A method and system for managing association of hierarchical accounts and an event handling method

Abstract

The present invention aims to provide a method and system for associating management of accounts in a hierarchical system, and also proposes an event handling method based on the management method. Responsible persons, asset groups and system administrator accounts are created for the headquarters system and branch systems respectively, and each asset group is configured with a responsible person. The responsible persons or persons in charge of different systems are configured with different permissions, which can provide an effective hierarchical association management method for systems including different levels of equipment or platforms. Based on the above management method, when a branch system reports an event to the headquarters, the headquarters system administrator account will judge the event, create a work order based on the event information and send it to the corresponding branch system, and the administrator account of the branch system will further assign the work order to the responsible person of the corresponding asset group for handling. After the handling is completed, the handling results are reported step by step. Finally, the headquarters system administrator account will review the handling results and change and archive the handling status, which can effectively improve the operation and maintenance handling efficiency of the event and ensure the safe operation of the system.

Description

Technical Field

[0001] The present invention belongs to the technical field of system account management, and in particular relates to an account association management method and system for a hierarchical system and a method for handling security incidents. Background Art

[0002] As the management resources and networks of current network security equipment and systems become increasingly large, users often deploy a master system or platform at the headquarters to bypass and mirror the traffic of subordinate branch systems and report it to the headquarters platform for analysis and processing. Therefore, the headquarters platform needs to set up corresponding branch users for each branch system so that branch users can only see, display and process the security status of their own branch network.

[0003] At the same time, the headquarters platform is also responsible for unified supervision and analysis of subordinate branches, and each subordinate branch must handle security incidents and risks within its jurisdiction in accordance with the requirements of the headquarters.

[0004] Therefore, how to manage the users and accounts of the hierarchical system and achieve efficient handling of security incidents based on such management is of great significance to the safe and stable operation of the entire system. Summary of the invention

[0005] In view of the above background, the present invention aims to provide a method and system for managing association of accounts in a hierarchical system, and also proposes an event handling method based on the management method. The specific technical solution is as follows.

[0006] In a first aspect, a method for managing association of hierarchical accounts is provided, for managing a network system including lower-level branches, comprising: Create corresponding person-in-charge information for the headquarters system and each branch system respectively, and the person-in-charge information includes name, department position and contact information; Configure the asset groups in the headquarters system and each branch system respectively. The asset group information includes group name, asset group IP range, asset type, and responsible person; Use the administrator account of the headquarters system to create a new system administrator account for each branch system, designate the person in charge and assign corresponding permissions; Supervise events in the headquarters system and branch systems based on the person in charge information, asset group and administrator account.

[0007] The above-mentioned branch system administrator information includes: account and password, login authentication policy, and bound IP address. After logging in, the branch system administrator only has the authority to view and operate the asset group and event information under the branch.

[0008] Preferably, the above-mentioned asset groups are divided into different levels of groups according to IP ranges or asset classifications, and the asset group information includes the name of the upper level group to which the current asset group belongs.

[0009] Preferably, the event information generated by each of the above-mentioned branch systems is reported to the headquarter system, and the event is handled according to the work order issued by the headquarter system for the event.

[0010] In a second aspect, a hierarchical account association management system is provided, the system comprising: The personnel configuration module creates corresponding person-in-charge information for the headquarters system and each branch system, including name, department position and contact information; The asset configuration module configures the asset groups in the headquarters system and each branch system respectively. The information of the asset group includes the group name, asset group IP range, asset type, and responsible person; The hierarchical management module uses the administrator account of the headquarters system to create a new system administrator account for each branch system, designate the associated person in charge and allocate corresponding permissions; and supervise the events of the headquarters system and branch systems based on the person in charge information, asset group and administrator account.

[0011] Preferably, in the above-mentioned asset configuration module: the asset group is divided into different levels of groups according to the IP range or asset classification, and the asset group information includes the name of the upper level group to which the current asset group belongs; And, the above-mentioned hierarchical management module: the administrator information of the branch system, including: account and password, login authentication policy, and bound IP address; after logging in, the administrator of the branch system only has the authority to view and operate the asset group and event information under the branch.

[0012] In a third aspect, a hierarchical handling method for an event is provided, comprising: when a security event reported by a branch system is detected, The person in charge of the upper-level branch system analyzes and judges the threat, generates a work order, and notifies the person in charge of the lower-level branch system where the incident occurred via email or SMS; After receiving the notification, the person in charge of the lower-level branch system logs in to the system to claim the work order. After the work order is processed, the work order status is changed to handled and the person in charge of the upper-level branch system is notified; The person in charge of the superior branch system shall review and verify the completed work orders; after the review and verification is completed, the event and its disposal shall be archived.

[0013] The above work order is assigned by the person in charge of the lower-level branch system to the person in charge of the asset group corresponding to the event in the work order for handling; the content of the work order includes event handling suggestions.

[0014] The above-mentioned branch system manager needs to log in as the corresponding system administrator to operate the work order, and execute the preset security authentication policy when logging in.

[0015] The embodiments of the present invention using the above technical solution have at least the following beneficial effects: On the one hand, responsible persons, asset groups and system administrator accounts are created for the headquarters system and branch systems respectively, and each asset group is assigned a responsible person. The responsible persons or persons in charge of different systems are assigned different permissions, which can provide an effective hierarchical association management method for systems including different levels of equipment or platforms; on the other hand, based on the above management method, when the branch system reports an event to the headquarters, the headquarters system administrator account will judge the event, create a work order based on the event information and send it to the corresponding branch system, and the administrator account of the branch system will further assign the work order to the responsible person of the corresponding asset group for disposal. After the disposal is completed, the disposal results are reported step by step. Finally, the headquarters system administrator account will review the disposal results, change and archive the disposal status, which can effectively improve the operation and maintenance disposal efficiency of the event and ensure the safe operation of the system. Implementation

[0016] In order to make the objectives, technical solutions and advantages of the present invention more clear, the technical solutions of the embodiments of the present invention are further described in detail below. Example

[0017] This embodiment provides a method for managing association of hierarchical accounts, which is used to manage a network system including lower-level branches, and specifically includes: Corresponding person-in-charge information is created for the headquarters system and each branch system respectively, and the person-in-charge information includes name, department position and contact information.

[0018] The asset groups in the headquarters system and each branch system are configured separately. The information of the asset group includes the group name, asset group IP range, asset type, and responsible person. The asset group is divided into different levels of groups according to IP range or asset classification. The asset group information includes the name of the upper-level group to which the current asset group belongs.

[0019] Through the administrator account of the headquarters system, create a new system administrator account for each branch system, designate the associated person in charge and assign corresponding permissions; the administrator information of the branch system includes: account and password, login authentication policy, and bound IP address. After logging in, the administrator of the branch system only has the authority to view and operate the asset group and event information under the branch.

[0020] Supervise events in the headquarters system and branch systems based on the person in charge information, asset group and administrator account; specifically, report event information generated by each branch system to the headquarters system, and handle events based on work orders issued by the headquarters system for the events. Example

[0021] This embodiment provides a hierarchical account association management system, the system comprising: The personnel configuration module creates corresponding person-in-charge information for the headquarters system and each branch system, including name, department position and contact information; The asset configuration module configures the asset groups in the headquarters system and each branch system respectively. The asset group information includes the group name, asset group IP range, asset type, and responsible person. The asset group is divided into different levels of groups according to the IP range or asset classification. The asset group information includes the name of the upper level group to which the current asset group belongs; The hierarchical management module uses the administrator account of the headquarters system to create a new system administrator account for each branch system, designate the associated person in charge and assign corresponding permissions; supervise the events of the headquarters system and branch systems based on the person in charge information, asset group and administrator account; the administrator information of the branch system includes: account and password, login authentication policy, and bound IP address; after logging in, the administrator of the branch system only has the authority to view and operate the asset group and event information under the branch. Example

[0022] This embodiment provides a hierarchical handling method for an event, comprising: when a security event reported by a branch system is detected, The person in charge of the upper-level branch system analyzes the threat, generates a work order, and notifies the person in charge of the lower-level branch system where the incident occurred via email or text message.

[0023] After receiving the notification, the person in charge of the subordinate branch system logs in to the system to claim the work order. After the work order is processed, the work order status is changed to handled and the person in charge of the superior branch system is notified; the work order is assigned by the person in charge of the subordinate branch system to the person responsible for the asset group corresponding to the event in the work order for handling; the content of the work order includes event handling suggestions.

[0024] The person in charge of the superior branch system shall review and verify the completed work orders; after the review and verification is completed, the event and its disposal shall be archived.

[0025] As a preferred implementation, the branch system manager needs to log in as a corresponding system administrator to operate the work order, and execute a preset security authentication policy when logging in.

[0026] In the above-mentioned embodiments of the present invention, on the one hand, responsible persons, asset groups and system administrator accounts are created for the headquarters system and branch systems respectively, and each asset group is configured with a responsible person. The responsible persons or responsible persons of different systems are configured with different permissions, which can provide an effective hierarchical association management method for systems including different levels of equipment or platforms; on the other hand, based on the aforementioned management method, when a branch system reports an event to the headquarters, the headquarters system administrator account will judge the event, create a work order based on the event information and send it to the corresponding branch system, and the administrator account of the branch system will further assign the work order to the responsible person of the corresponding asset group for disposal. After the disposal is completed, the disposal results are reported step by step. Finally, the headquarters system administrator account will review the disposal results, change and archive the disposal status, which can effectively improve the operation and maintenance disposal efficiency of the event and ensure the safe operation of the system.

[0027] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.

[0028] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.

Claims

1. A method for managing the association of hierarchical accounts, for managing a network system including lower-level branches, wherein: The characteristics include: Create corresponding person-in-charge information for the headquarters system and each branch system respectively, and the person-in-charge information includes name, department position and contact information; Configure the asset groups in the headquarters system and each branch system respectively. The asset group information includes group name, asset group IP range, asset type, and responsible person; Use the administrator account of the headquarters system to create a new system administrator account for each branch system, designate the person in charge and assign corresponding permissions; Supervise events in the headquarters system and branch systems based on the person in charge information, asset group and administrator account.

2. The hierarchical account management method according to claim 1, characterized in that: The administrator information of the branch system includes: account number and password, login authentication strategy, and bound IP address.

3. The hierarchical account management method according to claim 2, characterized in that: After logging in, the administrator of the branch system only has the authority to view and operate the asset groups and event information under the branch.

4. The hierarchical account management method according to claim 1, characterized in that: The asset group is divided into different levels of groups according to IP range or asset classification, and the asset group information includes the name of the upper level group to which the current asset group belongs.

5. The hierarchical account management method according to claim 1, characterized in that: The event information generated by each branch system is reported to the headquarters system, and the event is handled according to the work order issued by the headquarters system.

6. A hierarchical account association management system, characterized in that: The system comprises: The personnel configuration module creates corresponding person-in-charge information for the headquarters system and each branch system, including name, department position and contact information; The asset configuration module configures the asset groups in the headquarters system and each branch system respectively. The information of the asset group includes the group name, asset group IP range, asset type, and responsible person; The hierarchical management module uses the administrator account of the headquarters system to create a new system administrator account for each branch system, designate the associated person in charge and allocate corresponding permissions; and supervise the events of the headquarters system and branch systems based on the person in charge information, asset group and administrator account.

7. The account association management system according to claim 6, characterized in that: The asset configuration module: the asset group is divided into different levels of groups according to the IP range or asset classification, and the asset group information includes the name of the previous level group to which the current asset group belongs; The hierarchical management module: administrator information of the branch system, including: account and password, login authentication strategy, and bound IP address; After logging in, the administrator of a branch system only has the authority to view and operate the asset groups and event information under that branch.

8. A method for hierarchical handling of events, characterized in that: include: When a security incident reported by a branch system is detected, The person in charge of the upper-level branch system analyzes and judges the threat, generates a work order, and notifies the person in charge of the lower-level branch system where the incident occurred via email or SMS; After receiving the notification, the person in charge of the lower-level branch system logs in to the system to claim the work order. After the work order is processed, the work order status is changed to handled and the person in charge of the upper-level branch system is notified; The person in charge of the superior branch system shall review and verify the completed work orders; after the review and verification is completed, the events and their handling shall be archived.

9. The event handling method according to claim 8, characterized in that: The work order is handled by the person in charge of the lower-level branch system and the person in charge of the asset group corresponding to the event in the work order; the work order content includes event handling suggestions.

10. The event handling method according to claim 8, characterized in that: The branch system manager needs to log in as a corresponding system administrator to operate the work order, and execute the preset security authentication policy when logging in.