Password credential flow protection method, apparatus, device, medium and product

Abstract

The application relates to a password credential flow protection method, device, equipment, medium and product, wherein the method comprises the following steps: receiving a password credential flow request of a target terminal, and identifying the type of the password credential flow request; determining a target processing strategy corresponding to the type of the password credential flow request according to a preset mapping relationship table of the type of the password credential flow request and a password credential processing strategy; and executing the target processing strategy to enable the target terminal to decrypt the encrypted password credential according to a preloaded password credential processing program to obtain the plaintext password credential, or upload the password credential to be uploaded to an account management system. The application adopts the above method to realize minimum authorized access of the password credential in the account management system on the server side and the client side, that is, only the bound authorized terminal can access the password credential which has been authorized to access, so that the risk of password credential leakage in the flow process is avoided, and the risk of plaintext password leakage is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a password credential circulation protection method and device, equipment, medium and product. BACKGROUND

[0002] An account management system is a system for securely managing password credentials. By establishing a password credential library, it uniformly manages password credentials, centrally protects and regularly replaces password credentials, helps users master the dynamic distribution of privileged account passwords, and continuously tracks privileged account activities. Password credentials are a combination of usernames and passwords, used to verify user identity and ensure that only authorized users can access specific systems, applications, or resources.

[0003] In related technologies, password credentials in the account management system are uniformly encrypted and stored on the server. Different login user access is controlled according to user identity and authorization, and the server is responsible for the management and security of the server password credentials. Users with permission, such as administrators, can upload password credentials to the account management system through the local system or export password credentials to the local system (such as PC, mobile phone, Pad, etc.) through the account management system. However, when the account management system circulates password credentials with the local system or external system, i.e., downloads, uploads, or shares password credentials, since the plaintext password usually needs to be decrypted with the help of third-party software to view, it leads to the risk of plaintext password leakage in the local system. SUMMARY

[0004] Therefore, it is necessary to provide a password credential circulation protection method, device, computer equipment, computer readable storage medium, and computer program product to solve the technical problem of password credential leakage risk during circulation.

[0005] In a first aspect, the present application provides a password credential circulation protection method, which is applicable to an account management system. The account management system stores a plurality of password credentials, each of which corresponds to a plurality of target terminals bound to the account management system. The method comprises:

[0006] Receiving a password credential circulation request of a target terminal and identifying the type of the password credential circulation request;

[0007] According to a preset mapping relationship table of password credential circulation request types and password credential processing strategies, determining a target processing strategy corresponding to the type of the password credential circulation request;

[0008] Executing the target processing strategy to enable the target terminal to decrypt the encrypted password credential according to a preloaded password credential processing program to obtain the plaintext password credential, or upload the password credential to be uploaded to the account management system.

[0009] In one of the embodiments, the target processing strategy corresponding to the type of the password credential circulation request is determined, including:

[0010] When the type of the password credential circulation request is a password credential download request, the target processing strategy is determined as identifying the identity of the target terminal, and an encryption public key corresponding to the identity of the target terminal is determined, the password credential corresponding to the target terminal is encrypted according to the encryption public key, and the encrypted password credential is obtained, and the encrypted password credential is sent to the target terminal, so that the target terminal obtains the plaintext password credential according to the password credential processing program.

[0011] In one of the embodiments, the method further includes:

[0012] In the preset administrator terminal identity table, it is determined whether the identity of the target terminal exists or not;

[0013] In the case that the identity of the target terminal exists in the administrator terminal identity table, the encryption public key corresponding to the identity of the target terminal is determined;

[0014] In the case that the identity of the target terminal does not exist in the binding terminal identity table, an alarm information of illegal download request is outputted.

[0015] In one of the embodiments, the target processing strategy corresponding to the type of the password credential circulation request is determined, further including:

[0016] When the type of the password credential circulation request is a password credential upload request, the target processing strategy is determined as identifying the identity of the target terminal, and in the case that the identity of the target terminal is determined as an administrator identity, the to-be-uploaded password credential in the password credential upload request is obtained, and the to-be-uploaded password credential is decrypted according to a preset first decryption key to obtain the plaintext to-be-uploaded password credential;

[0017] In the case that the identity of the target terminal is determined as a normal user identity, an alarm information of illegal upload request is outputted.

[0018] In one of the embodiments, the target terminal includes an administrator terminal and a normal user terminal, and the target processing strategy corresponding to the type of the password credential circulation request is determined, further including:

[0019] When the password credential circulation request is a password credential sharing request, the target processing strategy is determined as obtaining an encrypted shared password credential in the password credential sharing request, and the encrypted shared password credential is decrypted according to a preset second decryption key to obtain the plaintext shared password credential, wherein the encrypted shared password credential is obtained by the administrator terminal from the encrypted shared credential from the normal user terminal according to a preset first encryption key and then encrypted according to the preset second encryption key.

[0020] In a second aspect, the present application also provides a password credential transfer protection method applicable to a target terminal that has been bound to an account management system and pre-loaded with a password credential processing program, the method comprising:

[0021] The encrypted password credential is decrypted according to the password credential processing program to obtain the plaintext password credential, or the password credential is uploaded to the account management system.

[0022] In a third aspect, the present application also provides a password credential transfer protection system, which includes:

[0023] An account management system for receiving a password credential transfer request from a target terminal and identifying the type of the password credential transfer request; and for determining a target processing policy corresponding to the type of the password credential transfer request based on a preset mapping relationship table between the password credential transfer request type and the password credential processing policy, and executing the target processing policy;

[0024] The target terminal is used to decrypt the encrypted password credential according to a pre-loaded password credential processing program to obtain the plaintext password credential, or upload the password credential to be uploaded to the account management system.

[0025] In a fourth aspect, the present application also provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a password credential transfer protection method provided in the first or second aspect is implemented.

[0026] In a fourth aspect, the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements a password credential transfer protection method provided in the first or second aspect above.

[0027] In a fifth aspect, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements a password credential transfer protection method provided in the first aspect or the second aspect above.

[0028] The password credential circulation protection method, device, computer device, storage medium and computer program product, in the case that the password credential circulation protection method is applied to an account management system, receive a password credential circulation request of a target terminal, and identify a type of the password credential circulation request; determine a target processing strategy corresponding to the type of the password credential circulation request according to a preset mapping relationship table of password credential circulation request types and password credential processing strategies; and execute the target processing strategy, so that the target terminal decrypts the encrypted password credential according to a preloaded password credential processing program to obtain a plaintext password credential, or uploads the password credential to be uploaded to the account management system. The present application adopts the above method, determines the corresponding target processing strategy through the identified type of the password credential circulation request, so that the target terminal decrypts the encrypted password credential according to the preloaded password credential processing program to obtain the plaintext password credential, thereby avoiding the need to use a general third-party software for decryption, reducing the risk of leakage of the plaintext password credential; and the target terminal can upload the password credential to be uploaded to the account management system according to the preloaded password credential processing program, thereby avoiding the situation that the password credential to be uploaded is maliciously intercepted by a third-party software, and even if the third-party software maliciously intercepts, since the password credential to be uploaded is encrypted by the preloaded password credential processing program and has a special data format, the third-party software is difficult to crack the plaintext password credential, that is, the password credential circulation protection method of the present application helps to realize the minimum authorized access of the password credential in the account management system between the server and the client, that is, only the authorized terminal bound can access the password credential authorized to access, thereby avoiding the risk of leakage of the password credential in the circulation process, and helping to reduce the risk of leakage of the plaintext password. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1 Application environment diagram of the password credential circulation protection method in an embodiment;

[0030] Figure 2 Flowchart of the password credential circulation protection method in an embodiment;

[0031] Figure 3 Application scenario diagram of the client registering the account management system in an embodiment;

[0032] Figure 4 Flowchart of determining the corresponding encryption public key according to the identifier of the target terminal in an embodiment;

[0033] Figure 5 Application scenario diagram of the password credential download in an embodiment;

[0034] Figure 6 Flowchart of processing the password credential upload request in an embodiment;

[0035] Figure 7 An application scenario diagram for password credential uploading in an embodiment;

[0036] Figure 8 An application scenario diagram for password credential sharing in an embodiment;

[0037] Figure 9 A flowchart for sharing password credentials by a target terminal in another embodiment;

[0038] Figure 10 A structural block diagram of a password credential circulation protection system in an embodiment;

[0039] Figure 11 An internal structural diagram of a computer device in an embodiment;

[0040] Figure 12 An internal structural diagram of a computer device in another embodiment. DETAILED DESCRIPTION

[0041] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0042] In the related art, an account management system is a system for securely managing password credentials. By establishing a password credential library, the account management system uniformly manages password credentials, centrally protects and regularly replaces password credentials, helps users to master the dynamic distribution of privileged account passwords, and continuously tracks privileged account activities. Password credentials are a combination of a username and a password, which are used to verify the identity of a user and ensure that only authorized users can access specific systems, applications, or resources. Password credentials in the account management system are uniformly encrypted and stored on the server. Different login user access is controlled according to user identity and authorization. The server is responsible for the management and security of the server password credentials. Users with permission, such as administrators, can upload password credentials to the account management system through the local system or export password credentials from the account management system to the local system (such as PC, mobile phone, Pad, etc.). The account management system is usually bound one-to-one with enterprise users, that is, only terminal devices within an enterprise user can bind the account management system.

[0043] The current password credential flow protection method mainly includes the following two kinds. One method is to perform security control of the password credential only on the server side and during transmission, specifically including: authenticating the user through the web browser, the server side performs authorization judgment, if the user has the right, the password credential can be exported or uploaded, the transmission is encrypted through technologies such as TLS in this process, and downloaded to the local as plaintext data; the password credential downloaded to the local is plaintext and specific format, edited by using third-party software, and uploaded to the server in plaintext. Another method is to encrypt the password credential again when downloading, specifically including: authenticating the user through the web browser, the server side performs authorization judgment, if the user has the right, the password credential can be exported or uploaded, and the user is required to input an encryption password when downloading to encrypt the password credential; the password credential downloaded to the local is an encrypted file, decrypted by using third-party decryption software, and edited by using third-party software, and then uploaded to the server in plaintext.

[0044] However, the above-mentioned existing first password credential flow protection method has the following defects: the password credential is given to the server side for security access control, but it cannot solve the risk of password leakage when the administrator processes locally, such as: third-party software security problem itself; the server uses web browser https for transmission during downloading and uploading; the browser needs to verify the certificate of the account management system, otherwise an intermediate person may steal data; the management of the client certificate increases the complexity of use; the local system is not verified, and the local plaintext password credential may be maliciously stolen and accessed; the file cannot be directly shared with other users, and protection is needed when sharing; when uploading an encrypted file, only the user's legitimacy can be checked, and the client uploading permission cannot be limited. The above-mentioned existing second password credential flow protection method has the following defects: the user password is used to encrypt the password when downloading, even if it is encrypted, there may be a problem of insufficient encryption strength due to the strength of the user password; poor usability, users need to set different passwords every time, which is easy to forget; even if the encryption is not a problem, since the third-party software still needs to be decrypted when used, there may be a problem of password leakage; when sharing the file with other users, the plaintext password needs to be informed to other users, which also has security risks.

[0045] In summary, the above-mentioned prior art has the technical problem that when the account management system performs password credential flow with the local system or external system, i.e. downloads, uploads or shares the password credential, since the third-party software is usually needed to decrypt to view the plaintext password, the local system has the risk of plaintext password leakage.

[0046] To solve the above technical problems, the application provides a password credential flow protection method, which can be applied to an application environment as shown in Figure 1 The terminal 102 communicates with the server 104 through a network. The data storage system can store data required to be processed by the server 104. The data storage system can be integrated on the server 104, or placed on a cloud or other network server. The terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers. The terminal 102 in the application can include an administrator terminal and a normal user terminal, and the management authority of the administrator terminal is higher than that of the normal user terminal.

[0047] In a first aspect, in one embodiment, as shown in Figure 2 The method is applied to a server of an account management system in Figure 1 In the account management system, a plurality of password credentials are stored, and each password credential corresponds to a plurality of target terminals bound to the account management system. It can be understood that the method can also be applied to a terminal and a password credential flow protection system including a terminal and an account management system, and is realized through the interaction of the terminal and the server. In this embodiment, the method includes the following steps:

[0048] Step 202, receiving a password credential flow request of a target terminal, and identifying the type of the password credential flow request.

[0049] The password credential is a combination of a username and a password, wherein the username is an identifier of a user account, and the password is a secret part of the credential. The account management system itself protects the password credential, which can include a user password, an API key, a digital certificate, and OAuth, etc. The API key, the digital certificate, and the OAuth are mainly machine credentials, which are used for service access to a server, that is, these credentials are used to verify the identity of a user, and to ensure that only authorized users can access the account management system in the application. In addition, the password credential accessed by the account management system itself is generally a username and password, plus a factor such as radius, otp, etc. The target terminal is a terminal device bound to the account management system of an enterprise user within an enterprise user, including but not limited to computer devices, tablets, mobile phones, etc. The local system of the target terminal has an encryption mechanism, including but not limited to password authentication and biometric authentication. The type of the password credential flow request includes a password credential download request, a password credential upload request, and a password credential sharing request, etc.

[0050] For example, if the request body of the password credential transfer request is {“requestType”:“download”,“credential-Id”:“12345”}, the request type in the password credential transfer request can be identified as password credential download.

[0051] In step 204, according to the preset mapping relationship table between the password credential transfer request type and the password credential processing strategy, the target processing strategy corresponding to the type of the password credential transfer request is determined.

[0052] The preset mapping relationship table between the password credential transfer request type and the password credential processing strategy is set according to the anti-leakage requirement of the password credential transfer. Different password credential request types correspond to a specific password credential processing strategy. The password credential processing strategy is a series of related security operations on the password credentials stored in the account management system, including but not limited to encryption and decryption operations.

[0053] In step 206, the target processing strategy is executed to make the target terminal decrypt the encrypted password credential according to the pre-loaded password credential processing program to obtain the plaintext password credential, or upload the password credential to be uploaded to the account management system.

[0054] The plaintext password credential refers to the original password that is not encrypted or hidden, for example, the user account is“12345”and the password is“123456”. The pre-loaded password credential processing program is an application program specially used for encrypting and decrypting password credentials developed by the enterprise user. That is, only the terminal devices within the enterprise user can load and run the specific password credential processing program, so that even if a third party maliciously steals the encrypted password credential sent by the server, the correct plaintext password credential cannot be parsed; or when the account management system of the enterprise user receives the password credential to be uploaded uploaded by the target terminal, it is difficult for a third party to maliciously steal it, thereby ensuring the security of the password credential transfer.

[0055] The password credential circulation protection method has the advantages that the type of the identified password credential circulation request is used to determine the corresponding target processing strategy, so that the target terminal decrypts the encrypted password credential according to the preloaded password credential processing program to obtain the plaintext password credential, thereby reducing the risk of leakage of the plaintext password credential without the help of general third-party software; and the target terminal can upload the to-be-uploaded password credential to the account management system according to the preloaded password credential processing program, thereby avoiding the situation that the to-be-uploaded password credential is maliciously intercepted by third-party software, and even if the third-party software maliciously intercepts, since the to-be-uploaded password credential is encrypted by the preloaded password credential processing program and has a special data format, the third-party software is difficult to crack the plaintext password credential, that is, the password credential circulation protection method of the present application helps to realize the minimum authorized access of the password credential in the account management system between the server and the client, that is, only the bound authorized terminal can access the password credential that has been authorized to access, thereby avoiding the risk of leakage of the password credential in the circulation process, and helping to reduce the risk of leakage of the plaintext password.

[0056] In one embodiment, determining the target processing strategy corresponding to the type of the password credential circulation request comprises: when the type of the password credential circulation request is a password credential download request, determining that the target processing strategy is to identify the identifier of the target terminal, and determining the corresponding encryption public key according to the identifier of the target terminal, encrypting the password credential corresponding to the target terminal according to the encryption public key to obtain an encrypted password credential, and sending the encrypted password credential to the target terminal, so that the target terminal obtains the plaintext password credential according to the password credential processing program.

[0057] The identifier of the target terminal is used to represent the uniqueness of the identity of the target terminal, and the identifier of the target terminal includes but is not limited to a digital number, a letter label, and a combination form thereof. In the embodiment, the identifier of the target terminal is taken as an example in the form of a combination of a digital number and a letter label, for example, the identifier of a certain target terminal is "M001", which represents that the target terminal is an administrator terminal, and the digital number of the administrator terminal is 001; for another example, the identifier of a certain target terminal is "U001", which represents that the target terminal is a normal user terminal, and the digital number of the user terminal is 001. Each target terminal is pre-equipped with a unique public key and a private key, the public key is stored in the server of the account management system, and the private key is stored in the local system of the target terminal. The function of the public key is to encrypt the password credential, so as to ensure that the data can only be decrypted and used by the terminal with the corresponding private key in the transmission process. The function of the private key is to decrypt the data encrypted by the public key to obtain the plaintext information, and only the terminal with the corresponding private key can decrypt and use the data encrypted by the public key.

[0058] Specifically, referring to Figure 3The application scenario of the password client registration is shown. When each terminal in the enterprise user internally registers the client, the client generates a unique user public key and private key for each terminal corresponding user, which is used for password credential encryption, and ensures that the encrypted file can only be accessed by a specific local client.

[0059] An exemplary encrypted password credential obtained by using the RSA algorithm to encrypt the plaintext password credential "credential-Id:M001; password:123456" is "w5ZdK9R2F+DkOyLpW1nJq6G7X3vY9T4ZmH2U5JnL6M3K9N4T8Y1D3E5F7G8I9J0L2M4N6P7Q8R9S0T1V2W3X4Y5Z6A7B8C9D0E1F2G3H4I5J6K7L8M9N0O1P2Q3R4S5T6U7V8W9X0Y1Z2A3B4C5D6E7F8G9H0I1J2K3L4M5N6O7P8Q9R0S1T2U3V4W5X6Y7Z8A9B0C1D2E3F4G5H6I7J8K9L0M1N2O3P4Q5R6S7T8U9V0W1X2Y3Z4A5B6C7D8E9F0G1H2I3J4K5L6M7N8O9P0Q1R2S3".

[0060] In one embodiment, as Figure 4 shown, the method further comprises:

[0061] Step 402, in the preset administrator terminal identification table, find and determine whether the identification of the target terminal exists.

[0062] Wherein, the preset administrator terminal identification table is preset according to the identification of the terminal of the account management system which has been bound, and the administrator terminal identification is obtained by identifying the identification of the target terminal.

[0063] Exemplarily, the identification of a certain target terminal in the above example is "M001", when the identification of the target terminal contains the character M, it means that the target terminal is an administrator terminal; and when the identification of the target terminal contains the character U, it means that the target terminal is a normal user terminal.

[0064] Step 404, in the case that the identification of the target terminal exists in the administrator terminal identification table, determine the corresponding encryption public key according to the identification of the target terminal.

[0065] As can be seen from the above, each target terminal has its own unique encryption public key and private key. When the target terminal's identifier is in the administrator terminal identification table, it indicates that the target terminal is an administrator terminal. When the target terminal's identifier is not in the administrator terminal identification table, it indicates that the target terminal is a normal user terminal.

[0066] Specifically, in order to ensure minimum authorization for access to the entire management process, that is, only people or applications with specific access rights can access the password credentials that have been authorized to access, this embodiment can set the account management system to only receive password credential download requests issued by the administrator terminal to ensure the secure download of password credentials within the enterprise users.

[0067] For example, refer to Figure 5 The application scenario of password credential download shown in the figure is that when a company's IT administrator needs to download the password credentials of specific users (some ordinary users) for configuring the company's business system, the specific operations are as follows:

[0068] Administrator requests download: The administrator accesses the company's account management system through a browser, enters the user name and password to log in, and chooses to download the password credentials of a specific user;

[0069] Server authentication and generation of encrypted credentials: The account management system server first verifies the administrator's identity and permissions. For example, when it identifies a target terminal as "M001," it determines that the target terminal is an administrator terminal with download permission. After confirming that it has the right to download the user credentials, it generates an encrypted password credential. This credential is bound to the administrator's local system and can only be decrypted by the administrator's specific client.

[0070] Client-side decryption: The administrator's client uses a specific encryption key in the pre-loaded password credential handler to decrypt the downloaded encrypted password credential and display the plaintext password in memory. The plaintext password is not persistently stored on the local system but is only temporarily saved in memory. When the client closes the password credential handler, the plaintext password credential temporarily stored in memory is automatically cleared to prevent the plaintext password credential from being maliciously stolen.

[0071] Step 406: If the target terminal identifier does not exist in the bound terminal identifier table, output warning information of an illegal download request.

[0072] The alarm information of the illegal download request can include an alarm title, an alarm detailed description, a timestamp, a request source, a request type, and a processing suggestion, etc. The alarm information of the illegal download request can be recorded in a system log for subsequent analysis, can be output on a console or a command interface of the target terminal, can be sent through an email for timely processing by relevant personnel, and can also be prompted to a user in the form of a pop-up window or a dialog box on a user interface.

[0073] For example, when the identity of a target terminal is identified as "U001", it is determined that the target terminal is a normal user terminal without download permission, and the following alarm information of the illegal download request is output:

[0074] Alarm title: illegal download request alarm

[0075] Alarm detailed description: the target terminal identity is not found in the binding terminal identity table, and the request is rejected.

[0076] Timestamp: 2024-11-18T01:50:03.877Z

[0077] Request source: 192.168.1.100

[0078] Request type: password credential download request

[0079] Processing suggestion: please check whether the terminal identity is correct, or contact the administrator for terminal binding.

[0080] In this embodiment, according to the identity of the target terminal sending the password credential download request, it is determined whether the target terminal is an administrator terminal. Only in the case that the target terminal is an administrator terminal, the account management system responds to the password credential download request of the terminal, thereby ensuring the minimum authorization of the entire management process, i.e. only a person or application with specific access permission can access the password credential that has been authorized to access, thereby ensuring the security of the password credential download.

[0081] In one embodiment, as shown in Figure 6 , the target processing strategy corresponding to the type of the password credential circulation request is determined, and further includes:

[0082] Step 602, when the type of the password credential circulation request is a password credential upload request, the target processing strategy is determined to identify the identity of the target terminal, and in the case that the identity of the target terminal is determined to be an administrator identity, the to-be-uploaded password credential in the password credential upload request is obtained, and the to-be-uploaded password credential is decrypted according to a preset first decryption key to obtain the plaintext to-be-uploaded password credential.

[0083] The to-be-uploaded password credential is a password credential encrypted by the administrator terminal using a specific encryption key on a password credential file edited in the local system, the specific encryption key is generated by a password credential processing program loaded by the administrator terminal and stored in the local environment of the client, ensuring that the key is only accessed when encryption operation is required. The preset first decryption key is a specific decryption key stored on the server, only the server can decrypt and upload the password credential.

[0084] For example, referring to the application scenario of password credential uploading shown in Figure 7 When a company needs to update an online password credential and an IT administrator is responsible for editing and uploading a new password credential, the specific operations are as follows:

[0085] Administrator editing and encryption: The administrator encrypts the newly edited password credential file locally using a specific encryption key, and only the server has the decryption key;

[0086] Upload encrypted credentials: The administrator uploads the encrypted password credentials to the account management system server through the browser;

[0087] Server authentication and decryption: The server verifies the identity and authority of the administrator, confirms that the administrator has the right to upload the password credential, and then decrypts and saves the new password credential using a specific key.

[0088] In step 604, if it is determined that the identifier of the target terminal is a normal user identifier, an alarm information of illegal upload request is output.

[0089] The alarm information of illegal upload request, like the alarm information of illegal download request, can also include alarm title, alarm detailed description, timestamp, request source, request type, and processing suggestion. The alarm information of illegal upload request can be recorded in the system log for subsequent analysis, can be output on the console or the command interface of the target terminal, can be sent through email for timely processing by relevant personnel, and can also be prompted to the user in the form of a pop-up window or a dialog box on the user interface.

[0090] For example, when it is identified that the identifier of a target terminal is "U001", it is determined that the target terminal is a normal user terminal without download authority, and the following alarm information of illegal upload request is output:

[0091] Alarm title: illegal upload request alarm

[0092] Alarm detailed description: the target terminal identifier is not found in the bound terminal identifier table, and the request is rejected.

[0093] Timestamp: 2024-11-17T01:50:03.877Z

[0094] Request source: 192.168.1.100

[0095] Request type: password credential upload request

[0096] Processing suggestion: please check whether the terminal identification is correct, or contact the administrator for terminal binding.

[0097] In this embodiment, according to the identification of the target terminal sending the password credential upload request, it is determined whether the target terminal is an administrator terminal, and only in the case that the target terminal is an administrator terminal, the account management system responds to the password credential upload request of the terminal, thereby ensuring the minimum authorization of the entire management process, that is, only a person or application with specific access permission can access the password credential that has been authorized to access, and further ensuring the security of the password credential upload.

[0098] In one embodiment, the target terminal includes an administrator terminal and a normal user terminal, and determining the target processing strategy corresponding to the type of the password credential circulation request further includes:

[0099] When the password credential circulation request is a password credential sharing request, the target processing strategy is determined to be obtaining the encrypted shared password credential in the password credential sharing request, and decrypting the encrypted shared password credential according to a preset second decryption key to obtain the plaintext shared password credential, wherein the encrypted shared password credential is obtained by encrypting the shared credential from the normal user terminal according to a preset first encryption key, and then re-encrypting by the administrator terminal according to a preset second encryption key.

[0100] The preset first encryption key is a key used by the normal user terminal to encrypt the key credential, which is preset by the local system of the normal user terminal and used when the normal user terminal encrypts the password credential, so as to ensure the confidentiality of the password credential in the transmission process. The preset second encryption key is a key used by the administrator terminal to re-encrypt the password credential, which is also preset by the local system of the administrator terminal, so as to ensure the confidentiality of the password credential when uploaded to the server. The preset second decryption key is a key used by the server to decrypt the password credential re-encrypted by the administrator terminal, and the preset second decryption key is stored in the server.

[0101] For example, referring to the application scenario of password credential sharing shown in FIG. 8, when a project team member needs to share the password credential of an online service with a project manager for subsequent operation, the specific operation is as follows: Figure 8 User encrypted credential: the project team member encrypts the locally edited password credential file using a specific encryption key, and only the project manager (i.e., the administrator) can decrypt it;

[0102] ​

[0103] User shares encrypted password credentials: project team members share encrypted password credential files to the project manager;

[0104] Manager decrypts and re-encrypts: after the project manager receives the encrypted files, the project manager decrypts them using the project manager's private key and re-encrypts the password credentials, and then uploads the re-encrypted password credentials to the account management system server through a browser.

[0105] In this embodiment, the password credentials uploaded by the ordinary user terminal are accessed and uploaded to the account management system through the decryption and re-encryption process of the administrator terminal, so that only authorized personnel can access the uploaded password credentials, thereby reducing the risk of password credential leakage during uploading.

[0106] The above method of the present application determines the corresponding target processing strategy according to the type of the recognized password credential circulation request, so that the target terminal decrypts the encrypted password credentials according to the preloaded password credential processing program to obtain plaintext password credentials, thereby reducing the risk of plaintext password credential leakage without the help of general third-party software for decryption; and the target terminal uploads the password credentials to be uploaded to the account management system according to the preloaded password credential processing program, thereby avoiding the situation that the password credentials to be uploaded are maliciously intercepted by third-party software, and even if the third-party software maliciously intercepts, since the password credentials to be uploaded are encrypted by the preloaded password credential processing program and have a special data format, the third software is difficult to crack to obtain plaintext password credentials, that is, the password credential circulation protection method of the present application helps to realize the minimum authorized access of password credentials in the account management system between the server and the client, that is, only the authorized terminal can access the password credentials that have been authorized to access, thereby avoiding the risk of password credential leakage during circulation, and helping to reduce the risk of plaintext password leakage.

[0107] In a second aspect, the embodiments of the present application also provide a password credential circulation protection method, which is suitable for a target terminal that has been bound to an account management system and preloaded with a password credential processing program, and the method comprises:

[0108] According to the password credential processing program, the encrypted password credentials are decrypted to obtain plaintext password credentials, or the password credentials are uploaded to the account management system.

[0109] Among them, the target terminal includes an administrator terminal and an ordinary user terminal, and the authority level of the administrator terminal is higher than that of the ordinary user terminal.

[0110] Specifically, the administrator terminal decrypts the encrypted password credential according to the password credential processing program to obtain the plaintext password credential, or uploads the password credential to the account management system to ensure the security of the password credential during downloading.

[0111] In this embodiment, the plaintext password credential obtained by decrypting the encrypted password credential by the password credential processing program is not easy to be leaked.

[0112] In one embodiment, the method further comprises: the administrator terminal sending the to-be-uploaded password credential to the account management system.

[0113] According to the above content, it can be known that the to-be-uploaded password credential is the password credential obtained by encrypting the password credential file edited in the local system by the administrator terminal using a specific encryption key, the specific encryption key is generated by the password credential processing program loaded by the administrator terminal and stored in the local environment of the client, and the key is ensured to be accessed only when encryption operation is needed.

[0114] In this embodiment, the administrator terminal sends the uploaded password credential to the account management system, which helps to ensure the security and confidentiality of the password credential during uploading and reduce the risk of leakage.

[0115] In one embodiment, as shown in Figure 9 the method further comprises:

[0116] Step 902, the ordinary user terminal encrypts the shared password credential according to a preset first encryption key to obtain an encrypted shared credential.

[0117] Step 904, the encrypted shared credential is sent to the administrator terminal, the administrator terminal decrypts the encrypted shared credential and encrypts it again according to a preset second encryption key to obtain an encrypted shared password credential.

[0118] Step 906, the administrator terminal sends the encrypted shared password credential to the account management system.

[0119] In this embodiment, the administrator terminal decrypts and re-encrypts the password credential uploaded by the ordinary user terminal to access and upload the password credential to the account management system uniformly, so as to ensure that only authorized personnel can access the uploaded password credential, thereby reducing the risk of leakage of the password credential during uploading.

[0120] It should be understood that although the steps in the flowcharts involved in the embodiments described above are shown in sequence according to the arrows, the steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, the execution of the steps is not strictly limited in sequence, and the steps can be executed in other orders. Moreover, at least some of the steps in the flowcharts involved in the embodiments described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of the steps or stages is not necessarily sequential, but can be alternately or alternately executed with at least part of other steps or steps or stages in other steps.

[0121] Based on the same inventive concept, the embodiments of the present application also provide a password credential flow protection system for implementing the above-mentioned password credential flow protection method. The problem-solving implementation scheme provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more password credential flow protection system embodiments provided below can refer to the limitations of the password credential flow protection method described above, and will not be repeated here.

[0122] In one embodiment, as shown in Figure 10 a password credential flow protection system is provided, comprising an account management system 1002 and a target terminal 1004, wherein:

[0123] The account management system 1002 is configured to receive a password credential flow request of a target terminal, and identify the type of the password credential flow request; and configured to determine a target processing strategy corresponding to the type of the password credential flow request according to a preset mapping relationship table of password credential flow request types and password credential processing strategies, and execute the target processing strategy.

[0124] The target terminal 1004 is configured to decrypt the encrypted password credential to obtain the plaintext password credential according to the preloaded password credential processing program, or upload the password credential to be uploaded to the account management system.

[0125] In one embodiment, the account management system 1002 is further configured to: when the type of the password credential flow request is a password credential download request, determine that the target processing strategy is to identify the identity of the target terminal, and determine the corresponding encryption public key according to the identity of the target terminal, encrypt the password credential corresponding to the target terminal according to the encryption public key to obtain the encrypted password credential, and send the encrypted password credential to the target terminal, so that the target terminal obtains the plaintext password credential according to the password credential processing program.

[0126] In an embodiment, the account management system 1002 is further configured to: in the preset administrator terminal identifier table, search and determine whether the identifier of the target terminal exists; in the case where the identifier of the target terminal exists in the administrator terminal identifier table, determine the corresponding encryption public key according to the identifier of the target terminal; and in the case where the identifier of the target terminal does not exist in the binding terminal identifier table, output alarm information of an illegal download request.

[0127] In an embodiment, the account management system 1002 is further configured to: when the type of the password credential circulation request is a password credential upload request, determine that the target processing strategy is to identify the identifier of the target terminal, and in the case where it is determined that the identifier of the target terminal is an administrator identifier, obtain the to-be-uploaded password credential in the password credential upload request, and decrypt the to-be-uploaded password credential according to a preset first decryption key to obtain the plaintext to-be-uploaded password credential; and in the case where it is determined that the identifier of the target terminal is a normal user identifier, output alarm information of an illegal upload request.

[0128] In an embodiment, the account management system 1002 is further configured to: when the password credential circulation request is a password credential sharing request, determine that the target processing strategy is to obtain the encrypted shared password credential in the password credential sharing request, and decrypt the encrypted shared password credential according to a preset second decryption key to obtain the plaintext shared password credential, wherein the encrypted shared password credential is obtained by encrypting the shared credential from the normal user terminal according to a preset first encryption key, decrypting by the administrator terminal, and then encrypting again according to the preset second encryption key.

[0129] The above-mentioned modules in the password credential circulation protection system can be realized by software, hardware, or a combination thereof, in whole or in part. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to call and execute the operations corresponding to the above-mentioned modules by the processor.

[0130] In an embodiment, a computer device is provided, which can be a server, and the internal structure diagram thereof can be as shown in FIG. 8. The computer device includes a processor, a memory, and a network interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The database of the computer device is configured to store private key data of a user and the like. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement the above-mentioned password credential circulation protection method of the first aspect. Figure 11 In an embodiment, a computer device is provided, which can be a server, and the internal structure diagram thereof can be as shown in FIG. 8. The computer device includes a processor, a memory, and a network interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The database of the computer device is configured to store private key data of a user and the like. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement the above-mentioned password credential circulation protection method of the first aspect.

[0131] In an embodiment, a computer device is provided, which can be a terminal, and an internal structure diagram thereof can be as shown in FIG. 1. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is configured to perform wired or wireless communication with an external terminal. The wireless communication can be achieved through WIFI, mobile cellular network, NFC (Near Field Communication) or other technologies. The computer program is executed by the processor to implement the method for protecting password credential flow provided in the second aspect. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device, or an external keyboard, touchpad or mouse, etc. Figure 12

[0132] Those skilled in the art can understand that the structure shown in FIG. 1 is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. Specifically, the computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components. Figure 11 Figure 12

[0133] In an embodiment, a computer device is provided, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the method embodiments.

[0134] In an embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the steps in the method embodiments.

[0135] In an embodiment, a computer program product is provided, which includes a computer program. The computer program is executed by a processor to implement the steps in the method embodiments.

[0136] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties. ​​​

[0137] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0138] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0139] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A password credential transfer protection method, applicable to an account management system, wherein the account management system stores multiple password credentials, each of which corresponds to multiple target terminals bound to the account management system, and is characterized in that: The method comprises: receiving a password credential transfer request from a target terminal and identifying a type of the password credential transfer request, wherein the target terminal includes an administrator terminal and a common user terminal; Determining a target processing strategy corresponding to the type of password credential transfer request based on a preset mapping relationship table between password credential transfer request types and password credential processing strategies; executing the target processing strategy so that the target terminal decrypts the encrypted password credential according to a pre-loaded password credential processing program to obtain a plaintext password credential, or uploads the password credential to be uploaded to the account management system; the pre-loaded password credential processing program is an application developed internally by the enterprise user specifically for encrypting and decrypting password credentials, and the pre-loaded password credential processing program is not a third-party program; The determining of a target processing strategy corresponding to the type of the password credential transfer request includes: When the password credential transfer request is a password credential sharing request, the target processing strategy is determined to obtain the encrypted shared password credential in the password credential sharing request, and decrypt the encrypted shared password credential according to the preset second decryption key to obtain the plaintext shared password credential, wherein the encrypted shared password credential is obtained by decrypting the encrypted shared credential obtained from the ordinary user terminal according to the preset first encryption key and then encrypting it again according to the preset second encryption key by the administrator terminal.

2. The method according to claim 1, characterized in that The determining of a target processing strategy corresponding to the type of the password credential transfer request includes: When the type of the password credential transfer request is a password credential download request, the target processing strategy is determined to identify the identifier of the target terminal, and the corresponding encryption public key is determined based on the identifier of the target terminal. The password credential corresponding to the target terminal is encrypted based on the encryption public key to obtain the encrypted password credential, and the encrypted password credential is sent to the target terminal so that the target terminal obtains the plaintext password credential according to the password credential processing procedure.

3. The method according to claim 2, characterized in that The method further comprises: Searching and determining whether the identifier of the target terminal exists in a preset administrator terminal identifier table; If the identifier of the target terminal exists in the administrator terminal identifier table, determining a corresponding encryption public key according to the identifier of the target terminal; In the case that the identifier of the target terminal does not exist in the administrator terminal identifier table, an alarm message of an illegal download request is output.

4. The method according to claim 1, wherein The determining of a target processing strategy corresponding to the type of the password credential transfer request further includes: When the type of the password credential transfer request is a password credential upload request, determining that the target processing strategy is to identify the identifier of the target terminal, and if it is determined that the identifier of the target terminal is an administrator identifier, obtaining the password credential to be uploaded in the password credential upload request, and decrypting the password credential to be uploaded according to a preset first decryption key to obtain a plaintext password credential to be uploaded; When it is determined that the identifier of the target terminal is a common user identifier, warning information of an illegal upload request is output.

5. The method according to claim 1, wherein The preset first encryption key is the key used by the ordinary user terminal to encrypt the password certificate, and the preset first encryption key is preset by the local system; the preset second encryption key is the key used by the administrator terminal to re-encrypt the password certificate, and the preset second encryption key is preset by the local system.

6. The method according to claim 1, characterized in that Each of the target terminals is pre-equipped with a unique public key and private key. The public key is stored in the server of the account management system, and the private key is stored in the local system of the target terminal.

7. A password credential transfer protection system, characterized in that: The system comprises: An account management system, configured to receive a password credential transfer request from a target terminal and identify the type of the password credential transfer request, the target terminal including an administrator terminal and an ordinary user terminal; and to determine, based on a preset mapping relationship table between password credential transfer request types and password credential processing policies, a target processing policy corresponding to the type of the password credential transfer request and execute the target processing policy; the determination of the target processing policy corresponding to the type of the password credential transfer request comprising: when the password credential transfer request is a password credential sharing request, determining the target processing policy to obtain the encrypted shared password credential in the password credential sharing request, and decrypting the encrypted shared password credential according to a preset second decryption key to obtain a plaintext shared password credential, wherein the encrypted shared password credential is obtained by decrypting the encrypted shared credential obtained from the ordinary user terminal according to a preset first encryption key, and then encrypting it again according to a preset second encryption key; The target terminal is used to decrypt the encrypted password credential according to a pre-loaded password credential processing program to obtain the plaintext password credential, or to upload the password credential to be uploaded to the account management system; the pre-loaded password credential processing program is an application developed internally by the enterprise user specifically for encrypting and decrypting password credentials, and the pre-loaded password credential processing program is not a third-party program.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images