Server security certificate automatic management system based on dynamic rules

Abstract

The invention relates to the technical field of information security, in particular to a dynamic rule-based server security certificate automatic management system, which comprises a rule generation module, a certificate generation module, a certificate distribution module, a monitoring and detection module, a dynamic adjustment module and a log recording module, wherein the rule generation module is used for generating a corresponding dynamic management rule; the voucher generation module is used for automatically generating a security voucher according to the dynamic management rule provided by the rule generation module; the voucher distribution module is used for distributing the generated security voucher to a specified server; the monitoring and detection module is used for detecting the abnormal condition of the security certificate; and the dynamic adjustment module is used for adjusting a dynamic rule based on the monitoring data and the abnormal condition detection result. According to the invention, through dynamic rule generation, real-time monitoring, anomaly detection and an automatic adjustment mechanism, efficient and automatic management of the server security credential is realized, and the security and adaptability of credential management are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a server security credential automation management system based on dynamic rules. Background Art

[0002] In the modern information technology environment, server credential management is an important part of ensuring the security of information systems. Especially with the widespread application of cloud computing and distributed architecture, the effective management and security protection of credentials have become particularly critical. Traditional credential management usually relies on manual configuration or static rule-based management methods. These methods have problems such as low efficiency and poor flexibility in credential generation, distribution and usage monitoring, and are difficult to adapt to rapidly changing usage scenarios and security requirements. For example, when the server's credentials are leaked due to misconfiguration or improper permission settings, the traditional system may not be able to detect and respond in time. In addition, the traditional management method lacks automated rule adjustment and log record analysis, and cannot effectively deal with abnormal use of credentials. This results in the inability to effectively ensure credential security and increases the risk of information leakage and security attacks.

[0003] Therefore, the existing technology has major defects in the dynamic and security aspects of credential management, especially in the frequently changing server environment, the traditional management method cannot provide key functions such as dynamic generation, real-time monitoring, intelligent adjustment and comprehensive recording. To solve these problems, it is necessary to propose a server security credential automatic management system based on dynamic rules to solve the above problems. Summary of the invention

[0004] Based on the above objectives, the present invention provides a server security credential automation management system based on dynamic rules.

[0005] The server security credential automatic management system based on dynamic rules includes a rule generation module, a credential generation module, a credential distribution module, a monitoring and detection module, a dynamic adjustment module and a log recording module; wherein:

[0006] Rule generation module: used to generate corresponding dynamic management rules according to the usage scenarios, connection frequency and historical operation records of the server, wherein the dynamic management rules include the generation frequency, expiration time and restriction conditions of the credential usage rights;

[0007] Credential generation module: connected to the rule generation module, used to automatically generate security credentials according to the dynamic management rules provided by the rule generation module, the security credentials containing unique identification information and encryption keys;

[0008] Credential distribution module: connected to the credential generation module, used to distribute the generated security credentials to the designated server and monitor the usage of the security credentials in the server;

[0009] Monitoring and detection module: connected to the credential distribution module, used to receive the usage of the server security credentials and detect abnormal situations of the security credentials through a rule matching algorithm, including credential abuse, unauthorized access and frequent requests;

[0010] Dynamic adjustment module: connected to the monitoring and detection module, used to adjust dynamic rules based on monitoring data and abnormal situation detection results to deal with potential security threats;

[0011] Logging module: connected to the above modules, used to record the operation logs and abnormal events of each module.

[0012] Optionally, the rule generation module includes a scenario analysis unit, a connection frequency statistics unit and a history record analysis unit; wherein:

[0013] Scenario analysis unit: used to analyze the actual usage scenarios of the server and generate the following dynamic management rules based on the scenarios;

[0014] Rule 1: When the server is located in an open network environment, set the expiration time of the certificate to no more than 4 hours;

[0015] Rule 2: When the server is in a high-frequency task scenario, that is, the number of operation requests per hour is greater than 100 times, the credential generation frequency is at least once per hour;

[0016] Rule 3: When the server task scenario involves sensitive data processing, the usage permissions will be limited to only the specified data access operations;

[0017] Connection frequency statistics unit: used to count the access frequency of the server, and generate the credential generation frequency and expiration time limit based on the statistical results, setting the credential generation frequency to f gen and the voucher expiration time is t exp , the limiting conditions include:

[0018] If the server access frequency is A f Satisfy A f >200 times / hour, then f gen = 1 time / hour, and t exp =2 hours;

[0019] If the server access frequency is A f Between 100 and 200 times / hour, then f gen = 1 time / 2 hours, and t exp =4 hours;

[0020] If the server access frequency is A f <100 times / hour, then fgen = 1 time / 4 hours, and t exp =8 hours;

[0021] History analysis unit: used to generate permission-restricting conditions based on the server's historical operation records. By analyzing the server's past credential usage and permission settings, corresponding permission priorities are formulated to ensure that the credential permissions are consistent with the server's historical behavior.

[0022] Optionally, the historical record analysis unit includes:

[0023] Data extraction: Extract the historical data of the last three months from the server's history records. The extracted data includes the operation frequency, access resource category, and permission level of each credential.

[0024] Operation frequency statistics: The historical usage frequency of each credential is counted, and the degree of demand for permission is determined based on this; the statistical value of the historical usage frequency is set to 0. f If O f >5 times / day, it indicates that the permission is a high-frequency permission, and the generated certificate must include this permission; if O f ≤5 times / day, the generated certificate needs to limit the frequency of use of this permission;

[0025] Access resource classification: According to the usage history of the credential, classify the resource categories involved in each credential; let the access ratio of each type of resource be R c ; If the access ratio of a certain type of resource is R c If it is greater than 40%, it is a high-frequency access resource, and the generated credentials must limit the access rights of the corresponding resources to the highest priority;

[0026] Permission setting optimization: Based on the results of operation frequency statistics and resource classification, determine the permission priority for generating credentials; set the permission score as P r , the formula is: r =min(O f , R c ), where P r The higher the value, the greater the permission requirement; the permission range is divided into three levels: r >5, it is a high priority permission, and the credential permission is set to full access; when 2≤P r When ≤5, it is a medium priority permission, and the credential permission is set to partial access; when P r When <2, it is a low priority permission, and the credential permission is set to restricted access;

[0027] Permission consistency verification: Verify the consistency of the generated permission range with the historical behavior of the server to ensure that the set permission range is consistent with the actual usage of the server and avoid permissions that are too broad or too narrow.

[0028] Optionally, the credential generation module includes a credential generation unit, a unique identification generation unit and an encryption key generation unit; wherein:

[0029] Credential generation unit: used to automatically generate initial information of security credentials according to the dynamic management rules provided by the rule generation module, ensuring that the generation frequency, expiration time and usage rights of the credentials meet the requirements of the dynamic management rules;

[0030] Unique identification generation unit: used to generate unique identification information for each security credential. The unique identification information is generated by hashing the initial credential information using the SHA-256 algorithm to generate a 256-bit unique identification to ensure the uniqueness of each credential in the system.

[0031] Encryption key generation unit: used to generate a corresponding encryption key for each security credential. The encryption key is generated using the Advanced Encryption Standard AES algorithm with a key length of 256 bits. A high-strength key is generated through a random number generator.

[0032] Optionally, the credential distribution module includes a credential transmission unit, a server designation unit and a usage monitoring unit; wherein:

[0033] Server specifying unit: used to determine the target server address of the security credential according to the system configuration or management instruction, wherein the target server address includes the IP address, port number and communication protocol type of the server;

[0034] Credential transmission unit: connected to the server designation unit, used to send the security credentials generated by the credential generation module to the designated server through an encrypted communication channel, and the encrypted communication channel is encrypted using the transport layer security protocol;

[0035] Usage monitoring unit: used to monitor the usage of the distributed security credentials in the server in real time, including the usage frequency F u , Use time T u And the verification result V r .

[0036] Optionally, the monitoring and detection module includes a usage record collection unit, a rule matching unit and an anomaly detection unit; wherein:

[0037] Usage record collection unit: used to collect real-time data on the usage of server security credentials, including the usage frequency, usage time and verification results of each credential;

[0038] Rule matching unit: used to compare the usage data obtained by the usage record collection unit with the dynamic management rules provided by the rule generation module, and identify whether the usage behavior of the credential meets the preset normal conditions through matching rules; if the usage behavior exceeds the rule limit, the rule matching unit will mark the behavior as a potential anomaly and submit it to the anomaly detection unit for analysis;

[0039] Anomaly detection unit: used to determine the anomaly type based on the potential anomalies marked by the rule matching unit and identify the specific anomaly situation.

[0040] Optionally, the rule matching unit includes:

[0041] Data reception: Receive the credential usage data provided by the usage record collection unit, the data includes the usage frequency F u , Use time T u And the verification result V r ;

[0042] Rule acquisition: dynamic management rules are acquired from the rule generation module, and the rules include the maximum allowed usage frequency F max , Allowed usage time range T allowed And the qualification standard V of the verification result pass ;

[0043] Frequency Matching: Compare the frequency of use F u The maximum frequency F max , if F u ≤F max ; It means the frequency is normal; otherwise, it is marked as abnormal frequency;

[0044] Usage time matching: Determine the usage time T u Is it within the permitted usage time range T? allowed If T u ∈T allowed , it indicates that the usage time is normal; otherwise, it is marked as abnormal time;

[0045] Verification result match: check verification result V r Whether it meets the qualification standard V pass , if V r =V pass , it indicates that the verification result is normal; otherwise, it is marked as verification abnormality;

[0046] Comprehensive matching judgment: Comprehensively judge the above conditions. If all conditions are met, the usage behavior of the credential is considered to meet the preset normal conditions; otherwise, it is marked as a potential anomaly;

[0047] Abnormal marking: For the usage behaviors marked as potential abnormalities, the rule matching unit will record the abnormality type, credential identification ID and timestamp, and submit it to the abnormality detection unit for analysis.

[0048] Optionally, the abnormality detection unit includes:

[0049] Abnormal data reception: receiving potential abnormal data marked by the rule matching unit, wherein the data includes abnormal type marks, including frequency abnormality, time abnormality, and verification abnormality;

[0050] Frequency anomaly analysis: For potential anomaly data marked as frequency anomaly, the anomaly detection unit calculates the actual usage frequency F u The maximum frequency F max The deviation between the two frequencies is used to determine the severity of the frequency anomaly. The deviation calculation formula is: ΔF = F u -F max ;like It is marked as high-frequency abuse abnormality; if 0<ΔF≤10%·F max , it is marked as mild frequency abnormality;

[0051] Time anomaly analysis: For potential anomaly data marked as time anomaly, the anomaly detection unit calculates the actual usage time T u Relative to the permitted usage time range T allowed The degree of deviation ΔT is used to determine the specific type of time anomaly; if ΔT>30 minutes, it is marked as long-term continuous use anomaly; if ΔT≤30 minutes, it is marked as mild time anomaly;

[0052] Verification anomaly analysis: For potential abnormal data marked as verification anomalies, the anomaly detection unit calculates the ratio of the number of verification failures to the total number of verification requests as the basis for judging verification anomalies; the verification failure rate F r The calculation formula is: Among them, V fail is the number of verification failures, V total is the total number of verification requests; if F r >0.1 is marked as a high failure rate exception: if 0 <F r ≤0.1 is marked as a mild verification anomaly;

[0053] Comprehensive anomaly identification: When multiple anomaly types occur simultaneously, the anomaly detection unit will mark them as compound anomalies and record detailed anomaly data, including credential identification ID, anomaly type, timestamp, deviation value, deviation time, and verification failure rate.

[0054] Optionally, the dynamic adjustment module includes a credential regeneration unit, an expiration time update unit, and a permission priority adjustment unit; wherein:

[0055] Credential regeneration unit: used to immediately trigger the regeneration of credentials when the anomaly detection unit identifies high-risk anomalies, including high-frequency abuse anomalies, long-term continuous use anomalies, or high failure rate anomalies; it will generate new security credentials based on the dynamic management rules provided by the rule generation module and revoke the original credentials;

[0056] Expiration time update unit: used to dynamically update the expiration time of the credential according to the actual usage of the credential, and adjust the expiration time of the credential according to the usage frequency, usage time and verification result data. exp ; If the actual frequency F u Exceeds the preset frequency threshold F max When , the failure time t is shortened exp , updated according to the following formula: exp =t exp ×α, where α∈(0,1) is the shortening factor, set to 0.5; if the actual frequency F u Lower than or equal to the frequency threshold F max If there is no abnormal test result, the failure time t is extended. exp , updated according to the following formula: exp =t exp ×β, where β>1 is the elongation factor, set to 1.5;

[0057] Permission priority adjustment unit: used to dynamically adjust the permission priority of the credential according to the abnormal detection results to ensure that the credential permissions meet the current security requirements; permission priority P r The adjustment is based on the following conditions; if unauthorized access is detected, the permission priority is reduced, and the permission priority adjustment formula is: r =P r ×γ, where γ∈(0,1) is the reduction coefficient, set to 0.8; if the frequency F is used u And the verification result V r If the normal conditions of the rule generation module are met and there is no abnormal record, the permission priority is restored or improved. The permission priority adjustment formula is: r =P r ×δ, where δ>1 is the boost factor, which is set to 1.2.

[0058] Optionally, the log recording module includes a log collection unit, a log storage unit and a log analysis unit; wherein:

[0059] Log collection unit: used to collect operation logs and abnormal event information from each module in the system in real time. The operation log includes the operation time, operation type and operation result of the module, and the abnormal event information includes the abnormal occurrence time and abnormal type;

[0060] Log storage unit: used to store the log information collected by the log collection unit in a predetermined format; the predetermined format includes a timestamp, a module identifier, an operation type, an operation result, an exception type, and a description field.

[0061] Beneficial effects of the present invention:

[0062] The present invention solves the problems of lag and poor flexibility in traditional credential management methods by dynamically generating and adjusting credential management rules. The system can generate specific dynamic rules according to the actual usage of the server, including the generation frequency, expiration time and authority range of the credential, making the credential management more targeted. With the automatically generated unique identifier and encryption key, the system further improves the security of the credential and effectively prevents the credential from being reused or maliciously tampered with. In addition, through encrypted transmission and real-time monitoring of the usage of the credential, the system ensures the security and consistency of the credential throughout its entire life cycle.

[0063] The present invention, through real-time anomaly detection and dynamic adjustment mechanism, can timely identify abnormal usage of credentials, such as frequent requests, unauthorized access and abuse, and automatically adjust management rules according to abnormal situations. Combined with refined logging functions, the system can comprehensively record the operations and abnormal events of each module, providing reliable data support for subsequent security analysis and troubleshooting. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0065] Figure 1 This is a schematic diagram of a fully automated voucher management system according to an embodiment of the present invention;

[0066] Figure 2 Schematic diagram of a monitoring and detection module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0067] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. At the same time, it is explained here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments, and those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0068] It should be noted that the references to "one embodiment", "an embodiment", "an exemplary embodiment", "some embodiments" and the like in the specification indicate that the embodiments described may include specific features, structures or characteristics, but not every embodiment may include the specific features, structures or characteristics. In addition, when a specific feature, structure or characteristic is described in conjunction with an embodiment, it should be within the knowledge of a person skilled in the art to implement such feature, structure or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0069] In general, a term can be understood, at least in part, from its use in context. For example, depending, at least in part, on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in the singular sense, or can be used to describe a combination of features, structures, or characteristics in the plural sense. Additionally, the term "based on" can be understood as not necessarily intended to convey an exclusive set of factors, but can instead, depending, at least in part, on the context, allow for the presence of other factors that are not necessarily explicitly described.

[0070] like Figure 1-Figure 2 As shown, the server security credential automation management system based on dynamic rules includes a rule generation module, a credential generation module, a credential distribution module, a monitoring and detection module, a dynamic adjustment module and a log recording module; wherein:

[0071] Rule generation module: used to generate corresponding dynamic management rules according to the server's usage scenarios, connection frequency and historical operation records. The dynamic management rules include the frequency of credential generation, expiration time and the conditions for limiting usage rights;

[0072] Credential generation module: connected to the rule generation module, used to automatically generate security credentials based on the dynamic management rules provided by the rule generation module. The security credentials contain unique identification information and encryption keys to ensure the uniqueness and confidentiality of the credentials;

[0073] Credential distribution module: connected to the credential generation module, used to distribute the generated security credentials to the designated server and monitor the use of the security credentials in the server;

[0074] Monitoring and detection module: connected to the credential distribution module, used to receive the usage of server security credentials and detect abnormal situations of security credentials through rule matching algorithms, including credential abuse, unauthorized access and frequent requests;

[0075] Dynamic adjustment module: connected to the monitoring and detection module, used to adjust dynamic rules based on monitoring data and abnormal situation detection results to deal with potential security threats;

[0076] Logging module: connected to the above modules, used to record the operation logs and abnormal events of each module for subsequent auditing and security analysis.

[0077] The rule generation module includes a scenario analysis unit, a connection frequency statistics unit and a history analysis unit; wherein:

[0078] Scenario analysis unit: used to analyze the actual usage scenarios of the server and generate the following dynamic management rules based on the scenarios;

[0079] Rule 1: When the server is located in an open network environment, set the expiration time of the certificate to no more than 4 hours to reduce the risk of external attacks;

[0080] Rule 2: When the server is in a high-frequency task scenario, that is, the number of operation requests per hour is greater than 100 times, the credential generation frequency is at least once per hour to ensure the timeliness of the credential;

[0081] Rule 3: When the server task scenario involves sensitive data processing, the usage permissions will be limited to only the specified data access operations to avoid opening up too many permissions;

[0082] Connection frequency statistics unit: used to count the access frequency of the server, and generate the credential generation frequency and expiration time limit based on the statistical results, setting the credential generation frequency to f gen and the voucher expiration time is t exp , the limiting conditions include:

[0083] If the server access frequency is A f Satisfy A f >200 times / hour, then f gen = 1 time / hour, and t exp =2 hours;

[0084] If the server access frequency is A f Between 100 and 200 times / hour, then f gen = 1 time / 2 hours, and t exp =4 hours;

[0085] If the server access frequency is A f <100 times / hour, then f gen = 1 time / 4 hours, and t exp =8 hours;

[0086] Historical record analysis unit: used to generate limiting conditions for usage permissions based on the server's historical operation records. By analyzing the server's past credential usage and permission settings, corresponding permission priorities are formulated to ensure that the credential permissions are consistent with the server's historical behavior, so that the generated credential permissions are set reasonably and avoid the risk of permissions being too broad or too narrow. Through the synergistic effect of the above units, the rule generation module can comprehensively consider the server's usage scenarios, connection frequency and historical operation records to generate dynamic management rules that are adapted to the server's security needs, ensuring that the credential generation frequency, expiration time and usage permissions are in line with the server's actual usage, thereby achieving efficient and secure credential management.

[0087] The historical record analysis unit includes:

[0088] Data extraction: Extract the historical data of the last three months from the server's history records. The extracted data includes the operation frequency, access resource category, and permission level of each credential.

[0089] Operation frequency statistics: The historical usage frequency of each credential is counted, and the degree of demand for permission is determined based on this; the statistical value of the historical usage frequency is set to 0. f , the formula is: Among them, A i represents the number of the ith operation, n represents the total number of operations of the voucher within the statistical range, and T represents the statistical time span in days; if O f >5 times / day, it indicates that the permission is a high-frequency permission, and the generated certificate must include this permission; if O f ≤5 times / day, the generated certificate needs to limit the frequency of use of this permission;

[0090] Access resource classification: According to the usage history of the credential, classify the resource categories involved in each credential; let the access ratio of each type of resource be R c , the formula is: Among them, R j represents the number of visits to the jth resource, m is the number of resource categories, and M is the total number of visits; if the visit ratio of a certain type of resource is R c If it is greater than 40%, it is a high-frequency access resource, and the generated credentials must limit the access rights of the corresponding resources to the highest priority;

[0091] Permission setting optimization: Based on the results of operation frequency statistics and resource classification, determine the permission priority for generating credentials; set the permission score as P r , the formula is: r =min(O f , R c ), where P r The higher the value, the greater the permission requirement; the permission range is divided into three levels:r >5, it is a high priority permission, and the credential permission is set to full access; when 2≤P r When ≤5, it is a medium priority permission, and the credential permission is set to partial access; when P r When <2, it is a low priority permission, and the credential permission is set to restricted access;

[0092] Permission consistency verification: Verify the consistency between the generated permission range and the historical behavior of the server to ensure that the set permission range is consistent with the actual usage of the server and avoid permissions that are too broad or too narrow. Specifically, the consistency ratio C between the permission range and the historical behavior is analyzed. v To determine, the formula is: If C v ≥0.8, indicating good consistency; if C v <0.8, the permission range needs to be readjusted until the consistency reaches the set standard; through the above steps, the historical record analysis unit can automatically generate accurate permission priorities based on the historical behavior of the server, ensure that the permission settings of the credentials are consistent with the actual usage requirements of the server, avoid the risk of permissions being too broad or too narrow, and improve the security and adaptability of credential management.

[0093] The credential generation module includes a credential generation unit, a unique identification generation unit and an encryption key generation unit; wherein:

[0094] Credential generation unit: used to automatically generate initial information of security credentials according to the dynamic management rules provided by the rule generation module, ensuring that the generation frequency, expiration time and usage rights of the credentials meet the requirements of the dynamic management rules;

[0095] Unique identification generation unit: used to generate unique identification information for each security credential. The unique identification information is generated by hashing the initial credential information using the SHA-256 algorithm to generate a 256-bit unique identification to ensure the uniqueness of each credential in the system and prevent duplication and conflict of credentials.

[0096] Encryption key generation unit: used to generate a corresponding encryption key for each security credential. The encryption key is generated using the Advanced Encryption Standard AES algorithm with a key length of 256 bits. A high-strength key is generated through a random number generator to ensure the confidentiality and security of the credential. Through the synergy of the above units, the credential generation module can automatically generate a security credential containing unique identification information and an encryption key based on dynamic management rules, ensuring the uniqueness and confidentiality of the credential and compliance with the requirements of dynamic management rules, thereby achieving secure generation and efficient management of the credential.

[0097] The credential distribution module includes a credential transmission unit, a server designation unit and a usage monitoring unit; wherein:

[0098] Server designation unit: used to determine the target server address of the security credential according to the system configuration or management instruction. The target server address includes the server's IP address, port number and communication protocol type to ensure that the security credential can be accurately sent to the designated server;

[0099] Credential transmission unit: connected to the server designated unit, used to send the security credentials generated by the credential generation module to the designated server through an encrypted communication channel. The encrypted communication channel is encrypted using the Transport Layer Security Protocol (TLS1.3) to ensure the confidentiality and integrity of the credentials during transmission and prevent the credentials from being intercepted or tampered with;

[0100] Usage monitoring unit: used to monitor the usage of the distributed security credentials in the server in real time, including the usage frequency F u , Use time T u And the verification result V r Among them, usage frequency monitoring is to obtain the number of times the credential is used by regularly sending usage query requests to the server. n and time interval T i , to calculate the usage frequency F u The formula is: Usage time monitoring is achieved by recording the first time the voucher is used T s and the last time of use T e , calculate the active time period T of the voucher u The formula is: T u =T e -T s ; The verification result is the success rate S of the credential verification by the collection server r , calculate the verification failure rate F r ; When the verification failure rate exceeds 5%, an abnormal event is recorded, and there may be a risk of credential tampering; through the synergy of the above units, the credential distribution module can accurately and securely distribute the generated security credentials to the designated server, and monitor the use of security credentials in the server in real time, specifically monitoring the frequency of use, usage time and verification results, to ensure the validity and security of the credentials, help to promptly discover and handle abnormal situations in the use of credentials, and improve the security management level of the system.

[0101] The monitoring and detection module includes a usage record collection unit, a rule matching unit and an anomaly detection unit; wherein:

[0102] Usage record collection unit: used to collect real-time data on the usage of server security credentials, including the usage frequency, usage time and verification results of each credential, providing complete data support for subsequent anomaly detection;

[0103] Rule matching unit: used to compare the usage data obtained by the usage record collection unit with the dynamic management rules provided by the rule generation module, and identify whether the usage behavior of the credential meets the preset normal conditions through matching rules; to ensure that each credential request is made within the scope allowed by the rules; if the usage behavior exceeds the rule limit, the rule matching unit will mark the behavior as a potential anomaly and submit it to the anomaly detection unit for analysis;

[0104] Anomaly detection unit: used to determine the anomaly type based on the potential anomalies marked by the rule matching unit and identify the specific anomaly situation.

[0105] The rule matching unit includes:

[0106] Data reception: Receive the credential usage data provided by the usage record collection unit, including the usage frequency F u , Use time T u And the verification result V r ;

[0107] Rule acquisition: Get dynamic management rules from the rule generation module. The rules include the maximum allowed usage frequency F. max , Allowed usage time range T allowed And the qualification standard V of the verification result pass ;

[0108] Frequency Matching: Compare the frequency of use F u The maximum frequency F max , if F u ≤F max ; It means the frequency is normal; otherwise, it is marked as abnormal frequency;

[0109] Usage time matching: Determine the usage time T u Is it within the permitted usage time range T? allowed If T u ∈T allowed , it indicates that the usage time is normal; otherwise, it is marked as abnormal time;

[0110] Verification result match: check verification result V r Whether it meets the qualification standard V pass , if V r =V pass , it indicates that the verification result is normal; otherwise, it is marked as verification abnormality;

[0111] Comprehensive matching judgment: Comprehensively judge the above conditions. If all conditions are met, the usage behavior of the credential is considered to meet the preset normal conditions; otherwise, it is marked as a potential anomaly;

[0112] Abnormal marking: For the usage behaviors marked as potential abnormalities, the rule matching unit will record the abnormality type (frequency abnormality, time abnormality, verification abnormality), credential identification ID and timestamp, and submit them to the abnormality detection unit for analysis; through the above steps, the rule matching unit can accurately match the credential usage with the dynamic management rules, and timely mark the behaviors that exceed the rule restrictions as potential abnormalities, providing effective technical support for the security protection of the system.

[0113] The anomaly detection unit includes:

[0114] Abnormal data reception: receiving potential abnormal data marked by the rule matching unit, including abnormal type tags, including frequency abnormality, time abnormality, and verification abnormality;

[0115] Frequency anomaly analysis: For potential anomaly data marked as frequency anomaly, the anomaly detection unit calculates the actual usage frequency F u The maximum frequency F max The deviation between the two frequencies is used to determine the severity of the frequency anomaly. The deviation calculation formula is: ΔF = F u -F max ;like It is marked as high-frequency abuse abnormality; if 0<ΔF≤10%·F max , it is marked as mild frequency abnormality;

[0116] Time anomaly analysis: For potential anomaly data marked as time anomaly, the anomaly detection unit calculates the actual usage time T u Relative to the permitted usage time range T allowed The degree of deviation ΔT is used to determine the specific type of time anomaly; if ΔT>30 minutes, it is marked as long-term continuous use anomaly; if ΔT≤30 minutes, it is marked as mild time anomaly;

[0117] Verification anomaly analysis: For potential abnormal data marked as verification anomalies, the anomaly detection unit calculates the ratio of the number of verification failures to the total number of verification requests as the basis for judging verification anomalies; the verification failure rate F r The calculation formula is: Among them, V fail is the number of verification failures, V total is the total number of verification requests; if F r >0.1 is marked as a high failure rate exception: if 0 <F r ≤0.1 is marked as a mild verification anomaly;

[0118] Comprehensive anomaly identification: When multiple anomaly types occur at the same time, the anomaly detection unit will mark them as compound anomalies and record detailed anomaly data, including credential identification ID, anomaly type, timestamp, deviation value, deviation time and verification failure rate; through the above steps, the anomaly detection unit can accurately determine the anomaly type and identify specific anomalies based on potential anomaly data, providing more refined protection measures for system security management.

[0119] The dynamic adjustment module includes a credential regeneration unit, an expiration time update unit, and a permission priority adjustment unit; wherein:

[0120] Credential regeneration unit: used to immediately trigger the regeneration of credentials when the anomaly detection unit identifies high-risk anomalies, including high-frequency abuse anomalies, long-term continuous use anomalies, or high failure rate anomalies; it will generate new security credentials based on the dynamic management rules provided by the rule generation module and revoke the original credentials; the newly generated credentials contain a unique identifier and encryption key to ensure the uniqueness and confidentiality of the credentials;

[0121] Expiration time update unit: used to dynamically update the expiration time of the credential according to the actual usage of the credential, and adjust the expiration time of the credential according to the usage frequency, usage time and verification result data. exp ; If the actual frequency F u Exceeds the preset frequency threshold F max When , the failure time t is shortened exp , updated according to the following formula: exp =t exp ×α, where α∈(0,1) is the shortening factor, set to 0.5; if the actual frequency F u Lower than or equal to the frequency threshold F max If there is no abnormal test result, the failure time t is extended. exp , updated according to the following formula: exp =t exp ×β, where β>1 is the elongation factor, set to 1.5;

[0122] Permission priority adjustment unit: used to dynamically adjust the permission priority of the credential according to the abnormal detection results to ensure that the credential permissions meet the current security requirements; permission priority P r The adjustment is based on the following conditions; if unauthorized access is detected, the permission priority is reduced, and the permission priority adjustment formula is: r =P r ×γ, where γ∈(0,1) is the reduction coefficient, set to 0.8; if the frequency F is used u And the verification result V rIf the normal conditions of the rule generation module are met and there is no abnormal record, the permission priority is restored or improved. The permission priority adjustment formula is: r =P r ×δ, where δ>1 is the improvement coefficient, which is set to 1.2. Through the synergy of the above units, the dynamic adjustment module can dynamically adjust the management rules according to the monitoring data and anomaly detection results in real time, including regenerating credentials, updating expiration time and adjusting permission priority, to deal with potential security threats and ensure the effective management and security of server credentials.

[0123] The log recording module includes a log collection unit, a log storage unit and a log analysis unit; wherein:

[0124] Log collection unit: used to collect operation logs and abnormal event information from each module in the system in real time. The operation log includes the module's operation time, operation type and operation result, and the abnormal event information includes the abnormal occurrence time and abnormal type. The log collection unit ensures the integrity and accuracy of all log information, providing a reliable basis for subsequent data storage and analysis.

[0125] Log storage unit: used to store the log information collected by the log collection unit in a predetermined format; the predetermined format includes timestamp, module identification, operation type, operation result, exception type and description field; through the synergy of the above units, the log recording module can comprehensively and accurately record the operation logs and abnormal events of each module, providing important technical support for the system's security management, performance optimization and troubleshooting.

[0126] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0127] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A server security credential automation management system based on dynamic rules, characterized in that: It includes a rule generation module, a credential generation module, a credential distribution module, a monitoring and detection module, a dynamic adjustment module and a log recording module; among which: Rule generation module: used to generate corresponding dynamic management rules according to the usage scenarios, connection frequency and historical operation records of the server, wherein the dynamic management rules include the generation frequency, expiration time and restriction conditions of the credential usage rights; Credential generation module: connected to the rule generation module, used to automatically generate security credentials according to the dynamic management rules provided by the rule generation module, the security credentials containing unique identification information and encryption keys; Credential distribution module: connected to the credential generation module, used to distribute the generated security credentials to the designated server and monitor the usage of the security credentials in the server; Monitoring and detection module: connected to the credential distribution module, used to receive the usage of the server security credentials and detect abnormal situations of the security credentials through a rule matching algorithm, including credential abuse, unauthorized access and frequent requests; Dynamic adjustment module: connected to the monitoring and detection module, used to adjust dynamic rules based on monitoring data and abnormal situation detection results to deal with potential security threats; Logging module: connected to the above modules, used to record the operation logs and abnormal events of each module.

2. The server security credential automation management system based on dynamic rules according to claim 1 is characterized in that: The rule generation module includes a scenario analysis unit, a connection frequency statistics unit and a history analysis unit; wherein: Scenario analysis unit: used to analyze the actual usage scenarios of the server and generate the following dynamic management rules based on the scenarios; Rule 1: When the server is located in an open network environment, set the expiration time of the certificate to no more than 4 hours; Rule 2: When the server is in a high-frequency task scenario, that is, the number of operation requests per hour is greater than 100 times, the credential generation frequency is at least once per hour; Rule 3: When the server task scenario involves sensitive data processing, the usage permissions will be limited to only the specified data access operations; Connection frequency statistics unit: used to count the access frequency of the server, and generate the credential generation frequency and expiration time limit based on the statistical results, setting the credential generation frequency to f gen and the voucher expiration time is t exp , the limiting conditions include: If the server access frequency is A f Satisfy A f >200 times / hour, then f gen = 1 time / hour, and t exp =2 hours; If the server access frequency is A f Between 100 and 200 times / hour, then f gen = 1 time / 2 hours, and t exp =4 hours; If the server access frequency is A f <100 times / hour, then f gen = 1 time / 4 hours, and t exp =8 hours; History analysis unit: used to generate permission-restricting conditions based on the server's historical operation records. By analyzing the server's past credential usage and permission settings, corresponding permission priorities are formulated to ensure that the credential permissions are consistent with the server's historical behavior.

3. The server security credential automation management system based on dynamic rules according to claim 2 is characterized in that: The historical record analysis unit comprises: Data extraction: Extract the historical data of the last three months from the server's history records. The extracted data includes the operation frequency, access resource category, and permission level of each credential. Operation frequency statistics: The historical usage frequency of each credential is counted, and the degree of demand for permission is determined based on this; the statistical value of the historical usage frequency is set to 0. f If O f >5 times / day, it indicates that the permission is a high-frequency permission, and the generated certificate must include this permission; if O f ≤5 times / day, the generated certificate needs to limit the frequency of use of this permission; Access resource classification: According to the usage history of the credential, classify the resource categories involved in each credential; let the access ratio of each type of resource be R c ; If the access ratio of a certain type of resource is R c If it is greater than 40%, it is a high-frequency access resource, and the generated credentials must limit the access rights of the corresponding resources to the highest priority; Permission setting optimization: Based on the results of operation frequency statistics and resource classification, determine the permission priority for generating credentials; set the permission score as P r , the formula is: r =min(O f , R c ), where P r The higher the value, the greater the permission requirement; the permission range is divided into three levels: r >5, it is a high priority permission, and the credential permission is set to full access; when 2≤P r When ≤5, it is a medium priority permission, and the credential permission is set to partial access; when P r When <2, it is a low priority permission, and the credential permission is set to restricted access; Permission consistency verification: Verify the consistency of the generated permission range with the historical behavior of the server to ensure that the set permission range is consistent with the actual usage of the server and avoid permissions that are too broad or too narrow.

4. The server security credential automation management system based on dynamic rules according to claim 1, characterized in that: The credential generation module includes a credential generation unit, a unique identification generation unit and an encryption key generation unit; wherein: Credential generation unit: used to automatically generate initial information of security credentials according to the dynamic management rules provided by the rule generation module, ensuring that the generation frequency, expiration time and usage rights of the credentials meet the requirements of the dynamic management rules; Unique identification generation unit: used to generate unique identification information for each security credential. The unique identification information is generated by hashing the initial credential information using the SHA-256 algorithm to generate a 256-bit unique identification to ensure the uniqueness of each credential in the system. Encryption key generation unit: used to generate a corresponding encryption key for each security credential. The encryption key is generated using the Advanced Encryption Standard AES algorithm with a key length of 256 bits. A high-strength key is generated through a random number generator.

5. The server security credential automation management system based on dynamic rules according to claim 1, characterized in that: The credential distribution module includes a credential transmission unit, a server designation unit and a usage monitoring unit; wherein: Server specifying unit: used to determine the target server address of the security credential according to the system configuration or management instruction, wherein the target server address includes the IP address, port number and communication protocol type of the server; Credential transmission unit: connected to the server designation unit, used to send the security credentials generated by the credential generation module to the designated server through an encrypted communication channel, and the encrypted communication channel is encrypted using the transport layer security protocol; Usage monitoring unit: used to monitor the usage of the distributed security credentials in the server in real time, including the usage frequency F u , Use time T u And the verification result V r .

6. The server security credential automation management system based on dynamic rules according to claim 5, characterized in that: The monitoring and detection module includes a usage record collection unit, a rule matching unit and an anomaly detection unit; wherein: Usage record collection unit: used to collect real-time data on the usage of server security credentials, including the usage frequency, usage time and verification results of each credential; Rule matching unit: used to compare the usage data obtained by the usage record collection unit with the dynamic management rules provided by the rule generation module, and identify whether the usage behavior of the credential meets the preset normal conditions through matching rules; if the usage behavior exceeds the rule limit, the rule matching unit will mark the behavior as a potential anomaly and submit it to the anomaly detection unit for analysis; Anomaly detection unit: used to determine the anomaly type based on the potential anomalies marked by the rule matching unit and identify the specific anomaly situation.

7. The server security credential automation management system based on dynamic rules according to claim 6, characterized in that: The rule matching unit comprises: Data reception: Receive the credential usage data provided by the usage record collection unit, the data includes the usage frequency F u , Use time T u And the verification result V r ; Rule acquisition: dynamic management rules are acquired from the rule generation module, and the rules include the maximum allowed usage frequency F max , Allowed usage time range T allowed And the qualification standard V of the verification result pass ; Frequency Matching: Compare the frequency of use F u The maximum frequency F max , if F u ≤F max ; It means the frequency is normal; otherwise, it is marked as abnormal frequency; Usage time matching: Determine the usage time T u Is it within the permitted usage time range T? allowed If T u ∈T allowed , it indicates that the usage time is normal; otherwise, it is marked as abnormal time; Verification result match: check verification result V r Whether it meets the qualification standard V pass , if V r =V pass , it indicates that the verification result is normal; otherwise, it is marked as verification abnormality; Comprehensive matching judgment: Comprehensively judge the above conditions. If all conditions are met, the usage behavior of the credential is considered to meet the preset normal conditions; otherwise, it is marked as a potential anomaly; Abnormal marking: For the usage behaviors marked as potential abnormalities, the rule matching unit will record the abnormality type, credential identification ID and timestamp, and submit it to the abnormality detection unit for analysis.

8. The server security credential automation management system based on dynamic rules according to claim 7, characterized in that: The abnormality detection unit comprises: Abnormal data reception: receiving potential abnormal data marked by the rule matching unit, wherein the data includes abnormal type marks, including frequency abnormality, time abnormality, and verification abnormality; Frequency anomaly analysis: For potential anomaly data marked as frequency anomaly, the anomaly detection unit calculates the actual usage frequency F u The maximum frequency F max The deviation between the two frequencies is used to determine the severity of the frequency anomaly. The deviation calculation formula is: ΔF = F u -F max ;like It is marked as high-frequency abuse abnormality; if 0<ΔF≤10%·F max , it is marked as mild frequency abnormality; Time anomaly analysis: For potential anomaly data marked as time anomaly, the anomaly detection unit calculates the actual usage time T u Relative to the permitted usage time range T allowed The degree of deviation ΔT is used to determine the specific type of time anomaly; if ΔT>30 minutes, it is marked as long-term continuous use anomaly; if ΔT≤30 minutes, it is marked as mild time anomaly; Verification anomaly analysis: For potential abnormal data marked as verification anomalies, the anomaly detection unit calculates the ratio of the number of verification failures to the total number of verification requests as the basis for judging verification anomalies; the verification failure rate F r The calculation formula is: Among them, V fail is the number of verification failures, V total is the total number of verification requests; if F r >0.1 is marked as a high failure rate exception: if 0 <F r ≤0.1 is marked as a mild verification anomaly; Comprehensive anomaly identification: When multiple anomaly types occur simultaneously, the anomaly detection unit will mark them as compound anomalies and record detailed anomaly data, including credential identification ID, anomaly type, timestamp, deviation value, deviation time, and verification failure rate.

9. The server security credential automation management system based on dynamic rules according to claim 1, characterized in that: The dynamic adjustment module includes a credential regeneration unit, an expiration time update unit and a permission priority adjustment unit; wherein: Credential regeneration unit: used to immediately trigger the regeneration of credentials when the anomaly detection unit identifies high-risk anomalies, including high-frequency abuse anomalies, long-term continuous use anomalies, or high failure rate anomalies; it will generate new security credentials based on the dynamic management rules provided by the rule generation module and revoke the original credentials; Expiration time update unit: used to dynamically update the expiration time of the credential according to the actual usage of the credential, and adjust the expiration time of the credential according to the usage frequency, usage time and verification result data. exp ; If the actual frequency F u Exceeds the preset frequency threshold F max When , the failure time t is shortened exp , updated according to the following formula: exp =t exp ×α, where α∈(0,1) is the shortening factor, set to 0.5; if the actual frequency F u Lower than or equal to the frequency threshold F max If there is no abnormal test result, the failure time t is extended. exp , updated according to the following formula: exp =t exp ×β, where β>1 is the elongation factor, set to 1.5; Permission priority adjustment unit: used to dynamically adjust the permission priority of the credential according to the abnormal detection results to ensure that the credential permissions meet the current security requirements; permission priority P r The adjustment is based on the following conditions; if unauthorized access is detected, the permission priority is reduced, and the permission priority adjustment formula is: r =P r ×γ, where γ∈(0,1) is the reduction coefficient, set to 0.8; if the frequency F is used u And the verification result V r If the normal conditions of the rule generation module are met and there is no abnormal record, the permission priority is restored or improved. The permission priority adjustment formula is: r =P r ×δ, where δ>1 is the boost factor, which is set to 1.

2.

10. The server security credential automation management system based on dynamic rules according to claim 1, characterized in that: The log recording module includes a log collection unit, a log storage unit and a log analysis unit; wherein: Log collection unit: used to collect operation logs and abnormal event information from each module in the system in real time. The operation log includes the operation time, operation type and operation result of the module, and the abnormal event information includes the abnormal occurrence time and abnormal type; Log storage unit: used to store the log information collected by the log collection unit in a predetermined format; the predetermined format includes a timestamp, a module identifier, an operation type, an operation result, an exception type, and a description field.

Images