Password voucher circulation protection method and device, equipment, medium and product

Abstract

The invention relates to a password voucher circulation protection method and device, equipment, a medium and a product, and the method comprises the steps: receiving a password voucher circulation request of a target terminal, and recognizing the type of the password voucher circulation request; determining a target processing strategy corresponding to the type of the password voucher circulation request according to a preset mapping relation table between the type of the password voucher circulation request and a password voucher processing strategy; and executing the target processing strategy to enable the target terminal to decrypt the encrypted password voucher according to a pre-loaded password voucher processing program to obtain a plaintext password voucher, or upload the password voucher to be uploaded to an account management system. According to the method, minimum authorized access of the password voucher in the account management system at the server and the client is realized, that is, only the bound authorized terminal can access the password voucher authorized to be accessed, so that the risk of leakage of the password voucher in the circulation process is avoided, and the risk of leakage of a plaintext password is reduced.

Description

Technical Field

[0001] The present application relates to the technical field of data security, and in particular to a password credential transfer protection method, device, equipment, medium and product. Background Art

[0002] An account management system is a system that manages password credentials securely. By establishing a password credential library, managing password credentials in a unified manner, and centrally protecting and regularly changing password credentials, it helps users understand the dynamic distribution of privileged account passwords and continuously track privileged account activities. A password credential is a combination of a user name and a password, which is used to verify the user's identity and ensure that only authorized users can access specific systems, applications, or resources.

[0003] In the related technology, the password credentials in the account management system are uniformly encrypted and stored on the server side, and the access of different logged-in users is controlled according to user identity and authorization. The server is responsible for the management and security of the server-side password credentials; authorized users such as administrators can upload password credentials to the account management system through the local system or export password credentials to the local system (such as PC, mobile phone, Pad, etc.) through the account management system. However, when the account management system transfers password credentials with the local system or external system, that is, downloads, uploads or shares password credentials, since it usually requires the use of third-party software to decrypt in order to view the plain text password, there is a risk of plain text password leakage in the local system. Summary of the invention

[0004] Based on this, it is necessary to provide a password credential circulation protection method, apparatus, computer equipment, computer-readable storage medium and computer program product to address the technical problem that the above-mentioned password credentials have the risk of leakage during circulation.

[0005] In a first aspect, the present application provides a password credential transfer protection method, which is applicable to an account management system, wherein a plurality of password credentials are stored in the account management system, and each password credential corresponds to a plurality of target terminals bound to the account management system, and the method comprises:

[0006] receiving a password credential transfer request from a target terminal and identifying the type of the password credential transfer request;

[0007] Determine a target processing strategy corresponding to the type of password credential transfer request according to a preset mapping relationship table between password credential transfer request types and password credential processing strategies;

[0008] The target processing strategy is executed so that the target terminal decrypts the encrypted password credential according to the pre-loaded password credential processing program to obtain the plaintext password credential, or uploads the password credential to be uploaded to the account management system.

[0009] In one embodiment, determining a target processing strategy corresponding to a type of password credential transfer request includes:

[0010] When the type of password credential transfer request is a password credential download request, the target processing strategy is determined to identify the identity of the target terminal, and the corresponding encryption public key is determined based on the identity of the target terminal. The password credential corresponding to the target terminal is encrypte according to the encryption public key to obtain the encrypted password credential, and the encrypted password credential is sent to the target terminal so that the target terminal obtains the plaintext password credential according to the password credential processing procedure.

[0011] In one embodiment, the method further comprises:

[0012] In the preset administrator terminal identification table, search and determine whether the identification of the target terminal exists;

[0013] When the identity of the target terminal exists in the administrator terminal identity table, determining the corresponding encryption public key according to the identity of the target terminal;

[0014] When the identification of the target terminal does not exist in the binding terminal identification table, warning information of illegal download request is output.

[0015] In one embodiment, determining a target processing strategy corresponding to the type of password credential transfer request further includes:

[0016] When the type of the password credential circulation request is a password credential upload request, determining the target processing strategy to be an identification of a target terminal, and when determining that the identification of the target terminal is an administrator identification, obtaining the password credential to be uploaded in the password credential upload request, and decrypting the password credential to be uploaded according to a preset first decryption key to obtain the plaintext password credential to be uploaded;

[0017] When it is determined that the identifier of the target terminal is a common user identifier, warning information of an illegal upload request is output.

[0018] In one embodiment, the target terminal includes an administrator terminal and a common user terminal, and determining a target processing strategy corresponding to the type of the password credential transfer request further includes:

[0019] When the password credential transfer request is a password credential sharing request, the target processing strategy is determined to obtain the encrypted shared password credential in the password credential sharing request, and decrypt the encrypted shared password credential according to a preset second decryption key to obtain a plaintext shared password credential, wherein the encrypted shared password credential is obtained by decrypting the encrypted shared credential obtained from an ordinary user terminal according to a preset first encryption key, and then decrypted by an administrator terminal and encrypted again according to a preset second encryption key.

[0020] In a second aspect, the present application also provides a password credential transfer protection method, which is applicable to a target terminal that has been bound to an account management system and pre-loaded with a password credential processing program, and the method includes:

[0021] The encrypted password credential is decrypted according to the password credential processing program to obtain the plain text password credential, or the password credential is uploaded to the account management system.

[0022] In a third aspect, the present application also provides a password credential circulation protection system, the system comprising:

[0023] An account management system, configured to receive a password credential transfer request from a target terminal and identify the type of the password credential transfer request; and, configured to determine a target processing strategy corresponding to the type of the password credential transfer request according to a preset mapping relationship table between the password credential transfer request type and the password credential processing strategy, and execute the target processing strategy;

[0024] The target terminal is used to decrypt the encrypted password credential according to a pre-loaded password credential processing program to obtain the plaintext password credential, or upload the password credential to be uploaded to the account management system.

[0025] In a fourth aspect, the present application further provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a password credential transfer protection method provided in the first aspect or the second aspect is implemented.

[0026] In a fourth aspect, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, a password credential transfer protection method provided in the first or second aspect above is implemented.

[0027] In a fifth aspect, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements a password credential transfer protection method provided in the first aspect or the second aspect above.

[0028] The above-mentioned password credential transfer protection method, apparatus, computer equipment, storage medium and computer program product, when the password credential transfer protection method is applicable to an account management system, receives a password credential transfer request from a target terminal and identifies the type of the password credential transfer request; determines a target processing policy corresponding to the type of the password credential transfer request based on a preset mapping relationship table between the password credential transfer request type and the password credential processing policy; executes the target processing policy so that the target terminal decrypts the encrypted password credential according to a pre-loaded password credential processing program to obtain a plaintext password credential, or uploads the password credential to be uploaded to the account management system. The present application adopts the above method to determine the corresponding target processing strategy by identifying the type of password credential transfer request, so that the target terminal can decrypt the encrypted password credential according to the pre-loaded password credential processing program to obtain the plaintext password credential, thereby eliminating the need for decryption with the help of general third-party software, reducing the risk of leakage of the plaintext password credential; and it is convenient for the target terminal to upload the password credential to be uploaded to the account management system according to the pre-loaded password credential processing program, thereby avoiding the situation where the password credential to be uploaded is maliciously intercepted by third-party software, and even if the third-party software maliciously intercepts it, since the password credential to be uploaded is encrypted by the pre-loaded password credential processing program and has a special data format, it is difficult for the third software to crack the plaintext password credential. In other words, the password credential transfer protection method of the present application helps to achieve the minimum authorized access of the password credential in the account management system on the server and the client, that is, only the bound authorized terminal can access the password credential that has been authorized to access, thereby avoiding the risk of leakage of the password credential during the circulation process, and helping to reduce the risk of leakage of the plaintext password. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is an application environment diagram of a password credential transfer protection method in one embodiment;

[0030] Figure 2 A flowchart of a password credential transfer protection method in one embodiment;

[0031] Figure 3 This is an application scenario diagram of a client registration account management system in one embodiment;

[0032] Figure 4 A flowchart of determining a corresponding encryption public key according to an identification of a target terminal in an embodiment;

[0033] Figure 5 An application scenario diagram of password credential downloading in one embodiment;

[0034] Figure 6 A flowchart of processing a password credential upload request in one embodiment;

[0035] Figure 7 An application scenario diagram of password credential upload in one embodiment;

[0036] Figure 8 A diagram of an application scenario of password credential sharing in one embodiment;

[0037] Fig. 9 A flow chart of when a target terminal shares password credentials in another embodiment;

[0038] Fig.10 It is a structural block diagram of a password credential transfer protection system in one embodiment;

[0039] Fig.11 is an internal structure diagram of a computer device in one embodiment;

[0040] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in another embodiment. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0042] In the related technology, an account management system is a system for secure management of password credentials. By establishing a password credential library, managing password credentials in a unified manner, centrally protecting and regularly changing password credentials, it helps users understand the dynamic distribution of privileged account passwords and continuously track privileged account activities. A password credential is a combination of a user name and a password, which is used to verify the user's identity and ensure that only authorized users can access specific systems, applications or resources. The password credentials in the account management system are uniformly encrypted and stored on the server side. The access of different logged-in users is controlled according to the user identity and authorization. The server is responsible for the management and security of the server-side password credentials; authorized users such as administrators can upload password credentials to the account management system through the local system or export password credentials to the local system (such as PC, mobile phone, Pad, etc.) through the account management system. The account management system is usually bound to enterprise users one by one, that is, only the terminal devices within the enterprise users can be bound to the account management system.

[0043] The current password credential transfer protection methods mainly include the following two methods. One method is to perform security control of password credentials only on the server side and during transmission, specifically including: through a web browser, the server authenticates the user, and makes authorization judgments according to the server. If the user has permission, the password credentials can be exported or uploaded. In this process, encryption protection of transmission will be performed through technologies such as TLS, and the data downloaded to the local computer is plain text data; after the password credentials are downloaded to the local computer, they are plain text and in a specific format. After editing with third-party software, they are uploaded to the server in plain text. Another method is to perform secondary encryption on the password credentials when downloading, specifically including: through a web browser, the server authenticates the user, and makes authorization judgments according to the server. If the user has permission, the password credentials can be exported or uploaded. When downloading, the customer is required to enter the encryption password to encrypt the password credentials; after the password credentials are downloaded to the local computer, they are encrypted files, decrypted with third-party decryption software, and then edited with third-party software. After editing, they are uploaded to the server in plain text.

[0044] However, the above-mentioned first existing password credential circulation protection method has the following defects: the password credential is given to the server for security access control, but it cannot solve the risk of password leakage when the administrator processes it locally, such as: the security problem of the third-party software itself; the server uses the web browser https for transmission during downloading and uploading; the browser needs to verify the certificate of the account management system, otherwise there may be a middleman to steal data; the management of client certificates increases the complexity of use; the local system will not be verified, and the local plaintext password credentials may be maliciously stolen and accessed; the file cannot be directly shared with other users, and other means are required for protection when sharing; when uploading encrypted files, only the user's legitimacy can be verified, and the uploading client and the client's upload authority will not be restricted. The above-mentioned second existing password credential circulation protection method has the following defects: the user password is used to encrypt the download password, and even if it is encrypted, there may be insufficient encryption strength due to the strength of the user password; the ease of use is poor, and the user needs to set a different password each time, which is easy to forget; even if there is no problem with encryption, because it still needs to be decrypted to the third-party software when using it, there may be a problem of password leakage; when sharing files with other users, it is necessary to inform other users of the plaintext password, which also has security risks.

[0045] In summary, the technical problem existing in the above-mentioned prior art is that when the account management system transfers password credentials with the local system or external system, that is, downloads, uploads or shares password credentials, since it usually requires the use of third-party software to decrypt to view the plaintext password, there is a risk of plaintext password leakage in the local system.

[0046] In order to solve the above technical problems, the present application embodiment provides a password credential transfer protection method, which can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers. The terminal 102 in this application may include an administrator terminal and an ordinary user terminal, and the management authority of the administrator terminal is higher than the management authority of the ordinary user terminal.

[0047] In one embodiment, the first aspect is as follows: Figure 2 As shown, this method is applied to Figure 1 The server of the account management system in the example is used for explanation. The account management system stores multiple password credentials, and each password credential corresponds to multiple target terminals bound to the account management system. It can be understood that the method can also be applied to the terminal, and can also be applied to the password credential circulation protection system including the terminal and the account management system, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0048] Step 202: Receive a password credential transfer request from a target terminal and identify the type of the password credential transfer request.

[0049] Among them, the password credential is a combination of username and password, where the username is the identifier of the user account and the password is the confidential part of the credential. The password credentials protected by the account management system itself may include user passwords, API keys, digital certificates, and OAuth, among which API keys, digital certificates, and OAuth are mainly machine credentials used for service access to the server, that is, these credentials are used to verify the user's identity and ensure that only authorized users can access the account management system in this application; in addition, the password credentials for accessing the account management system itself are generally username and password, plus multiple factors, such as radius, otp, etc. The target terminal is a terminal device that is bound to the enterprise user's account management system within the enterprise user, including but not limited to computer equipment, tablets, mobile phones and other terminals. The local system of the target terminal has an encryption mechanism, including but not limited to password authentication and biometric authentication. The types of password credential transfer requests include password credential download requests, password credential upload requests, and password credential sharing requests.

[0050] Exemplarily, taking the request body of the password credential transfer request as {"requestType":"download","credential-Id":"12345"} as an example, it can be identified that the request type in the password credential transfer request is password credential download.

[0051] Step 204: Determine a target processing strategy corresponding to the type of password credential transfer request according to a preset mapping relationship table between password credential transfer request types and password credential processing strategies.

[0052] Among them, the mapping relationship table between the preset password credential circulation request type and the password credential processing strategy is set according to the anti-leakage requirements of the password credential circulation, wherein different password credential request types correspond to a specific password credential processing strategy, and the password credential processing strategy is a series of related security operations on the password credentials stored in the account management system, including but not limited to encryption and decryption operations.

[0053] Step 206, executing the target processing strategy, so that the target terminal decrypts the encrypted password credential according to the pre-loaded password credential processing program to obtain the plaintext password credential, or uploads the password credential to be uploaded to the account management system.

[0054] The plaintext password credential refers to the original password that is not encrypted or hidden, such as the user account "12345" and the password "123456". The pre-loaded password credential processing program is an application developed by the enterprise user internally for encrypting and decrypting password credentials. In other words, only the terminal devices within the enterprise user can load and run this specific password credential processing program, so that a third party cannot parse the correct plaintext password credential after maliciously stealing the encrypted password credential sent by the server; or the account management system within the enterprise user is difficult to be maliciously stolen by a third party when receiving the password credential to be uploaded from the bound target terminal, thereby ensuring the security of the password credential circulation.

[0055] In the above-mentioned password credential transfer protection method, the corresponding target processing strategy is determined by identifying the type of password credential transfer request, so that the target terminal can decrypt the encrypted password credential according to the pre-loaded password credential processing program to obtain the plaintext password credential, thereby eliminating the need for general third-party software to decrypt, reducing the risk of plaintext password credential leakage; and it is convenient for the target terminal to upload the password credential to be uploaded to the account management system according to the pre-loaded password credential processing program, thereby avoiding the situation where the password credential to be uploaded is maliciously intercepted by third-party software, and even if the third-party software is maliciously intercepted, since the password credential to be uploaded is encrypted by the pre-loaded password credential processing program and has a special data format, it is difficult for the third software to crack the plaintext password credential. In other words, the password credential transfer protection method of the present application helps to achieve the minimum authorized access of the password credential in the account management system on the server and the client, that is, only the bound authorized terminal can access the password credential that has been authorized to access, thereby avoiding the risk of leakage of the password credential during the circulation process, and helping to reduce the risk of leakage of the plaintext password.

[0056] In one embodiment, a target processing strategy corresponding to the type of password credential transfer request is determined, including: when the type of password credential transfer request is a password credential download request, determining the target processing strategy to identify the identity of the target terminal, and determining the corresponding encryption public key based on the identity of the target terminal, encrypting the password credential corresponding to the target terminal based on the encryption public key to obtain the encrypted password credential, and sending the encrypted password credential to the target terminal, so that the target terminal obtains the plaintext password credential according to the password credential processing procedure.

[0057] Among them, the identification of the target terminal is used to characterize the uniqueness of the identity of the target terminal. The identification form of the target terminal includes but is not limited to digital numbers, letter numbers and their combination forms. In this embodiment, the identification of the target terminal takes the combination of digital numbers and letter numbers as an example. For example, the identification of a certain target terminal is "M001", which means that the target terminal is an administrator terminal, and the digital number of the administrator terminal is 001; for another example, the representation of a certain target terminal is "U001", which means that the target terminal is an ordinary user terminal, and the digital number of the user terminal is 001. Each target terminal is pre-equipped with a unique public key and private key. The public key is stored in the server of the account management system, and the private key is stored in the local system of the target terminal. The role of the public key is to encrypt the password credentials to ensure that the data can only be decrypted and used by the terminal with the corresponding private key during the transmission process. The role of the private key is to decrypt the data encrypted by the public key to obtain the plaintext information therein. Only the terminal with the corresponding private key can decrypt the data encrypted with the public key.

[0058] Specifically, refer to Figure 3In the application scenario of password client registration shown in the figure, when each enterprise user's internal terminal is registered on the client, the client will generate a unique user public key and private key for the user corresponding to each terminal, which are used to encrypt the password credentials to ensure that the encrypted files can only be accessed by specific local clients.

[0059] For example, the encrypted password credential obtained by encrypting the plain text password credential "credential-Id:M001;password:123456" using the RSA algorithm is "w5ZdK9R2F+DkOyLpW1nJq6G7X3vY9T4ZmH2U5JnL6M3K9N4T8Y1D3E5F7G8I9J0L2M4N6P7Q8R9S0T1V2W3X4Y5Z6A7B8C9D0E1F2G3H4I5 J6K7L8M9N0O1P2Q3R4S5T6U7V8W9X0Y1Z2A3B4C5D6E7F8G9H0I1J2K3L4M5N6O7P8Q9R0S1T2U3V4W5X6Y7Z8A9B 0C1D2E3F4G5H6I7J8K9L0M1N2O3P4Q5R6S7T8U9V0W1X2Y3Z4A5B6C7D8E9F0G1H2I3J4K5L6M7N8O9P0Q1R2S3”.

[0060] In one embodiment, Figure 4 As shown, the method also includes:

[0061] Step 402: Search and determine whether the target terminal identifier exists in the preset administrator terminal identifier table.

[0062] The preset administrator terminal identification table is pre-set according to the identification of the terminal bound to the account management system, and the administrator terminal identification is obtained by identifying the identification of the target terminal.

[0063] Exemplarily, the identification of a target terminal in the above example is "M001". When the identification of the target terminal is identified with the character M, it indicates that the target terminal is an administrator terminal; and when the identification of the target terminal is identified with the character U, it indicates that the target terminal is an ordinary user terminal.

[0064] Step 404: if the target terminal identifier exists in the administrator terminal identifier table, determine the corresponding encryption public key according to the target terminal identifier.

[0065] Among them, according to the above content, each target terminal has its own unique corresponding encryption public key and private key. When the target terminal identification table contains the target terminal identification, it indicates that the target terminal is an administrator terminal. When the target terminal identification table does not contain the target terminal identification, it indicates that the target terminal is an ordinary user terminal.

[0066] Specifically, in order to ensure minimum authorization for access to the entire management process, that is, only people or applications with specific access rights can access password credentials that have been authorized for access, this embodiment can set the account management system to only receive password credential download requests issued by the administrator terminal to ensure the secure download of password credentials within the enterprise users.

[0067] For example, refer to Figure 5 The application scenario of password credential download shown is that when a company's IT administrator needs to download the password credentials of a specific user (some ordinary users) for configuring the company's business system, the specific operations are as follows:

[0068] Administrator requests download: The administrator accesses the company's account management system through a browser, enters the user name and password to log in, and chooses to download the password credentials of a specific user;

[0069] Server authentication and generation of encrypted credentials: The account management system server first verifies the identity and authority of the administrator. For example, when a target terminal is identified as "M001", it is determined that the target terminal is an administrator terminal with download authority. After confirming that it has the authority to download the user credential, it generates an encrypted password credential. This credential is bound to the administrator's local system and can only be decrypted by the administrator's specific client.

[0070] Client-side decryption: The administrator's client uses a specific encryption key in the pre-loaded password credential handler to decrypt the downloaded encrypted password credential and display the plaintext password in memory. The plaintext password is not persistently stored on the local system but is only temporarily saved in memory. When the client closes the password credential handler, the plaintext password credential temporarily stored in memory is automatically cleaned up to prevent the plaintext password credential from being maliciously stolen.

[0071] Step 406: if the target terminal identifier does not exist in the binding terminal identifier table, output warning information of illegal download request.

[0072] The warning information of illegal download requests may include the warning title, warning description, timestamp, request source, request type, and processing suggestions, etc. The warning information of illegal download requests may be recorded in the system log for subsequent analysis; it may also be output on the console or command interface of the target terminal; it may also be sent via email for timely processing by relevant personnel; it may also be prompted to the user in the form of a pop-up window or dialog box on the user interface.

[0073] Exemplarily, when the identification of a target terminal is "U001", it is determined that the target terminal is a common user terminal without download authority, and the following warning information of illegal download request is output:

[0074] Alert Title: Illegal Download Request Alert

[0075] Alarm detailed description: The target terminal identifier is not found in the bound terminal identifier table and the request is rejected.

[0076] Timestamp: 2024-11-18T01:50:03.877Z

[0077] Request source: 192.168.1.100

[0078] Request type: Password credential download request

[0079] Solution: Please check whether the terminal ID is correct, or contact the administrator to bind the terminal.

[0080] In this embodiment, based on the identification of the target terminal that sends the password credential download request, it is determined whether the target terminal is an administrator terminal. Only when the target terminal is an administrator terminal does the account management system respond to the password credential download request of the terminal, thereby ensuring the minimum authorization for access to the entire management process, that is, only people or applications with specific access rights can access the password credentials that have been authorized for access, thereby ensuring security when downloading the password credentials.

[0081] In one embodiment, Figure 6 As shown, determining a target processing strategy corresponding to the type of password credential transfer request also includes:

[0082] Step 602, when the type of password credential transfer request is a password credential upload request, determine that the target processing strategy is to identify the identity of the target terminal, and when it is determined that the identity of the target terminal is the administrator identity, obtain the password credential to be uploaded in the password credential upload request, and decrypt the password credential to be uploaded according to the preset first decryption key to obtain the plaintext password credential to be uploaded.

[0083] The password credential to be uploaded is the password credential encrypted by the administrator terminal using a specific encryption key to encrypt the password credential file edited in the local system. The specific encryption key is generated by the password credential processing program loaded by the administrator terminal and stored in the local environment of the client to ensure that the key is accessed only when encryption operation is required. The preset first decryption key is a specific decryption key stored on the server, and only the server can decrypt and upload the password credential.

[0084] For example, refer to Figure 7 The application scenario of password credential upload shown is that when a company needs to update an online password credential, the IT administrator is responsible for editing and uploading the new password credential. The specific operations are as follows:

[0085] Administrator edit and encrypt: The administrator encrypts the new password credential file edited locally using a specific encryption key, and only the server has the decryption key;

[0086] Upload encrypted credentials: The administrator uploads the encrypted password credentials to the account management system server through the browser;

[0087] Server authentication and decryption: The server verifies the administrator's identity and permissions. After confirming that the administrator has the right to upload the password credentials, the server uses a specific key to decrypt and save the new password credentials.

[0088] Step 604: When it is determined that the identifier of the target terminal is a common user identifier, output warning information of an illegal upload request.

[0089] The warning information of illegal upload request is the same as the warning information of illegal download request, and may also include the warning title, warning description, timestamp, request source, request type, and processing suggestions, etc. The warning information of illegal upload request may be recorded in the system log for subsequent analysis; it may also be output on the console or command interface of the target terminal; it may also be sent via email for timely processing by relevant personnel; it may also be prompted to the user in the form of a pop-up window or dialog box on the user interface.

[0090] Exemplarily, when the identification of a target terminal is "U001", it is determined that the target terminal is a common user terminal without download authority, and the following warning information of illegal upload request is output:

[0091] Alert Title: Illegal upload request alert

[0092] Alarm detailed description: The target terminal identifier is not found in the bound terminal identifier table and the request is rejected.

[0093] Timestamp: 2024-11-17T01:50:03.877Z

[0094] Request source: 192.168.1.100

[0095] Request type: Password credential upload request

[0096] Solution: Please check whether the terminal ID is correct, or contact the administrator to bind the terminal.

[0097] In this embodiment, based on the identification of the target terminal that sends the password credential upload request, it is determined whether the target terminal is an administrator terminal. Only when the target terminal is an administrator terminal, the account management system responds to the password credential upload request of the terminal, thereby ensuring the minimum authorization for access to the entire management process, that is, only people or applications with specific access rights can access the password credentials that have been authorized for access, thereby ensuring the security of uploading the password credentials.

[0098] In one embodiment, the target terminal includes an administrator terminal and a common user terminal, and determining a target processing strategy corresponding to the type of the password credential transfer request further includes:

[0099] When the password credential transfer request is a password credential sharing request, the target processing strategy is determined to obtain the encrypted shared password credential in the password credential sharing request, and decrypt the encrypted shared password credential according to a preset second decryption key to obtain a plaintext shared password credential, wherein the encrypted shared password credential is obtained by decrypting the encrypted shared credential obtained from an ordinary user terminal according to a preset first encryption key, and then decrypted by an administrator terminal and encrypted again according to a preset second encryption key.

[0100] Among them, the preset first encryption key is the key used by ordinary user terminals to encrypt key credentials. This key is preset by the local system and is used when ordinary user terminals encrypt password credentials to ensure the confidentiality of password credentials during transmission. The preset second encryption key is the key used by the administrator terminal to re-encrypt the password credentials. This key is also preset by the local system of the administrator terminal to ensure the confidentiality of the password credentials when uploading to the server. The preset second decryption key is the key used by the server to decrypt the password credentials re-encrypted by the administrator terminal. The preset second decryption key is stored in the server.

[0101] For example, refer to Figure 8 In the application scenario of password credential sharing shown in the figure, when a project team member needs to share the password credential of an online service with the project manager so that the project manager can perform subsequent operations, the specific operations are as follows:

[0102] User encrypted credentials: Project team members use specific encryption keys to encrypt locally edited password credential files, and only the project manager (i.e., administrator) can decrypt them;

[0103] User shared encrypted credentials: Project team members share the encrypted password credential file with the project manager;

[0104] Administrator decryption and re-encryption: After receiving the encrypted file, the project manager uses his own private key to decrypt and re-encrypt the password credentials, and then uploads the re-encrypted password credentials to the account management system server through the browser.

[0105] In this embodiment, through the decryption and re-encryption process of the administrator terminal, the password credentials uploaded by the ordinary user terminal are accessed and uniformly uploaded to the account management system, thereby ensuring that only authorized personnel can access the uploaded password credentials to reduce the risk of leakage when uploading password credentials.

[0106] The above method of the present application determines the corresponding target processing strategy by identifying the type of password credential transfer request, so that the target terminal decrypts the encrypted password credential according to the pre-loaded password credential processing program to obtain the plaintext password credential, thereby eliminating the need for decryption with the help of general third-party software, reducing the risk of leakage of the plaintext password credential; and it is convenient for the target terminal to upload the password credential to be uploaded to the account management system according to the pre-loaded password credential processing program, thereby avoiding the situation where the password credential to be uploaded is maliciously intercepted by third-party software, and even if the third-party software maliciously intercepts it, since the password credential to be uploaded is encrypted by the pre-loaded password credential processing program and has a special data format, it is difficult for the third software to crack the plaintext password credential. In other words, the password credential transfer protection method of the present application helps to achieve the minimum authorized access of the password credential in the account management system on the server and the client, that is, only the bound authorized terminal can access the password credential that has been authorized to access, thereby avoiding the risk of leakage of the password credential during the circulation process, and helping to reduce the risk of leakage of the plaintext password.

[0107] In a second aspect, the embodiment of the present application further provides a password credential transfer protection method, which is applicable to a target terminal that has been bound to an account management system and pre-loaded with a password credential processing program, and the method includes:

[0108] The encrypted password credential is decrypted according to the password credential processing program to obtain the plain text password credential, or the password credential is uploaded to the account management system.

[0109] The target terminals include administrator terminals and common user terminals, and the authority level of the administrator terminal is higher than that of the common user terminal.

[0110] Specifically, the administrator terminal decrypts the encrypted password credential according to the password credential processing program to obtain the plaintext password credential, or uploads the password credential to the account management system to ensure the security of the password credential when it is downloaded.

[0111] In this embodiment, the encrypted password credential is decrypted by the password credential processing program, and the obtained plain text password feature is not easily leaked.

[0112] In one embodiment, the method further includes: the administrator terminal sends the password credentials to be uploaded to the account management system.

[0113] Among them, according to the above content, it can be known that the password credential to be uploaded is the password credential that the administrator terminal encrypts the password credential file edited in the local system using a specific encryption key. The specific encryption key is generated by the password credential handler loaded by the administrator terminal and stored in the local environment of the client to ensure that the key is accessed only when encryption operation is required.

[0114] In this embodiment, the uploaded password credentials are sent to the account management system through the administrator terminal, which helps to ensure the security and confidentiality of the password credentials when they are uploaded and reduce the risk of leakage.

[0115] In one embodiment, Fig. 9 As shown, the method also includes:

[0116] Step 902: The common user terminal encrypts the shared password credential according to a preset first encryption key to obtain an encrypted shared credential.

[0117] Step 904: Send the encrypted shared credential to the administrator terminal. The administrator terminal decrypts the encrypted shared credential and encrypts it again according to a preset second encryption key to obtain an encrypted shared password credential.

[0118] Step 906: The administrator terminal sends the encrypted shared password credential to the account management system.

[0119] In this embodiment, through the decryption and re-encryption process of the administrator terminal, the password credentials uploaded by the ordinary user terminal are accessed and uniformly uploaded to the account management system, thereby ensuring that only authorized personnel can access the uploaded password credentials to reduce the risk of leakage when uploading password credentials.

[0120] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0121] Based on the same inventive concept, the embodiment of the present application also provides a password credential circulation protection system for implementing the password credential circulation protection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more password credential circulation protection system embodiments provided below can refer to the limitations of the password credential circulation protection method above, and will not be repeated here.

[0122] In one embodiment, Fig.10 As shown, a password credential transfer protection system is provided, including an account management system 1002 and a target terminal 1004, wherein:

[0123] The account management system 1002 is used to receive a password credential transfer request from a target terminal and identify the type of the password credential transfer request; and to determine a target processing policy corresponding to the type of the password credential transfer request based on a preset mapping relationship table between the password credential transfer request type and the password credential processing policy, and execute the target processing policy.

[0124] The target terminal 1004 is used to decrypt the encrypted password credential according to the pre-loaded password credential processing program to obtain the plaintext password credential, or upload the password credential to be uploaded to the account management system.

[0125] In one embodiment, the account management system 1002 is also used for: when the type of password credential transfer request is a password credential download request, determining the target processing strategy as identifying the identity of the target terminal, and determining the corresponding encryption public key based on the identity of the target terminal, encrypting the password credential corresponding to the target terminal according to the encryption public key to obtain the encrypted password credential, and sending the encrypted password credential to the target terminal, so that the target terminal obtains the plaintext password credential according to the password credential processing procedure.

[0126] In one embodiment, the account management system 1002 is also used to: search and determine whether the target terminal identification exists in the preset administrator terminal identification table; if the target terminal identification exists in the administrator terminal identification table, determine the corresponding encryption public key according to the target terminal identification; if the target terminal identification does not exist in the binding terminal identification table, output an alarm message of an illegal download request.

[0127] In one embodiment, the account management system 1002 is also used for: when the type of password credential transfer request is a password credential upload request, determining the target processing strategy as identifying the identifier of the target terminal, and when it is determined that the identifier of the target terminal is an administrator identifier, obtaining the password credential to be uploaded in the password credential upload request, and decrypting the password credential to be uploaded according to a preset first decryption key to obtain the plaintext password credential to be uploaded; when it is determined that the identifier of the target terminal is an ordinary user identifier, outputting an alarm message of an illegal upload request.

[0128] In one embodiment, the account management system 1002 is also used to: when the password credential transfer request is a password credential sharing request, determine the target processing strategy to obtain the encrypted shared password credential in the password credential sharing request, and decrypt the encrypted shared password credential according to a preset second decryption key to obtain a plaintext shared password credential, wherein the encrypted shared password credential is obtained by decrypting the encrypted shared credential obtained from the ordinary user terminal according to the preset first encryption key, and then encrypting it again according to the preset second encryption key via the administrator terminal.

[0129] Each module in the above-mentioned password credential circulation protection system can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0130] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.11 As shown. The computer device includes a processor, a memory and a network interface connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the user's private key data, etc. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it implements a password credential transfer protection method of the first aspect above.

[0131] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.12 As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a password credential transfer protection method provided in the second aspect above is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0132] Those skilled in the art will understand that Fig.11 and Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0133] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0134] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0135] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0136] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0137] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0138] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0139] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A password credential circulation protection method, applicable to an account management system, wherein the account management system stores a plurality of password credentials, each of which corresponds to a plurality of target terminals bound to the account management system, and is characterized in that: The method comprises: receiving a password credential transfer request from the target terminal, and identifying a type of the password credential transfer request; Determine a target processing strategy corresponding to the type of the password credential transfer request according to a preset mapping relationship table between the password credential transfer request type and the password credential processing strategy; The target processing strategy is executed so that the target terminal decrypts the encrypted password credential according to the pre-loaded password credential processing program to obtain the plaintext password credential, or uploads the password credential to be uploaded to the account management system.

2. The method according to claim 1, characterized in that The determining of a target processing strategy corresponding to the type of the password credential transfer request includes: When the type of the password credential transfer request is a password credential download request, the target processing strategy is determined to identify the identity of the target terminal, and the corresponding encryption public key is determined according to the identity of the target terminal, the password credential corresponding to the target terminal is encrypte according to the encryption public key to obtain the encrypted password credential, and the encrypted password credential is sent to the target terminal, so that the target terminal obtains the plaintext password credential according to the password credential processing procedure.

3. The method according to claim 2, characterized in that The method further comprises: In a preset administrator terminal identification table, searching and determining whether the identification of the target terminal exists; When the identifier of the target terminal exists in the administrator terminal identifier table, determining a corresponding encryption public key according to the identifier of the target terminal; When the identification of the target terminal does not exist in the binding terminal identification table, warning information of illegal download request is output.

4. The method according to claim 1, characterized in that: The determining of a target processing strategy corresponding to the type of the password credential transfer request further includes: When the type of the password credential circulation request is a password credential upload request, determining that the target processing strategy is to identify the identifier of the target terminal, and when determining that the identifier of the target terminal is an administrator identifier, obtaining the password credential to be uploaded in the password credential upload request, and decrypting the password credential to be uploaded according to a preset first decryption key to obtain the plaintext password credential to be uploaded; When it is determined that the identifier of the target terminal is a common user identifier, warning information of an illegal upload request is output.

5. The method according to claim 1, characterized in that The target terminal includes an administrator terminal and a common user terminal, and the determining of a target processing strategy corresponding to the type of the password credential transfer request further includes: When the password credential transfer request is a password credential sharing request, the target processing strategy is determined to obtain the encrypted shared password credential in the password credential sharing request, and decrypt the encrypted shared password credential according to a preset second decryption key to obtain a plaintext shared password credential, wherein the encrypted shared password credential is obtained by decrypting the encrypted shared credential obtained from the ordinary user terminal according to the preset first encryption key, and then decrypting it by the administrator terminal and encrypting it again according to the preset second encryption key.

6. A password credential transfer protection method, applicable to a target terminal that has been bound to an account management system and pre-loaded with a password credential processing program, characterized in that: The method comprises: The encrypted password credential is decrypted according to the password credential processing program to obtain the plain text password credential, or the password credential is uploaded to the account management system.

7. A password credential circulation protection system, characterized in that: The system comprises: An account management system, configured to receive a password credential transfer request from a target terminal and identify the type of the password credential transfer request; and to determine a target processing strategy corresponding to the type of the password credential transfer request according to a preset mapping relationship table between the password credential transfer request type and the password credential processing strategy, and execute the target processing strategy; The target terminal is used to decrypt the encrypted password credential according to the pre-loaded password credential processing program to obtain the plaintext password credential, or upload the password credential to be uploaded to the account management system.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images