilege escalation request can include the program information of the target program.

[0049] In addition, the default privilege escalation rules have been described in detail in the previous article and will not be repeated here.

[0050] By adopting the above technical solution, it is possible to achieve default privilege escalation under any device account system on the target device, thereby meeting the device permission management requirements in various device usage environments and having universal applicability, for example, applicable to local account systems, local domain account systems, cloud domain account systems, etc. In addition, since the default privilege escalation rules can achieve more fine-grained permission management, such as specific time periods, specific programs, specific directories, specific processes, specific signatures and other dimensions, it has strong flexibility and can meet the user's personalized permission management needs. In addition, by performing permission management on the target device in the cloud, the privileges of the local administrator of the target device can be revoked and the permission management of the target device can be performed locally on the target device according to the default privilege escalation rules, which can not only reduce the risk of the target device's operating environment being destroyed, greatly reduce the attack surface, resist attacks, but also flexibly meet the permission requirements in specific scenarios, and from the perspective of enterprise operations, it can also unify the device operating environment and improve enterprise operation efficiency.

[0051] In some embodiments, creating a custom token with administrator privileges to elevate privileges of a target device in step S12 may include: generating a self-service privilege escalation entry on the target device according to a self-service privilege escalation enabling instruction in a target privilege management policy, wherein the self-service privilege escalation enabling instruction is used to instruct generation of a self-service privilege escalation entry on the target device; in response to a privilege escalation request for a target program through the self-service privilege escalation entry, matching the privilege escalation request with a self-service privilege escalation rule in the target privilege management policy, wherein the self-service privilege escalation rule is used to instruct self-service elevation of privileges of a process running the target program to administrator privileges based on the privilege escalation request; if the privilege escalation request matches the self-service privilege escalation rule, creating a custom token with administrator privileges based on a token of a current account of the target device, and starting the target program through the custom token.

[0052] For example, the self-service privilege escalation entry can be generated in the right-click menu on the target device by modifying the registry, or by modifying the registry and the desktop right-click menu extension technology based on the modern user interface (UI) style implemented by Microsoft Universal Windows Platform (UWP) technology. In this way, the user can easily find the self-service privilege escalation entry through the right-click menu.

[0053] The operation of matching the privilege escalation request with the self-service privilege escalation rule in the target privilege management policy can be performed through the pop-up program. The operation of creating a custom token with administrator privileges based on the token of the current account of the target device and launching the target program through the custom token can be performed through the privilege escalation process described above. The pop-up program and the privilege escalation process can communicate through local RPC.

[0054] When a user runs a target program that requires administrator privileges to run, in order to achieve self-service privilege escalation, the user can right-click the icon of the target program on the target device, and a right-click menu window will pop up. Then, click the menu item of the self-service privilege escalation entrance displayed in the right-click menu. If the self-service privilege escalation rules are currently met, for example, the self-service privilege escalation rules configure the time period during which self-service privilege escalation is allowed, and whether the reason for the self-service privilege escalation application needs to be filled in, and the current time is within the time period specified by the self-service privilege escalation rules that allow self-service privilege escalation, the self-service privilege escalation application window will pop up (such as Figure 2), the self-service privilege escalation application window can display the program information of the program that requires administrator privileges to run, and the user can confirm whether the program information is consistent with the program information of the target program that the user wants to run. If it is consistent, the user can confirm the application for self-service privilege escalation, and the self-service privilege escalation request will be sent to the privilege escalation process. The self-service privilege escalation request can carry the program information of the target program; in addition, the self-service privilege escalation application window can also display the privilege escalation reason option, requiring the user to fill in the privilege escalation reason. If the self-service privilege escalation rules are not met at present, for example, the self-service privilege escalation rules are configured within which time period self-service privilege escalation is allowed, and the current time is not within the time period allowed by the self-service privilege escalation rules, a self-service privilege escalation rejection window may pop up (such as Figure 3 to deny the user's request for self-service privilege escalation.

[0055] In addition, the self-service privilege escalation rules have been described in detail in the previous article and will not be repeated here.

[0056] By adopting the above technical solution, it is possible to realize self-service privilege escalation under any device account system on the target device, so as to meet the device permission management requirements in various device usage environments, and it has universal applicability, for example, it is applicable to local account system, local domain account system, cloud domain account system, etc. In addition, since the self-service privilege escalation rules can realize more fine-grained permission management, such as specific time period, specific program, specific directory, specific process, specific signature and other dimensions, it has strong flexibility and can meet the personalized permission management needs of users. In addition, by performing permission management on the target device in the cloud, the privileges of the local administrator of the target device can be revoked and the permission management of the target device can be performed locally on the target device according to the self-service privilege escalation rules, which can not only reduce the risk of the target device operating environment being damaged, greatly reduce the attack surface, resist attacks, but also flexibly meet the permission requirements in specific scenarios, and from the perspective of enterprise operations, it can also unify the device operating environment and improve enterprise operation efficiency.

[0057] In some embodiments, the device rights management method according to the embodiments of the present disclosure may further include: sending a rights management log to the server. For example, after the default rights escalation, after the self-service rights escalation, etc., the rights management log is sent to the server. The rights management log can be used for auditing by cloud administrators.

[0058] The permission management log may include various permission management related information that the cloud administrator wants to know, such as information about the permission escalation method, information about the program targeted by the permission escalation, information about the device applying for permission escalation, etc. For example, the permission management log may include the device identification of the permission-managed device, the platform used by the permission-managed device (such as the Windows platform, etc.), the login account of the permission-managed device when the permission management log is generated, the permission escalation method of the permission-managed device (such as the default permission escalation method, the self-service permission escalation method, etc.), information about the permission-managed object on the permission-managed device (such as the program targeted by the permission escalation and its related information, such as the path, publisher, hash value, etc. of the program), the permission-managed time of the permission-managed device, etc.

[0059] By adopting the above technical solution, the permission management log can realize the association between the permission escalation method, the program targeted by the permission escalation and the device applying for the permission escalation, which is convenient for cloud administrators to perform risk identification and content audit.

[0060] Figure 4 1 is a schematic block diagram of a device rights management apparatus according to an embodiment of the present disclosure. The device rights management apparatus can be generally applied to device rights management in various scenarios such as local account scenarios, local domain scenarios, and cloud domain scenarios. Figure 4 As shown, the device permission management device 40 may include: an acquisition module 41, used to obtain a target permission management policy for a target device from a permission management policy pre-configured by a server, wherein the target device is a device that is permission managed by the server, and the pre-configured permission management policy is a permission management policy pre-configured by the server for each device that is permission managed; a management module 42, used to manage the administrator permissions on the target device according to the target permission management policy, and to create a customized token with administrator permissions to elevate the permissions of the target device.

[0061] By adopting the above technical solution, the target permission management policy for the target device is obtained from the pre-configured permission management policy on the server side, and then according to the target permission management policy, the administrator permissions on the target device are managed and a customized token with administrator permissions is created to enhance the permissions of the target device. This permission management method is limited by the target permission management policy on the server side, but not limited to the device account system. Therefore, it can provide extensive support for possible device account systems, including local accounts, local domain accounts, cloud domain accounts, etc., so as to meet the device permission management requirements in various device usage environments and have universal applicability. In addition, since the permission rules in the target permission management policy can achieve more fine-grained permission management, such as specific time periods, specific programs, specific directories, specific processes, specific signatures and other dimensions, it has strong flexibility and can meet the user's personalized permission management needs. In addition, by managing the permissions of the target device in the cloud, it is possible to revoke the privileges of the local administrator of the target device and manage the permissions of the target device locally according to the target permission management policy. This can not only reduce the risk of the target device's operating environment being damaged, significantly reduce the attack surface, and resist attacks, but also flexibly meet the permission requirements in specific scenarios. From the perspective of enterprise operations, it can also unify the device operating environment and improve enterprise operating efficiency.

[0062] Optionally, the management module 42 performs authority management on the administrator authority on the target device, including: Matching the administrator whitelist in the target permission management policy with the permissions of each account on the target device, wherein the administrator whitelist is used to indicate the accounts with administrator permissions on the target device; Based on the matching results, the administrator rights of accounts that are not in the administrator whitelist but currently have administrator rights will be revoked, and accounts that are in the administrator whitelist but have had their administrator rights revoked before will be granted administrator rights.

[0063] Optionally, the management module 42 creates a custom token with administrator privileges to elevate privileges of the target device, including: Intercept the startup process of the target program on the target device; Matching the program information of the target program with the default privilege escalation rule in the target privilege management policy, wherein the default privilege escalation rule is used to indicate that when the program specified in the default privilege escalation rule is started, the privilege of the process running the program specified in the default privilege escalation rule is elevated to the administrator privilege by default; If the program information of the target program matches the default privilege escalation rule in the target permission management policy, a custom token with administrator privileges is created based on the token of the current account of the target device, and the target program is started through the custom token.

[0064] Optionally, the management module 42 intercepts the startup process of the target program on the target device, including: The startup process of the target program on the target device is intercepted by injecting a target permission management policy into the host process responsible for starting the target program and hooking the application program interface used to create an instance of the target program.

[0065] Optionally, the management module 42 creates a custom token with administrator privileges to elevate privileges of the target device, including: Generate a self-service privilege escalation entry on the target device according to the self-service privilege escalation enabling instruction in the target privilege management policy, wherein the self-service privilege escalation enabling instruction is used to instruct the generation of a self-service privilege escalation entry on the target device; In response to a privilege escalation request for a target program through a self-service privilege escalation portal, matching the privilege escalation request with a self-service privilege escalation rule in a target privilege management policy, wherein the self-service privilege escalation rule is used to instruct to self-servicely elevate the privilege of a process running the target program to an administrator privilege based on the privilege escalation request; If the privilege escalation request matches the self-service privilege escalation rule, a custom token with administrator privileges is created based on the token of the current account of the target device, and the target program is started through the custom token.

[0066] Optionally, the management module 42 generates a self-service privilege escalation entry on the target device, including: By modifying the registry, the self-service privilege escalation entry is generated in the right-click menu on the target device.

[0067] Optionally, the device authority management apparatus 40 further includes a sending module (not shown) configured to: Sending a rights management log to the server, wherein the rights management log includes at least one of information about a rights escalation method, information about a program targeted by the rights escalation, and information about a device applying for the rights escalation.

[0068] The specific implementation of the operations performed by each module in the device authority management apparatus according to the embodiment of the present disclosure has been described in detail in the relevant method and will not be repeated here.

[0069] The present disclosure also provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processing device, the steps of any method in the present disclosure are implemented.

[0070] The present disclosure also provides an electronic device, comprising: a storage device having a computer program stored thereon; A processing device is used to execute a computer program in a storage device to implement the steps of any method in the present disclosure.

[0071] The present disclosure also provides a computer program product, comprising a computer program, which implements the steps of any method in the present disclosure when executed by a processor.

[0072] Figure 5 It is a schematic diagram of a device permission management architecture according to an embodiment of the present disclosure.

[0073] like Figure 5 As shown, the server 50 is located in the cloud and is used to uniformly manage all or part of the devices of an enterprise, for example, to uniformly manage the rights of the devices. For each device, the server 50 can pre-configure a corresponding rights management policy so that the rights management policy can be used to manage the rights of the device.

[0074] The target device 51 is one of the devices uniformly managed by the server 50. The server 50 sends the target permission management policy for the target device 51 to the EPM 511 of the target device 51, thereby implementing the distribution and update of the pre-configured permission management policy.

[0075] EPM 511 injects the target permission management policy into the host process responsible for starting the target program in the resource manager 512 and application information service process 513 of the target device 51, and hooks the start of the target program, for example, by hooking the application program interface used to create an instance of the target program, to intercept the start-up process of the target program. Before the UAC pop-up window appears, EPM511 matches the program information of the target program with the default privilege escalation rule in the target permission management policy. If the two match, EPM 511 sends the program information of the target program to the privilege escalation process 516 on the target device 51 through local RPC. The privilege escalation process 516 can create a custom token with administrator privileges based on the token of the current account of the target device 51 and start the target program through the custom token, thereby realizing the privilege escalation of the host process running the target program. The privilege escalation process 516 can also generate a privilege management log and send the privilege management log to the server 50 for the convenience of the cloud administrator to audit. In this way, the default privilege escalation operation on the target device 51 is realized.

[0076] EPM 511 can also control the generation of a self-service privilege escalation entry in the right-click menu 514 on the target device 51 according to the self-service privilege escalation enablement indication in the target privilege management policy, by modifying the registry or by modifying the registry and the desktop right-click menu extension technology of the modern UI style based on Microsoft UWP technology. When a user applies for self-service privilege escalation for a target program, the pop-up program in the self-service privilege escalation pop-up module 515 will match the user's privilege escalation request with the self-service privilege escalation rule in the target privilege management policy. If the two match, the pop-up program sends the program information of the target program to the privilege escalation process 516 through the local RPC. The privilege escalation process 516 can create a custom token with administrator privileges based on the token of the current account of the target device 51 and start the target program through the custom token, thereby realizing the privilege escalation of the host process running the target program on the target device. The privilege escalation process 516 can also generate a privilege management log and send the privilege management log to the server 50 for the convenience of the cloud administrator to audit. In this way, the self-service privilege escalation operation on the target device 51 is realized.

[0077] In addition, the privilege escalation process 516 can inherit the token creation capability from the local security authority on the target device 51 , so that the privilege escalation process 516 can create a customized token with administrator privileges based on the token of the current account of the target device 51 .

[0078] By adopting the above technical solution, the target permission management policy for the target device is obtained from the permission management policy pre-configured on the server, and then the permission management of the target device is performed according to the target permission management policy. This permission management method is limited by the target permission management policy on the server, but not limited to the device account system. Therefore, it can widely support possible device account systems, including local accounts, local domain accounts, cloud domain accounts, etc., so as to meet the device permission management needs in various device usage environments and have universal applicability. In addition, since the permission rules in the target permission management policy can achieve more fine-grained permission management, such as specific time periods, specific programs, specific directories, specific processes, specific signatures and other dimensions, it has strong flexibility and can meet the personalized permission management needs of users. In addition, by performing permission management on the target device in the cloud, the privileges of the local administrator of the target device can be revoked and the permission management of the target device can be performed locally on the target device according to the target permission management policy, which can reduce the risk of the target device operating environment being damaged, greatly reduce the attack surface, resist attacks, and flexibly meet the permission demands in specific scenarios. From the perspective of enterprise operations, it can also unify the device operating environment and improve enterprise operation efficiency.

[0079] Reference below Figure 6, which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0080] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0081] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0082] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0083] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0084] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0085] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0086] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains a target permission management policy for a target device from the permission management policy preconfigured by the server, wherein the target device belongs to a device that is permission-managed by the server, and the preconfigured permission management policy is a permission management policy preconfigured by the server for each device that is permission-managed; performs permission management on the administrator's permission on the target device according to the target permission management policy, and creates a customized token with administrator's permission to elevate the permission of the target device.

[0087] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0088] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0089] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the acquisition module may also be described as "a module for acquiring a target permission management policy for a target device from a permission management policy pre-configured on the server side".

[0090] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0091] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0092] According to one or more embodiments of the present disclosure, Example 1 provides a device permission management method, including: Obtaining a target permission management policy for a target device from a permission management policy pre-configured by the server, wherein the target device is a device that is permission-managed by the server, and the pre-configured permission management policy is a permission management policy pre-configured by the server for each device that is permission-managed; According to the target permission management policy, the administrator permission on the target device is managed, and a customized token with administrator permission is created to enhance the permission of the target device.

[0093] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein the performing permission management on the administrator permission on the target device includes: Matching the administrator whitelist in the target permission management policy with the permissions of each account of the target device, wherein the administrator whitelist is used to indicate the accounts with administrator permissions on the target device; Based on the matching results, the administrator rights of the account that is not in the administrator whitelist but currently has the administrator rights are reclaimed, and the account that is in the administrator whitelist but has had the administrator rights revoked before is granted the administrator rights.

[0094] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 1, wherein the step of creating a custom token with administrator privileges to elevate privileges of the target device includes: Intercept the startup process of the target program on the target device; Matching the program information of the target program with the default privilege escalation rule in the target privilege management policy, wherein the default privilege escalation rule is used to indicate that when the program specified in the default privilege escalation rule is started, the privilege of the process running the program specified in the default privilege escalation rule is elevated to the administrator privilege by default; If the program information of the target program matches the default privilege escalation rule in the target permission management policy, a custom token with administrator privileges is created based on the token of the current account of the target device, and the target program is started through the custom token.

[0095] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 3, wherein intercepting the startup process of the target program on the target device includes: The target program startup process on the target device is intercepted by injecting the target permission management policy into the host process responsible for starting the target program and hooking the application program interface used to create an instance of the target program.

[0096] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 1, wherein creating a custom token with administrator privileges to elevate privileges of the target device includes: Generate a self-service privilege escalation entry on the target device according to the self-service privilege escalation activation instruction in the target privilege management policy, wherein the self-service privilege escalation activation instruction is used to instruct the generation of the self-service privilege escalation entry on the target device; In response to a privilege escalation request for a target program through the self-service privilege escalation portal, matching the privilege escalation request with a self-service privilege escalation rule in the target privilege management policy, wherein the self-service privilege escalation rule is used to indicate that the privilege of the process running the target program is self-service elevated to administrator privilege based on the privilege escalation request; If the privilege escalation request matches the self-service privilege escalation rule, a custom token with administrator privileges is created based on the token of the current account of the target device, and the target program is started through the custom token.

[0097] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 5, wherein generating a self-service privilege escalation entry on the target device includes: By modifying the registry, the self-service privilege escalation entry is generated in the right-click menu on the target device.

[0098] According to one or more embodiments of the present disclosure, Example 7 provides the method of any one of Examples 1 to 6, wherein the method further includes: Sending a rights management log to the server, wherein the rights management log includes at least one of information about a rights escalation method, information about a program for which the rights escalation is targeted, and information about a device for which the rights escalation is applied.

[0099] According to one or more embodiments of the present disclosure, Example 8 provides a device authority management apparatus, including: An acquisition module, used to acquire a target permission management policy for a target device from a permission management policy pre-configured by a server, wherein the target device is a device that is permission-managed by the server, and the pre-configured permission management policy is a permission management policy pre-configured by the server for each device that is permission-managed; The management module is used to manage the administrator rights on the target device according to the target rights management policy, and to create a customized token with administrator rights to enhance the rights of the target device.

[0100] According to one or more embodiments of the present disclosure, Example 9 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any one of the methods in Examples 1-7 when executed by a processing device.

[0101] According to one or more embodiments of the present disclosure, Example 10 provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute a computer program in a storage device to implement the steps of any method in Examples 1-7.

[0102] According to one or more embodiments of the present disclosure, Example 11 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1 to 7 when executed by a processor.

[0103] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0104] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0105] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A device rights management method, characterized in that: include: Obtaining a target permission management policy for a target device from a permission management policy pre-configured by the server, wherein the target device is a device that is permission-managed by the server, and the pre-configured permission management policy is a permission management policy pre-configured by the server for each device that is permission-managed; According to the target permission management policy, the administrator permission on the target device is managed, and a customized token with administrator permission is created to enhance the permission of the target device.

2. The method according to claim 1, characterized in that: The performing authority management on the administrator authority on the target device includes: Matching the administrator whitelist in the target permission management policy with the permissions of each account of the target device, wherein the administrator whitelist is used to indicate the accounts with administrator permissions on the target device; Based on the matching results, the administrator rights of the account that is not in the administrator whitelist but currently has the administrator rights are reclaimed, and the account that is in the administrator whitelist but has had the administrator rights revoked before is granted the administrator rights.

3. The method according to claim 1, characterized in that The step of creating a custom token with administrator privileges to elevate privileges of the target device includes: Intercepting a startup process of a target program on the target device; Matching the program information of the target program with the default privilege escalation rule in the target privilege management policy, wherein the default privilege escalation rule is used to indicate that when the program specified in the default privilege escalation rule is started, the privilege of the process running the program specified in the default privilege escalation rule is elevated to the administrator privilege by default; If the program information of the target program matches the default privilege escalation rule in the target privilege management policy, a custom token with administrator privileges is created based on the token of the current account of the target device, and the target program is started through the custom token.

4. The method according to claim 3, characterized in that The process of intercepting the startup of the target program on the target device includes: The target program startup process on the target device is intercepted by injecting the target permission management policy into the host process responsible for starting the target program and hooking the application program interface used to create an instance of the target program.

5. The method according to claim 1, characterized in that The step of creating a custom token with administrator privileges to elevate privileges of the target device includes: Generate a self-service privilege escalation entry on the target device according to the self-service privilege escalation activation instruction in the target privilege management policy, wherein the self-service privilege escalation activation instruction is used to instruct the generation of the self-service privilege escalation entry on the target device; In response to a privilege escalation request for a target program through the self-service privilege escalation portal, matching the privilege escalation request with a self-service privilege escalation rule in the target privilege management policy, wherein the self-service privilege escalation rule is used to indicate that the privilege of the process running the target program is self-service elevated to administrator privilege based on the privilege escalation request; If the privilege escalation request matches the self-service privilege escalation rule, a custom token with administrator privileges is created based on the token of the current account of the target device, and the target program is started through the custom token.

6. The method according to claim 5, characterized in that Generating a self-service privilege escalation entry on the target device includes: By modifying the registry, the self-service privilege escalation entry is generated in the right-click menu on the target device.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Sending a rights management log to the server, wherein the rights management log includes at least one of information about a rights escalation method, information about a program targeted by the rights escalation, and information about a device applying for the rights escalation.

8. A device authority management device, characterized in that: include: An acquisition module, used to acquire a target permission management policy for a target device from a permission management policy pre-configured by a server, wherein the target device is a device that is permission-managed by the server, and the pre-configured permission management policy is a permission management policy pre-configured by the server for each device that is permission-managed; The management module is used to manage the administrator rights on the target device according to the target rights management policy, and to create a customized token with administrator rights to enhance the rights of the target device.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 7 are implemented.

10. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images