Account application method, electronic device, storage medium and program product

Abstract

The embodiment of the invention provides an account application method, electronic equipment, a storage medium and a program product. The method comprises the following steps: in response to received account application information, based on a change event in the account application information, determining that the account application information satisfies a corresponding verification condition, then based on the account application information, generating a corresponding auditing request, sending the auditing request to a corresponding auditing account, and then in response to received change authorization information, sending the auditing request to the corresponding auditing account. And carrying out change processing on the target account corresponding to the account application information. According to the method, the problems of low operation and maintenance efficiency and high management cost in the prior art are solved, and the safety of the system and the overall efficiency of operation and maintenance management are improved.

Description

Technical Field

[0001] The present application relates to the fields of system management technology and data analysis technology, and in particular to an account application method, electronic equipment, storage medium and program product. Background Art

[0002] In enterprises such as banks that consist of a large number of subsidiaries, a large number of operation and maintenance personnel are usually deployed to operate and maintain various parts of the enterprise system. Since operation and maintenance often involve multiple departments and multiple types of production resources, different resources require accounts to log in before operation and maintenance operations can be carried out. Therefore, the operation and maintenance permissions of different accounts are different, forming a large and complex IT operation and maintenance account system. How to manage the permissions and permission changes of different accounts is crucial. Improper management can easily lead to account abuse or misoperation that causes risks.

[0003] In the prior art, operation and maintenance personnel's application for permission to use a specific operation and maintenance account usually relies solely on management personnel's review. Since the review work may involve operation and maintenance personnel from different departments and subsidiaries, the review mechanism is very cumbersome and may lead to problems such as low operation and maintenance efficiency, untimely information synchronization, manual errors, and increased management costs. Summary of the invention

[0004] The embodiments of the present application provide an account application method, an electronic device, a storage medium, and a program product to achieve the effect of effectively managing account applications.

[0005] In a first aspect, an embodiment of the present application provides an account application method, the method comprising:

[0006] In response to the received account application information, based on the change event in the account application information, determining that the account application information meets the corresponding verification condition, wherein the account application information includes the application account, the target account and the corresponding change event, the account application information includes the account authority of the application account to be changed and / or the application setting type authority account, and the change event is used to indicate the event that triggers the application account to make an account application;

[0007] Generate a corresponding review request based on the account application information, and send the review request to the corresponding review account, wherein the review account is used to return the corresponding change authorization information based on the review request;

[0008] In response to the received change authorization information, a change process is performed on the target account corresponding to the account application information.

[0009] In a second aspect, an embodiment of the present application provides an account application device, comprising:

[0010] A verification module, configured to respond to the received account application information and determine whether the account application information satisfies a corresponding verification condition, wherein the account application information includes an application account, a target account, and a corresponding change event, the account application information includes changing the account authority of the application account and / or applying for setting a type of authority account, and the change event is used to indicate an event that triggers the application account to make an account application;

[0011] A transmission module, used to generate a corresponding review request based on the account application information, and send the review request to the corresponding review account, wherein the review account is used to return the corresponding change authorization information based on the review request;

[0012] The processing module is used to perform change processing on the target account corresponding to the account application information in response to the received change authorization information.

[0013] In a third aspect, an embodiment of the present application provides a control device, including: a memory, a processor;

[0014] The memory stores computer-executable instructions;

[0015] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0016] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0017] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0018] The account application method, electronic device, storage medium and program product provided by the embodiment of the present disclosure respond to the received account application information, determine that the account application information meets the corresponding verification condition based on the change event in the account application information, and then generate a corresponding audit request based on the account application information, and send the audit request to the corresponding audit account, and then respond to the received change authorization information to change the target account corresponding to the account application information. Thus, by responding to the account application information and verifying based on the change event, the necessity and compliance of the account change are ensured, and the tediousness and error risk of manual audit are reduced. Secondly, the audit request is generated and sent to the corresponding audit account, which realizes the automation and standardization of the audit process, ensures timely synchronization of information, and reduces the complexity of cross-department and subsidiary audits. Finally, by receiving the change authorization information and automatically processing the account application, the permission management process is simplified, and the management cost and the risk of misoperation are reduced. This solution effectively solves the problems of low operation and maintenance efficiency and high management cost in the prior art, and improves the security of the system and the overall effectiveness of operation and maintenance management. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0020] Figure 1 An application scenario diagram of the account application method provided in the embodiment of the present disclosure;

[0021] Figure 2 A flowchart of an account application method provided by an embodiment of the present disclosure;

[0022] Figure 3a A flowchart of an account application method provided by another embodiment of the present disclosure;

[0023] Figure 3b for Figure 3a Schematic diagram of the cooperation relationship between the account management system and the corresponding platform in different scenarios provided by the illustrated embodiment;

[0024] Figure 4 A schematic diagram of the structure of an account application device provided by another embodiment of the present disclosure;

[0025] Figure 5 A schematic diagram of the structure of a control device provided in one embodiment of the present disclosure.

[0026] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0027] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0028] Figure 1 A schematic diagram of the application scenario of the account application method provided for this application, such as Figure 1 As shown, during the account application process of the operation and maintenance account, the user sends the account application information to the account management system 110 through the operation and maintenance terminal 100. After the account management system 110 verifies the account application information, it will send the review information to the review account terminal 120, receive the authorization information returned by the review account terminal 120, and return the account application information corresponding to the target account to the operation and maintenance terminal 100 to complete the account application process.

[0029] It should be noted that Figure 1 In the scenario shown, only one or a specific number of operation and maintenance terminals, account management systems, and account audit terminals are used as examples for illustration, but the present disclosure is not limited to this. In other words, the number of operation and maintenance terminals, account management systems, and account audit terminals can be arbitrary.

[0030] In enterprises such as banks that consist of a large number of subsidiaries, a large number of operation and maintenance personnel are usually deployed to operate and maintain various parts of the enterprise system. Since operation and maintenance often involve multiple departments and multiple types of production resources, different resources require accounts to log in before operation and maintenance operations can be carried out. Therefore, the operation and maintenance permissions of different accounts are different, forming a large and complex IT operation and maintenance account system. How to manage the permissions and permission changes of different accounts is crucial. Improper management can easily lead to account abuse or misoperation that causes risks.

[0031] In the prior art, the permission requirements for each operation and maintenance account are different, resulting in a large and complicated permission management system. When an operation and maintenance account needs to change permissions or apply for a new account, the administrator needs to manually review the account application information of each account, which is not only time-consuming and labor-intensive, but also prone to human errors. In addition, permission changes involve multiple systems and platforms, and untimely information synchronization may increase the risk of permission abuse or misoperation.

[0032] On the other hand, since the existing system relies on manual review, the review process often involves multiple departments and subsidiaries, and the information transmission and synchronization are inefficient, resulting in delayed and opaque permission changes. It is difficult for administrators to promptly discover unreasonable or potential risks in permission configuration. In addition, the consequences of permission abuse or misoperation may only appear after the problem occurs, which increases the difficulty of problem discovery. This makes it difficult to solve the problem of low operation and maintenance efficiency.

[0033] The account application method provided in this application responds to the account application information and verifies its necessity, then automatically generates an audit request and passes it to the audit account. The audit account returns authorization information according to the rules to reduce manual errors. Finally, the system automatically executes permission changes to ensure fast and accurate processing. This solution optimizes operation and maintenance account permission management through automated processes, solves complexity and inefficiency problems, improves the automation and efficiency of permission management, and enhances system security and operation and maintenance efficiency.

[0034] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0035] Figure 2 Schematic diagram of the account application process provided for this application Figure 1 ,like Figure 2 As shown, the method includes:

[0036] S201. In response to received account application information, determine whether the account application information satisfies a corresponding verification condition based on a change event in the account application information.

[0037] The account application information includes the application account, the target account and the corresponding change event. The account application information includes the account authority of the application account and / or the application setting type authority account. The change event is used to indicate the event that triggers the application account to make an account application.

[0038] Specifically, this embodiment is used to illustrate the overall implementation process of the account application method.

[0039] The executor of the embodiment of the present disclosure may be a system that manages all operation and maintenance accounts of the entire enterprise, such as an account management system, or a system within other enterprises that can manage user accounts and change their permissions, which is not limited here.

[0040] Account application information mainly comes from operation and maintenance personnel. If there is a problem that cannot be viewed or processed by the current account permissions (for example, a business manager's system cannot successfully process certain businesses, and the business manager has higher confidentiality permissions than ordinary employees, so the operation and maintenance personnel need to obtain an operation and maintenance account with higher permissions to process the business manager's system), or the system as a whole fails, resulting in the need for the highest permission account (or privileged account) to debug the system, it is necessary to initiate account application information to handle the corresponding business.

[0041] Account application information is a request submitted by an operation and maintenance personnel, which usually includes the application for an account, the specific event that leads to the need for an account change (i.e., a change event), and specifies the account to be obtained (or the account with the target permissions, i.e., the target account). Account application information can be to create a temporary privileged account and provide it to the operation and maintenance personnel (in some scenarios, it can also be to temporarily adjust the permissions of the operation and maintenance personnel's current account).

[0042] A change event is a specific reason or condition that triggers a permission change. In addition to system anomalies, functional failures, and other situations, it may also be caused by project requirements (such as the need to conduct regular spot checks on the entire system).

[0043] Specific verification conditions can be used to determine whether the application account and the target account comply with pre-configured rules (such as account permissions cannot be changed across regions or departments), or if the change event does not belong to the event type restricted for account application (such as the need to use a certain software, this type of operation itself does not require changing the permissions of the operation and maintenance account to complete), to determine the legitimacy and necessity of the change application.

[0044] After receiving the account application information, the system will analyze the change event in the application and automatically judge it according to the preset verification conditions. The verification conditions may include one or more conditions such as the current permission status of the application account and the rationality of the change event. Usually, only applications that meet all the verification conditions will be approved to proceed to the next step.

[0045] Through automated verification, unnecessary manual intervention is reduced, ensuring the compliance and necessity of the application process, improving processing efficiency and reducing the possibility of human error.

[0046] S202: Generate a corresponding audit request based on the account application information, and send the audit request to the corresponding audit account.

[0047] The audit account is used to return the corresponding change authorization information based on the audit request.

[0048] Specifically, the review request is request information generated by the system according to the change details in the received account application information (including the application account, change event and target account in the account application information), and sent to the review account for approval.

[0049] The audit account is the account responsible for receiving audit requests and approving permission changes. It is usually the account of the administrator who manages the operation and maintenance account, or the account of the superior operation and maintenance personnel.

[0050] After confirming that the change application meets the verification conditions, the system will automatically generate an audit request containing the change details. The audit request can be sent to a pre-configured designated audit account through a secure channel within the system (corresponding to each operation and maintenance account, the corresponding audit account is usually pre-configured, and the operation and maintenance account does not need to manually select the audit account) to ensure timely and accurate transmission of information.

[0051] As a result, the existing manual forwarding review process can be transformed into a standardized automatic review process, reducing cross-departmental communication barriers, ensuring information synchronization, and improving review efficiency and accuracy.

[0052] S203: In response to the received change authorization information, change the target account corresponding to the account application information.

[0053] Specifically, the change authorization information is the result returned by the audit account based on the audit request, indicating whether to approve the permission change. The audit account is usually audited manually, or it can be automatically completed by a system configured with corresponding audit rules.

[0054] The change process is that the system performs specific permission adjustment operations according to the authorization information, that is, sends the login information of a privileged temporary account to the application account.

[0055] In specific implementation, after receiving the change authorization information, the system will automatically change the permissions of the relevant accounts (for example, the account change application may include the application for changing the permissions of multiple accounts at the same time, not just the application for changing the permissions of a single account). Change processing includes updating the permission configuration to reflect the new authorization status and ensuring that the applying account obtains or loses the corresponding permissions.

[0056] This ensures that permission changes are executed quickly, reduces the risk of delays or errors that may occur when manually changing permissions, and improves system security and operation and maintenance efficiency. Through automated processing, the permission management process is simplified and the overall effectiveness of the system is enhanced.

[0057] The account application method provided in the embodiment of the present application determines that the account application information meets the corresponding verification conditions based on the change event in the account application information in response to the received account application information, and then generates a corresponding audit request based on the account application information, and sends the audit request to the corresponding audit account, and then responds to the received change authorization information to change the target account corresponding to the account application information. Thus, by responding to the account application information and verifying based on the change event, the necessity and compliance of the change are ensured, and the tediousness and error risk of manual audit are reduced. Secondly, the audit request is generated and sent to the corresponding audit account, which realizes the automation and standardization of the audit process, ensures timely synchronization of information, and reduces the complexity of cross-department and subsidiary audits. Finally, by receiving the change authorization information and automatically processing the account application, the permission management process is simplified, and the management cost and the risk of misoperation are reduced. This solution effectively solves the problems of low operation and maintenance efficiency and high management cost in the prior art, and improves the security of the system and the overall effectiveness of operation and maintenance management.

[0058] Figure 3a The account application process provided for this application Figure 2 ,like Figure 3a As shown, in this embodiment Figure 2 Based on the embodiment, the whole process of the account application method is further described in detail. The method includes:

[0059] S301: In response to received account application information, determine that the current account management system has not received an alarm event.

[0060] Specifically, before receiving the account application information, it is necessary to first configure the operation and maintenance accounts and their management rules in the account management system, so as to allocate corresponding permissions, applicable account permissions, applicable privileged accounts and other information to each operation and maintenance account, so as to avoid abnormal permission allocation across departments and regions, which affects the effectiveness of account management.

[0061] In some embodiments, the account management system configures the corresponding rules between the operation and maintenance account and the account application information based on the following principles:

[0062] Principle 1: Principle of hierarchical management: The authority scope of different accounts shall be divided according to the enterprise organizational structure and functional departments. The user administrator of the upper level shall be responsible for the establishment of the organizational structure and user administrator of the lower level. Accounts of the same user administrator department can only be responsible for the operation and maintenance resources, operation and maintenance accounts, operation and maintenance personnel role settings, and authorization processes within the unit at the same level, and cannot be managed across units or levels.

[0063] Principle 2: Application on demand and principle of minimum authorization: Users who initiate account application information can apply to change specific account permissions or apply for a new temporary account (including ordinary accounts for information query and privileged accounts for emergency response or overall system processing) according to operation and maintenance needs, and the account application information needs to apply for corresponding resources based on the resources involved in this operation. Under normal circumstances, the scope of permission changes in the account permission application is not allowed to exceed the preset scope of resources allowed to be processed.

[0064] Principle 3: Separation of Duties: Users who initiate account application information apply for corresponding resource accounts according to the operation and maintenance resource categories of their departments. Different types of operation and maintenance personnel can only apply for corresponding types of permissions and accounts. For example, system operation and maintenance, network operation and maintenance, and application operation and maintenance can only apply for ordinary accounts and privileged accounts for system, network, and application resources, respectively. In general, cross-departmental and cross-line resource permissions and account applications are not allowed. Similarly, developers are not allowed to grant permissions to the above-mentioned operation and maintenance accounts in principle.

[0065] Principle 4: The principle of mutual exclusion of roles: The operation execution, authorization approval, and supervision and audit processes of the same production and operation and maintenance matter are separated, that is, the implementer (generally the applicant for authority), approver, and auditor cannot hold concurrent roles in the same production and operation and maintenance matter, thereby realizing the differences in authority and responsibilities of each role and forming a mechanism of mutual supervision and restraint between roles.

[0066] Principle 5, Principle of escalated approval: Under normal circumstances, the change operations corresponding to the account application information need to be reviewed and approved by the change review committee corresponding to the approval account, and before the account completes the permission change, the user is allowed to temporarily apply for a temporary account to use the resources involved in the change, and it must be approved by the functional group leader; in special circumstances, such as during emergency response, the change operations performed by the user have not been reviewed by the change review committee corresponding to the approval account, and the account permissions for the resource application must be approved by the next higher level administrator account (such as approval by the head of the department). In addition, in extreme scenarios, if the user needs to apply for resource account permissions across departments and lines, there will be multiple corresponding approval accounts for multi-level approval, such as the head of the department where the user is located and the head of the department where the resource is located, respectively, through the corresponding approval accounts for approval.

[0067] In the above principles, some accounts and corresponding roles are mentioned. The following describes the configuration related to account types:

[0068] The use and permission changes of accounts follow the principle of on-demand application and minimum authorization, that is, granting the minimum role permissions within the scope of responsibility according to the division of responsibilities. Among them, accounts include the following two types:

[0069] The first category is ordinary accounts. This type of account only has query permissions so that operation and maintenance personnel can query account information that their current account cannot obtain (such as) the maximum account authorization period is no more than one year.

[0070] The second category is privileged accounts. In addition to querying, these accounts also have editing permissions, that is, they have read and write permissions to handle emergency events or important temporary tasks. The authorization period for this type of account is applied according to the operation and maintenance implementation time. The maximum application time does not exceed 24 hours, and the permissions are automatically revoked after expiration. Privileged accounts can be divided into application-type (application system) privileged accounts, system-type (Linux, Windows, AIX, etc.) privileged accounts, and database-type (Oracle, MySql, GuassDB, TDSQL, etc.) privileged accounts according to the type of operation and maintenance resources.

[0071] The above description mentions the principle of mutual exclusion of roles. The following describes the configuration related to the types of roles corresponding to the account:

[0072] The first category is general roles, including applicants, approvers, and implementers, among which:

[0073] The applicant is the person who initiates the account application information. The corresponding account is the application account, that is, applying for a common account for query operations or a privileged account for read and write operations.

[0074] The approver is responsible for approving and authorizing the application initiated by the applicant, and is generally the management of the department / division / functional group.

[0075] The implementer is responsible for carrying out specific operation and maintenance operations based on the target account, usually the applicant (if the applicant applies for multiple target accounts, the implementer may not be limited to the applicant).

[0076] The second category is the audit role, which is the person who reviews and examines the operation records to audit the records related to the change operation, including whether the operation content is consistent with the change content, whether the operation time is carried out within the change time range, and whether the user role setting is reasonable.

[0077] The third category is the desensitization role, which is used to configure desensitization rules for desensitizing sensitive information in operation records.

[0078] The fourth category is the administrator role, which is used to define the mapping relationship between employees and roles based on work content and employee ranks, and to delete and modify the roles of employees who leave or transfer positions in a timely manner.

[0079] The account management system and operation resources in this embodiment correspond to the operation and maintenance account and operation and maintenance related resources, so the operation resources are described below:

[0080] Resources are divided into two types: account management system resources and configuration library resources. Account management system resources and configuration library resources maintain a nearly synchronous relationship. Configuration library resources include five sub-type resources: business application layer, virtual resource layer, platform resource layer, physical resource layer, and computer room facility layer resources, as well as the relationship between resources. Account management system resources are a subset of configuration library resources, including operating systems, databases, etc. at the platform resource layer, and application systems, application modules, etc. at the application resource layer. The resources managed in the account management system also include attribute information such as corresponding departments. According to the principle of hierarchical management, the managers of each resource are responsible for the accuracy, completeness, and consistency of the resource information within their jurisdiction.

[0081] like Figure 3b As shown in the figure, it is a schematic diagram of the cooperation relationship between the account management system and the corresponding platform in different scenarios. Figure 3b , the following is a description of the account management system and the corresponding platform:

[0082] The full name of the account management system is the unified management platform for production and operation accounts. It is a management information system that centrally manages production system accounts and passwords, and provides pre-authorization, in-process control, and post-audit support for production and operation operations. It provides role management, resource management, audit management, and account management functions.

[0083] In practical applications, the system that cooperates with the account management system may also include:

[0084] Configuration library: A system platform used to store configuration resources and the relationships between configuration resources. It ensures the timeliness and accuracy of configuration information through functions such as configuration discovery, configuration storage, configuration inspection, configuration information comparison, and configuration correction, and can provide interfaces for other platforms to consume resource information of this platform.

[0085] Monitoring platform: A system platform used to access logs, indicators and other information of application resources, infrastructure resources and platform resources, filter, convert and analyze their contents, and configure corresponding monitoring strategies. It can monitor various production resources and generate alarm information according to their abnormal status, realizing the monitoring of production and operation facilities and application systems from multiple dimensions.

[0086] Change management platform: a system platform used to provide management functions such as application, approval, review and inquiry related to daily change events.

[0087] Emergency management platform: a system platform used to link the monitoring platform to generate emergency events, conduct emergency disposal, review emergency events and other management functions for alarm information in production. When the alarm level of the monitoring platform exceeds the threshold for generating emergency events, the emergency management platform will be linked to generate emergency events.

[0088] Automated audit platform: a platform responsible for automated review of operations of users of the account management system, providing functions such as operation record review and user authority review.

[0089] Based on the above configuration rules and configuration information, the effective implementation of the account application method can be guaranteed, and the operation and maintenance accounts in the enterprise can be effectively managed.

[0090] In response to the received account application information, the system first confirms that the current account management system has not received an alarm event. It can then be determined that the account application information at this time belongs to a change scenario that needs to be reviewed and approved by the change management committee, that is, a daily change scenario.

[0091] The account application information may be for applying for a common account or a privileged account.

[0092] In some embodiments, if the operation object is a resource managed by the account management system, the applicant can initiate an account application information for a privileged account on the account management system. The application duration of the privileged account is the implementation duration of the change event, and the scope of the application resources is the target operation object in the account application information. The applicant can apply for an account of the corresponding type (application, system, database or network) according to the change operation content.

[0093] S302: Determine that the system status is normal.

[0094] Specifically, it is determined that the system state is normal, that is, it is determined that the system is currently in a daily change scenario.

[0095] At this time, the change applicant can initiate a change application by filling in the account application information in the account management system. The specific content of the account application information mainly includes the applicant's current application account, the target account of the change event (automatically generated by the account management system), the change implementation time, the implementer, the target operation resource, the change content, the fallback plan, etc. Among them, the change applicant (hereinafter referred to as the applicant) needs to log in to the application account, fill in the change implementation time period, implementer and change content of the change event in the account application information, and fill in the target operation object involved in this change according to the configuration resources in the configuration library. Otherwise, the change cannot be initiated.

[0096] In some embodiments, when the change enters the implementation stage, the above-mentioned element information generally no longer changes (if the account application information has entered the processing stage, the account management system will return the same account application information sent by the same application account to the account management system login user).

[0097] S303: Determine whether the target operation resource is a management object of the account management system.

[0098] Specifically, based on the account application information, the account management system performs resource verification on the target operation resource, that is, verifies whether the operation object belongs to the resources managed by the account management system (the corresponding concept can be found in the description of the above embodiment). If the verification fails, the next step cannot be performed; if it does, it can usually pass the verification.

[0099] S304: In response to the received account application information, determine that the account management system receives an alarm event.

[0100] Specifically, in addition to daily change scenarios, there are also emergency event handling scenarios, that is, scenarios where the account management system receives alarm events.

[0101] In this type of scenario, the handling of emergency events is based on the principle of restoring business continuity as the top priority. Users can first upgrade their application for resource account authorization and carry out emergency handling operations as soon as possible. After the emergency handling work is completed, the user completes the account application information in the account management system (such as the various other contents that need to be filled in the account application information in addition to the target operation resource and target account in the above embodiment).

[0102] The following is an explanation of the process of generating the emergency event handling scenario:

[0103] First, the monitoring platform generates corresponding alarm information when it detects abnormal conditions in the logs and indicators of the production system according to the pre-configured alarm strategy. If the alarm level exceeds the threshold for initiating an emergency event, the monitoring platform will automatically generate an emergency event through the emergency management platform (for the relevant platform, see the instructions in the previous steps).

[0104] Then, the monitoring platform will obtain the configuration resources related to the alarm event and the relationship between configuration resources from the configuration library, and synchronize the resource information involved in this emergency event to the emergency management platform.

[0105] Afterwards, the emergency management platform will generate an emergency event flag and emergency event start time for the emergency event, and synchronize this information to the account management system as an alarm event.

[0106] Therefore, when the account management system receives the account application information, it can determine whether it is currently in a state of receiving an alarm event.

[0107] S305: Determine that the system status is an abnormal status.

[0108] Specifically, based on the received alarm event, it can be determined that the system status is abnormal, and the scene and corresponding handling process of the emergency event are prepared to be entered (eg, the account application information is not required to be fully filled in at this time).

[0109] S306: Acquire alarm event information corresponding to the abnormal state.

[0110] The alarm event information includes corresponding operation resources.

[0111] Specifically, the account management system will link with the emergency management platform to verify the alarm event and the current emergency event flag to determine whether the current emergency response period is in progress.

[0112] S307: Determine that the operation resource corresponding to the alarm event information is the target operation resource in the account application information, and determine that the target operation resource belongs to a management object of the account management system.

[0113] Specifically, if the verification is passed, the account management system synchronizes the emergency management platform with the production resources related to this incident (that is, the corresponding operation resources in the alarm event information), and determines whether the production resources are resources managed by the account management system. If the production resources are managed by the account management system, the emergency event applicant can initiate a privileged account permission application for the resources involved in this emergency event, and the application duration and other information in the account application information do not need to be filled in.

[0114] S308: Determine whether the account application information meets corresponding verification conditions.

[0115] Specifically, whether in daily change scenarios or emergency event handling scenarios, it is necessary to ensure that the account change application meets the corresponding verification conditions to ensure that the change application also meets the necessary conditions (such as including the target account) under abnormal conditions.

[0116] S309: If the system status is normal, generate an audit request and send the audit request to the audit account corresponding to the application account.

[0117] Specifically, in daily change scenarios, the account management system will generate an audit request based on the account application information and transmit it to the approval account associated with the target operation resource and the application account (such as the functional group leader, change management committee, etc.). The auditor corresponding to the approval account will review whether the position of the person corresponding to the application account matches the change content. If it matches, the applicant will be authorized with a privileged account.

[0118] S310: If the system status is abnormal, generate an audit request and send the audit request to the superior audit account of the audit account corresponding to the application account.

[0119] Among them, the approval authority of the superior review account is higher than that of the review account.

[0120] Specifically, in the scenario of emergency incident handling, the applicant corresponding to the emergency incident initiates a privileged account permission application on the account management system. Since the production environment change operation performed by the implementer during the emergency period has not been reviewed and approved by the change review committee, the application needs to be approved at a higher level, that is, the superior review account (such as department management) is responsible for approving and authorizing the application.

[0121] S311. In response to the received change authorization information, a change process is performed on the target account corresponding to the account application information.

[0122] Specifically, after receiving the change authorization information, the account management system will change the target account corresponding to the account application information so that the corresponding operation and maintenance personnel can perform operations based on the target account.

[0123] S312: In response to the received notification information indicating that the change event has been processed, the application account corresponding to the account application information is recalled to the state before the application.

[0124] Specifically, the implementer carries out specific operation and maintenance operations, and the operation records will be synchronously saved in the operation log of the account management system.

[0125] When the implementer completes the change operation, he / she will click the "Implementation Completed" option on the account management system, which will generate a notification message indicating that the change event has been processed. After receiving the notification message, the account management system will revoke the account applied for by the user. If the authorization time of the account has exceeded the time range applied by the user, the system will automatically revoke the account.

[0126] Similarly, in the scenario of emergency incident handling, the emergency handling personnel, i.e. the implementers, will carry out emergency operations based on the authorized account. Their operation records are synchronously recorded in the operation log of the account management system. When the emergency incident handling is completed, the account management system receives a notification message from the emergency management platform containing the emergency incident end mark, and thus the account management system automatically reclaims the corresponding privileged account.

[0127] S313: Record the change information of the application account corresponding to the account application information.

[0128] The change information includes the content of the change process and the time of the change process.

[0129] Specifically, the account management system will record the implementer's actual change implementation time, implementation results, operation record summary and other information, and push it to the account management system so that the account management system can write the above information back to the account application information.

[0130] In the scenario of emergency incident handling, emergency response personnel can supplement the account application information of operations involved in the emergency response period in the account management system, and supplement the emergency response operation records involved in this emergency incident in the emergency management platform.

[0131] S314. Output the recorded results to the audit platform.

[0132] Among them, the audit platform is used to review the recorded results based on preset operating specifications.

[0133] Specifically, the account management system will output the user's role settings, operation logs and other information to the automated audit platform. Through a mechanism that combines the automated audit platform's pre-audit and manual re-audit, it will regularly review and inspect matters such as user role settings, permission application processes, resource and terminal management status, and operational behaviors.

[0134] The automated audit platform has built-in audit modules such as user rights audit, resource management audit, operation record automated audit, and authorization process compliance check, which can realize integrated audit of user role settings, account authorization processes, operation records, etc. in the production environment, and comprehensively cover all matters related to the operation and maintenance of the account management system. If the user's operation record does not meet the requirements of the relevant management specifications, the audit role will urge the relevant personnel to rectify the audit issues to ensure that the change implementer performs operation and maintenance operations in accordance with the change management specifications and the account management system platform usage specifications.

[0135] S315, perform desensitization processing on the record result, and output the record result after desensitization processing.

[0136] Specifically, when the user operation records need to be transmitted to other platforms outside the account management system, the desensitizing role desensitizes the operation records of the person who implements the change according to the desensitizing rules.

[0137] The account application method provided in the embodiment of the present application realizes efficient management of account change applications through a systematic and automated process, and has significant beneficial effects. First, by distinguishing between normal and abnormal states, the system can flexibly respond to change applications in different situations, ensure rapid response and upgraded approval in emergency situations, and improve the agility and security of the system. Secondly, strict resource verification and authority review mechanisms ensure the compliance and necessity of change operations, and reduce the risks of authority abuse and misoperation. Through automated change processing and authority recovery, the system effectively reduces the complexity of human intervention and improves operation and maintenance efficiency. In addition, the detailed recording and desensitization of operation records, combined with the audit function of the audit platform, enhance the transparency and traceability of the system, and ensure compliance and security. Overall, this solution improves the security, efficiency, and management cost-effectiveness of the system by optimizing the authority management process.

[0138] More specifically, the account application method provided in the embodiment of the present application includes the following beneficial effects:

[0139] (1) Integrate multiple mechanisms to strengthen the management of production system operation and maintenance accounts. Before processing account application information, this solution distinguishes different operation and maintenance scenarios, divides multiple types of operation and maintenance resources, establishes multiple user roles, distinguishes between general and privileged account types, and combines multiple management principles to minimize the resource scope of production system account applications by operation and maintenance personnel, control the application time, and make the authorization process traceable. At the same time, the upgraded approval and multi-level approval mechanism for resource account applications in special scenarios not only meets the needs of emergency response, but also prevents the risks brought by the abuse of privileged accounts in the production system.

[0140] (2) Multi-stage account control ensures the reasonable use of production system operation and maintenance accounts. This solution is based on the account management system, which incorporates management systems and process specifications into each use link of the platform. It controls the use of authorized accounts in the production environment through prior authorization (approval authorization based on account application information), in-process control (recovery of authorized accounts) and post-audit, ensuring that operation and maintenance personnel use various operation and maintenance accounts reasonably and realizing full-process control of operation and maintenance account authorization.

[0141] (3) Multi-platform linkage improves the authorization efficiency of operation and maintenance accounts. This solution links the account management system with the change management platform, monitoring platform, configuration library and other platforms by designing change scenarios and emergency scenarios. This can achieve the rapid filling of user operation elements and simplify the cumbersome process of filling in multiple elements when applying for resource permissions. At the same time, it also strictly controls the scope of resources applied by users and reduces authorization risks. In addition, in emergency scenarios, the linkage method of this solution can greatly shorten the account authorization time and improve the efficiency of emergency response.

[0142] (4) Multi-dimensional auditing ensures the transparency of user operation and maintenance in the production environment. This solution designs an automated audit platform to connect to the account management system. Through a combination of automated auditing and manual re-auditing, it regularly conducts multi-dimensional reviews and inspections on user role settings, account authorization processes, operation records, etc. to ensure the compliance of account authorization and user operations. At the same time, through the principle of role mutual exclusion, the transparency of the account authorization process is guaranteed, reducing the risk of illegal users obtaining resource account permissions.

[0143] In summary, this solution can achieve unified management of operation and maintenance elements such as operation and maintenance personnel, resources and accounts, and further link other platforms to achieve standardization and process-based resource account authorization in different application scenarios, thereby improving the operation and maintenance management efficiency of the production system.

[0144] Figure 4 A schematic diagram of the structure of the account application device provided for this application, such as Figure 4 As shown, the account application device 400 provided in this embodiment includes:

[0145] Verification module 410, for responding to the received account application information, determining that the account application information meets the corresponding verification condition, wherein the account application information includes the application account, the target account and the corresponding change event, the account application information includes the account authority of the application account to be changed and / or the application setting type authority account, and the change event is used to indicate the event that triggers the application account to make an account application;

[0146] The transmission module 420 is used to generate a corresponding review request based on the account application information, and send the review request to the corresponding review account, wherein the review account is used to return the corresponding change authorization information based on the review request;

[0147] The processing module 430 is used to perform a change process on the target account corresponding to the account application information in response to the received change authorization information.

[0148] In a possible implementation, the verification module 410 is specifically used to: if the change event includes the target operation resource and the system status; in response to the received account application information, determine that the current account management system has not received an alarm event; determine that the system status is normal; determine that the target operation resource belongs to a management object of the account management system; and determine that the account application information meets the corresponding verification conditions.

[0149] In one possible implementation, the verification module 410 is specifically used to, in response to the received account application information, determine that the account management system has received an alarm event; determine that the system state is an abnormal state; obtain the alarm event information corresponding to the abnormal state, the alarm event information including the corresponding operation resource; determine that the operation resource corresponding to the alarm event information is the target operation resource in the account application information, and determine that the target operation resource belongs to the management object of the account management system; determine that the account application information meets the corresponding verification conditions.

[0150] In one possible implementation, the transmission module 420 is specifically used to, if the system status is normal, generate an audit request and send the audit request to the audit account corresponding to the application account; if the system status is abnormal, generate an audit request and send the audit request to the superior audit account of the audit account corresponding to the application account, and the approval authority of the superior audit account is higher than that of the audit account.

[0151] In a possible implementation, the processing module 430 is further configured to, in response to the received change authorization information, perform change processing on the target account corresponding to the account application information, and then, in response to the received notification information indicating that the change event processing is completed, call back the application account corresponding to the account application information to the state before the application.

[0152] In one possible implementation, the processing module 430 is also used to, in response to the notification information received that the change event has been processed, call back the application account corresponding to the account application information to the state before the application, and then record the change information of the application account corresponding to the account application information, where the change information includes the content of the change processing and the time of the change processing; and output the record results to the audit platform, which is used to review the record results based on preset operating specifications.

[0153] In a possible implementation, the processing module 430 is further used to perform desensitization processing on the record results after outputting the record results to the audit platform, and output the desensitized record results.

[0154] The account application device provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail in this embodiment.

[0155] Figure 5 This is a schematic diagram of the structure of the control device provided in this application. Figure 5 As shown, the electronic device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the device 50 also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0156] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0157] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0158] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0159] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0160] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0161] The present application also provides a computer program product, including a computer program, which implements the method in any of the above embodiments when executed by a processor.

[0162] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the method in any of the above embodiments is implemented.

[0163] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0164] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0165] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0166] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0167] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0168] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0169] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0170] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for applying for an account, characterized in that: The method comprises: In response to the received account application information, based on the change event in the account application information, determining that the account application information meets the corresponding verification condition, wherein the account application information includes an application account, a target account and a corresponding change event, the account application information includes changing the account authority of the application account and / or applying for setting a type authority account, and the change event is used to indicate an event that triggers the application account to make an account application; Generate a corresponding review request based on the account application information, and send the review request to the corresponding review account, wherein the review account is used to return corresponding change authorization information based on the review request; In response to the received change authorization information, a change process is performed on the target account corresponding to the account application information.

2. The method according to claim 1, characterized in that The change event includes target operation resources and system status; The step of determining, in response to the received account application information, that the account application information satisfies a corresponding verification condition includes: In response to the received account application information, determining that the current account management system has not received an alarm event; Determining that the system state is a normal state; Determining that the target operation resource belongs to a management object of the account management system; Determine whether the account application information satisfies corresponding verification conditions.

3. The method according to claim 2, characterized in that The step of determining, in response to the received account application information, that the account application information satisfies a corresponding verification condition includes: In response to the received account application information, determining that the account management system receives an alarm event; Determining that the system state is an abnormal state; Acquire alarm event information corresponding to the abnormal state, wherein the alarm event information includes corresponding operation resources; Determining that the operation resource corresponding to the alarm event information is the target operation resource in the account application information, and determining that the target operation resource belongs to a management object of the account management system; Determine whether the account application information satisfies corresponding verification conditions.

4. The method according to claim 3, characterized in that: Based on the account application information, a corresponding audit request is generated, and the audit request is sent to the corresponding audit account, including: If the system status is normal, generate an audit request, and send the audit request to the audit account corresponding to the application account; If the system status is abnormal, a review request is generated and sent to a superior review account of the review account corresponding to the application account, and the approval authority of the superior review account is higher than that of the review account.

5. The method according to any one of claims 1 to 4, characterized in that After the target account corresponding to the account application information is changed in response to the received change authorization information, the method further includes: In response to the received notification information indicating that the change event has been processed, the application account corresponding to the account application information is recalled to a state before the application.

6. The method according to claim 5, characterized in that After calling back the application account corresponding to the account application information to the state before the application in response to the received notification information of the completion of the change event processing, the method further includes: Recording change information of the application account corresponding to the account application information, wherein the change information includes the content and time of the change process; The recording results are output to an audit platform, and the audit platform is used to review the recording results based on preset operating specifications.

7. The method according to claim 6, characterized in that After the recording result is output to the audit platform, the method further includes: Perform desensitization processing on the recording result, and output the recording result after the desensitization processing.

8. An account application device, characterized in that: include: A verification module, configured to respond to the received account application information and determine whether the account application information satisfies a corresponding verification condition, wherein the account application information includes an application account, a target account, and a corresponding change event, the account application information includes changing the account authority of the application account and / or applying for setting a type of authority account, and the change event is used to indicate an event that triggers the application account to make an account application; A transmission module, used for generating a corresponding review request based on the account application information, and sending the review request to a corresponding review account, wherein the review account is used for returning corresponding change authorization information based on the review request; The processing module is used to perform change processing on the target account corresponding to the account application information in response to the received change authorization information.

9. A control device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images