Configuration mode credible switching method, system and equipment with authority management and medium

Abstract

The invention discloses a configuration mode credible switching method, system and device with authority management and a medium. The method comprises the steps that a strategy file in a JSON format is formed; the trusted management platform verifies the information of a user to be logged in, after the verification is passed, the user logs in the client, analyzes and displays the strategy file in the JSON format through the client, selects equipment needing to be issued, and sends the equipment information needing to be issued, the strategy file and the information of the current logged-in user to the trusted management platform; the method, the system, the equipment and the medium can ensure the safety of the equipment.

Description

Technical Field

[0001] The invention belongs to the technical field of trusted control, and relates to a trusted logging-in and logging-out method, system, equipment and medium in a configuration mode with authority management. Background Art

[0002] A distributed control system (DCS) consists of a controller, an operator station, an engineer station, and a history station. In order to enhance the security of this system, these devices are registered in a trusted management platform and trusted technology is used for trust enhancement.

[0003] In recent years, with the increasing complexity of network environments and the increasing number of security threats, trusted computing technologies have developed rapidly. By using these technologies, a trusted operating environment can be established on the local host to provide security for various applications. Especially in the thermal power generation environment, the security requirements for equipment are getting higher and higher, but the security of current equipment does not meet the requirements. Summary of the invention

[0004] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a configuration-based trusted entry and exit method, system, device and medium with authority management, which can ensure the security of the device.

[0005] To achieve the above object, the present invention discloses a configuration-based trusted entry and exit method with authority management, comprising:

[0006] When a user logs into the trusted management platform, the authority requirements for policy investment and withdrawal are determined based on at least one of the user's location, device status, and operation history;

[0007] Use a configuration tool to generate a policy file that needs to be cast or withdrawn, wherein the policy file includes a policy file in JSON format of a trusted policy;

[0008] Perform multi-level verification of user permissions based on the permission requirements, user permissions, device status, and time information. After verification, parse and display the policy file in JSON format;

[0009] Obtain the device information selected by the user for policy rollback;

[0010] The device information, policy file and user information are sent to the trusted management platform, and the policy investment and withdrawal log is recorded.

[0011] Furthermore, the configuration tool is used to generate a policy file that needs to be invested and withdrawn, including:

[0012] When the trusted policy on the device needs to be cast or withdrawn, the configuration tool is used to display the file system on the device, and the policy is configured for the files that need trusted protection to form a policy file in JSON format.

[0013] Furthermore, in the multi-level verification of user rights, the verification weight of the user rights ranges from 40% to 60%, the verification weight of the device trusted status ranges from 20% to 40%, and the verification weight of the time information ranges from 10% to 30%.

[0014] Furthermore, the method further comprises:

[0015] Two-factor authentication method based on USB-key and user name and password verification login method to authenticate users;

[0016] The multi-level verification of user authority based on the authority requirement, user authority, device status and time information includes:

[0017] Verify whether the user meets the permission requirement based on the permission requirement and the user authority, and if the user does not meet the permission requirement, the verification fails;

[0018] Verify the trust status of the device logged in by the user based on the device status, and if the device is not trustworthy, the verification fails;

[0019] Furthermore, the method further comprises:

[0020] Based on the time information, it is verified whether the login time is normal office hours. When the login time is non-normal office hours, the user's operation time is limited.

[0021] Furthermore, the method further comprises:

[0022] Verify user permissions through the trusted management platform. When the user permissions are verified, the trusted policy is applied to the device.

[0023] When the user authority verification fails, the trusted policy rollback is canceled and the trusted policy rollback log is recorded.

[0024] The present invention discloses a configuration-based trusted entry and exit system with authority management, comprising:

[0025] A determination module, used to determine the authority requirements for policy investment and withdrawal based on at least one of the user's location, device status, and operation history when the user logs into the trusted management platform;

[0026] A generation module is used to use a configuration tool to generate a policy file that needs to be invested and withdrawn, wherein the policy file includes a policy file in JSON format of a trusted policy;

[0027] A verification module is used to perform multi-level verification of user permissions based on the permission requirements, user permissions, device status, and time information. After the verification is passed, the policy file in JSON format is parsed and displayed;

[0028] An acquisition module is used to obtain the device information selected by the user for policy withdrawal;

[0029] The sending module is used to send the device information, policy files and user information to the trusted management platform and record the policy investment and withdrawal log.

[0030] The further improvement of the configuration mode trusted entry and exit system with authority management described in the present invention is:

[0031] Furthermore, the configuration tool is used to generate a policy file that needs to be invested and withdrawn, including:

[0032] When the trusted policy on the device needs to be cast or withdrawn, the configuration tool is used to display the file system on the device, and the policy is configured for the files that need trusted protection to form a policy file in JSON format.

[0033] Furthermore, in the multi-level verification of user rights, the verification weight of the user rights ranges from 40% to 60%, the verification weight of the device trusted status ranges from 20% to 40%, and the verification weight of the time information ranges from 10% to 30%.

[0034] Furthermore, the method further comprises:

[0035] Two-factor authentication method based on USB-key and user name and password verification login method to authenticate users;

[0036] The multi-level verification of user authority based on the authority requirement, user authority, device status and time information includes:

[0037] Verify whether the user meets the permission requirement based on the permission requirement and the user authority, and if the user does not meet the permission requirement, the verification fails;

[0038] Verify the trust status of the device logged in by the user based on the device status, and if the device is not trustworthy, the verification fails;

[0039] Furthermore, the method further comprises:

[0040] Based on the time information, it is verified whether the login time is normal office hours. When the login time is non-normal office hours, the user's operation time is limited.

[0041] Furthermore, the method further comprises:

[0042] Verify user permissions through the trusted management platform. When the user permissions are verified, the trusted policy is applied to the device.

[0043] When the user authority verification fails, the trusted policy rollback is canceled and the trusted policy rollback log is recorded.

[0044] The present invention discloses a computer device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the configuration mode trusted entry and exit method with authority management are implemented.

[0045] The present invention discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the configuration-based trusted entry and exit method with authority management are implemented.

[0046] The present invention has the following beneficial effects:

[0047] The trusted rollback method, system, device and medium with configuration mode with permission management described in the present invention, during specific operation, verifies the user information, device information and time information to be logged in through a trusted management platform, and conducts comprehensive verification based on the user information, device information and time information. After the verification is passed, the user logs in to the client, parses and displays the policy file in JSON format through the client, selects the device to be issued, and sends the device information and policy file to be issued as well as the currently logged in user information, device information and time information to the trusted management platform, that is, the trusted policy is issued and withdrawn by the correct person, ensuring that in the trusted management platform, only users with corresponding permissions can execute the trusted policy rollback policy. This comprehensive, intelligent and dynamic permission management and trusted rollback method can enhance the security and credibility of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0049] Figure 1 One of the flow charts of a configuration mode trusted entry and exit method with authority management provided by the present invention;

[0050] Figure 2 The second flowchart of a configuration mode trusted entry and exit method with authority management provided by the present invention;

[0051] Figure 3 A structural diagram of a configuration-based trusted entry and exit system with authority management provided by the present invention;

[0052] Figure 4 A structural diagram of a computer device provided by the present invention. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] In the description of the present invention, it should be understood that the terms “include” and “comprises” indicate the presence of described features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0055] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0056] It should be further understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in the present invention generally indicates that the associated objects are in an "or" relationship.

[0057] It should be understood that, although the terms first, second, third, etc. may be used to describe preset ranges, etc. in the embodiments of the present invention, these preset ranges should not be limited to these terms. These terms are only used to distinguish preset ranges from each other. For example, without departing from the scope of the embodiments of the present invention, the first preset range may also be referred to as the second preset range, and similarly, the second preset range may also be referred to as the first preset range.

[0058] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0059] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention described and shown in the drawings here can usually be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0060] Various structural schematic diagrams of the embodiments disclosed in the present invention are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0061] Permission control is an important part of system security. It requires that only legitimate users can access the system, and users must have access rights to the corresponding resources to perform operations. Permission control is generally divided into two stages: identity identification (Authentication) and permission identification (Authorization). Identity authentication mainly determines the identity of the visitor, while permission identification determines whether the visitor has the permission to the corresponding resources.

[0062] The trusted management platform is a complete device management platform based on trusted technology. The authority control is implemented in accordance with the rules of the Security Management Center of the 2.0 Security Protection System, meeting the requirements of the 2.0 Security Protection System. Use the authority control function to configure trusted policies, so that the thermal power generation system can use trusted technology efficiently and reliably to improve system security. Edit policies through configuration tools, and the trusted management platform performs authority control to ensure that only users with corresponding authority can perform trusted policy activation and deactivation operations. The main purpose of this method is to ensure that in the trusted management platform, only users or administrators with corresponding authority can perform trusted policy activation and deactivation operations, thereby enhancing the security and credibility of the system.

[0063] In the trusted management platform, the idea of ​​separation of powers is adopted to divide user roles into four types: system administrator, audit administrator, security administrator, and business administrator. Among them, the business administrator role is divided into editable permissions and read-only permissions based on resource control. The client displays different menus and operations according to user roles and permissions, and the trusted management platform verifies the user's role and permissions.

[0064] For users who are registered and assigned permissions in the trusted management platform, when the client is displayed, the menu is displayed according to the user's permissions, and only the menus and operation buttons with permissions are displayed. The user permissions are verified in the management platform, so that users with corresponding permissions can perform trusted policy rollback operations. At the same time, the client and the trusted management platform will record logs for troubleshooting policy rollback logs, so that when a device fails, the person responsible can be found and the rights and responsibilities are clear. At the same time, it is ensured that in the trusted management platform, only users or administrators with corresponding permissions can perform trusted policy rollback operations, thereby enhancing the security and credibility of the system.

[0065] See also Figure 1 , Figure 1 A flow chart of a configuration-based trusted subscription and withdrawal method with authority management provided by an embodiment of the present invention includes the following steps:

[0066] When a user logs into the trusted management platform, the authority requirements for policy investment and withdrawal are determined based on at least one of the user's location, device status, and operation history;

[0067] Use a configuration tool to generate a policy file that needs to be cast or withdrawn, wherein the policy file includes a policy file in JSON format of a trusted policy;

[0068] Perform multi-level verification of user permissions based on the permission requirements, user permissions, device status, and time information. After verification, parse and display the policy file in JSON format;

[0069] Obtain the device information selected by the user for policy rollback;

[0070] The device information, policy file and user information are sent to the trusted management platform, and the policy investment and withdrawal log is recorded.

[0071] Furthermore, the configuration tool is used to generate a policy file that needs to be invested and withdrawn, including:

[0072] When the trusted policy on the device needs to be cast or withdrawn, the configuration tool is used to display the file system on the device, and the policy is configured for the files that need trusted protection to form a policy file in JSON format.

[0073] Furthermore, in the multi-level verification of user rights, the verification weight of the user rights ranges from 40% to 60%, the verification weight of the device trusted status ranges from 20% to 40%, and the verification weight of the time information ranges from 10% to 30%.

[0074] Furthermore, the method further comprises:

[0075] Two-factor authentication method based on USB-key and user name and password verification login method to authenticate users;

[0076] The multi-level verification of user authority based on the authority requirement, user authority, device status and time information includes:

[0077] Verify whether the user meets the permission requirement based on the permission requirement and the user authority, and if the user does not meet the permission requirement, the verification fails;

[0078] Verify the trust status of the device logged in by the user based on the device status, and if the device is not trustworthy, the verification fails;

[0079] Furthermore, the method further comprises:

[0080] Based on the time information, it is verified whether the login time is normal office hours. When the login time is non-normal office hours, the user's operation time is limited.

[0081] Furthermore, the method further comprises:

[0082] Verify user permissions through the trusted management platform. When the user permissions are verified, the trusted policy is applied to the device.

[0083] When the user authority verification fails, the trusted policy rollback is canceled and the trusted policy rollback log is recorded.

[0084] The following is a further explanation of the configuration-based trusted subscription and withdrawal method with authority management provided by the embodiment of the present invention with some specific embodiments:

[0085] Embodiment 1

[0086] Based on the above, reference Figure 2 The configuration mode trusted entry and exit method with authority management described in the present invention comprises the following steps:

[0087] 1) Edit and generate a trusted policy file;

[0088] When the trusted policy is deployed or withdrawn, the configuration tool displays the file system on the device, configures the policy for the files that need trusted protection, that is, the deployment or withdrawal of the trusted policy, to form a policy file in JSON format, where the configuration policy is the deployment policy and the deletion policy is the rollback policy. The policy includes the boot verification policy, file integrity verification policy, process prevention of malicious killing policy, whitelist policy, and application access control policy to form a policy file in JSON format, and the policy file contains one or more policies.

[0089] 2) Log in to the client platform;

[0090] The user logs in to the trusted management platform for identity authentication. There are two ways to verify: the first is a two-factor authentication method based on USB-key; the second is to use username and password verification to log in. After the two-factor authentication is passed, the system first checks the trusted status of the device. If unauthorized software installation or hardware modification is found on the device, the login is denied. If the device is trusted, you can log in to the trusted management platform correctly and modify the device's policy.

[0091] 3) Client verification strategy;

[0092] The user logs in to the client, and the trusted management platform verifies the login user information. If the verification is passed, the user logs in to the client, and the client parses and displays the policy file in JSON format to check whether the policy content is correct. After confirmation, the device to be issued is selected, and then the device information, policy file and current login user information are sent to the trusted management platform. The client records the policy investment and withdrawal log so that when the device fails, it can be used for investigation and to find the responsible person to ensure clear rights and responsibilities.

[0093] 4) The trusted management platform verifies permissions;

[0094] The user rights are verified in the trusted management platform, and the user rights verification adopts a comprehensive verification mechanism: in the multi-level verification mechanism, the verification weight of user rights accounts for 40%-60%, the verification weight of the device's trusted status accounts for 20%-40%, and the verification weight of time information accounts for 10%-30%. If the permission verification passes, the trusted policy will be deployed to the device. If the permission verification fails, the trusted policy deployment fails. The trusted management platform records the trusted policy deployment log so that when the device fails, it can be used for investigation and the person responsible can be found to ensure clear rights and responsibilities.

[0095] If the device is trustworthy, the login time is checked. If the login is made during non-working hours, only part of the device status is allowed to be viewed and the operation time is limited to 15 minutes. If the login is made during normal working hours, comprehensive verification is performed based on user permissions (such as ordinary employees, department heads, system administrators, etc.), the current status of the device (such as whether there are unfinished security updates, etc.) and time information (such as whether it is during business peak hours).

[0096] It should be noted that, when the terminal policy of a DCS system with a trusted enhancement function needs to be updated, the trusted policy is activated or deactivated by the correct person, ensuring that in the trusted management platform, only users or administrators with corresponding permissions can execute trusted policy activation or deactivation operations, while ensuring clear rights and responsibilities, thereby enhancing the security and credibility of the system.

[0097] Embodiment 2

[0098] The configuration mode trusted entry and exit system with authority management described in the present invention is as follows: Figure 3 As shown, including:

[0099] A determination module, used to determine the authority requirements for policy investment and withdrawal based on at least one of the user's location, device status, and operation history when the user logs into the trusted management platform;

[0100] A generation module is used to use a configuration tool to generate a policy file that needs to be invested and withdrawn, wherein the policy file includes a policy file in JSON format of a trusted policy;

[0101] A verification module is used to perform multi-level verification of user permissions based on the permission requirements, user permissions, device status, and time information. After the verification is passed, the policy file in JSON format is parsed and displayed;

[0102] An acquisition module is used to obtain the device information selected by the user for policy withdrawal;

[0103] The sending module is used to send the device information, policy files and user information to the trusted management platform and record the policy investment and withdrawal log.

[0104] The further improvement of the configuration mode trusted entry and exit system with authority management described in the present invention is:

[0105] Furthermore, the configuration tool is used to generate a policy file that needs to be invested and withdrawn, including:

[0106] When the trusted policy on the device needs to be cast or withdrawn, the configuration tool is used to display the file system on the device, and the policy is configured for the files that need trusted protection to form a policy file in JSON format.

[0107] Furthermore, in the multi-level verification of user rights, the verification weight of the user rights ranges from 40% to 60%, the verification weight of the device trusted status ranges from 20% to 40%, and the verification weight of the time information ranges from 10% to 30%.

[0108] Furthermore, the method further comprises:

[0109] Two-factor authentication method based on USB-key and user name and password verification login method to authenticate users;

[0110] The multi-level verification of user authority based on the authority requirement, user authority, device status and time information includes:

[0111] Verify whether the user meets the permission requirement based on the permission requirement and the user authority, and if the user does not meet the permission requirement, the verification fails;

[0112] Verify the trust status of the device logged in by the user based on the device status, and if the device is not trustworthy, the verification fails;

[0113] Furthermore, the method further comprises:

[0114] Based on the time information, it is verified whether the login time is normal office hours. When the login time is non-normal office hours, the user's operation time is limited.

[0115] Furthermore, the method further comprises:

[0116] Verify user permissions through the trusted management platform. When the user permissions are verified, the trusted policy is applied to the device.

[0117] When the user authority verification fails, the trusted policy rollback is canceled and the trusted policy rollback log is recorded.

[0118] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0119] Embodiment 3

[0120] A computer device such as Figure 4As shown, it includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of implementing the trusted rollback method of the configuration mode with permission management are implemented, for example, including: forming a policy file in JSON format; verifying the user information to be logged in through a trusted management platform, after the verification is passed, the user logs in to the client, parsing and displaying the policy file in JSON format through the client, and selecting the device to be issued, sending the device information to be issued, the policy file and the currently logged in user information to the trusted management platform, and the client records the policy rollback log; verifying the user authority through the trusted management platform, after the user authority verification is passed, the trusted policy rollback is rolled back to the device; when the authority verification fails, the trusted policy rollback fails, and the trusted management platform records the trusted policy rollback log. Wherein, the memory may include a memory, such as a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk memory, etc.; the processor, the network interface, and the memory are interconnected through an internal bus, and the internal bus can be an industrial standard architecture bus, a peripheral component interconnection standard bus, an extended industrial standard structure bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory is used to store programs, specifically, the programs may include program codes, and the program codes include computer operation instructions. The memory may include internal memory and non-volatile memory, and provide instructions and data to the processor.

[0121] Embodiment 4

[0122] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of implementing the trusted rollback method of the configuration mode with permission management are implemented, for example, including: forming a policy file in JSON format; verifying the user information to be logged in through a trusted management platform, after the verification is passed, the user logs in to the client, parsing and displaying the policy file in JSON format through the client, and selecting the device to be issued, sending the device information to be issued, the policy file and the currently logged in user information to the trusted management platform, and the client recording the policy rollback log; verifying the user authority through the trusted management platform, after the user authority verification is passed, the trusted policy is rolled back to the device; when the authority verification fails, the trusted policy rollback fails, and the trusted management platform records the trusted policy rollback log. Specifically, the computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. The volatile memory may include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include read-only memory (ROM), hard disk, flash memory, optical disk, disk, etc.

[0123] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0124] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0125] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0126] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0127] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and disclosure of the invention. This application is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

[0128] It should be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

[0129] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any way. Any simple modification, change and equivalent structural change made to the above embodiment based on the technical essence of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A configuration-based trusted entry and exit method with authority management, characterized in that: include: When a user logs into the trusted management platform, the authority requirements for policy investment and withdrawal are determined based on at least one of the user's location, device status, and operation history; Use a configuration tool to generate a policy file that needs to be cast and withdrawn, wherein the policy file includes a policy file in JSON format of a trusted policy; Perform multi-level verification of user permissions based on the permission requirements, user permissions, device status, and time information. After verification, parse and display the policy file in JSON format; Obtain the device information selected by the user for policy rollback; The device information, policy files and user information are sent to the trusted management platform, and the policy investment and withdrawal log is recorded.

2. The method according to claim 1, characterized in that: The configuration tool is used to generate the policy file that needs to be invested and withdrawn, including: When the trusted policy on the device needs to be cast or withdrawn, the configuration tool is used to display the file system on the device, and the policy is configured for the files that need trusted protection to form a policy file in JSON format.

3. The configuration mode trusted entry and exit method with authority management according to claim 1 is characterized in that: In the multi-level verification of user rights, the verification weight of the user rights ranges from 40% to 60%, the verification weight of the device trusted status ranges from 20% to 40%, and the verification weight of the time information ranges from 10% to 30%.

4. The configuration mode trusted entry and exit method with authority management according to claim 1 is characterized in that: Also includes: Two-factor authentication method based on USB-key and user name and password verification login method to authenticate users; The multi-level verification of user authority based on the authority requirement, user authority, device status and time information includes: Verify whether the user meets the permission requirement based on the permission requirement and the user authority, and if the user does not meet the permission requirement, the verification fails; The trust status of the device logged in by the user is verified based on the device status. If the device is not trustworthy, the verification fails.

5. The configuration mode trusted entry and exit method with authority management according to claim 1 is characterized in that: Also includes: Based on the time information, it is verified whether the login time is normal office hours. When the login time is non-normal office hours, the user's operation time is limited.

6. The configuration-based trusted entry and exit method with authority management according to claim 1 is characterized in that: Also includes: Verify user permissions through the trusted management platform. When the user permissions are verified, the trusted policy is applied to the device. When the user authority verification fails, the trusted policy rollback is canceled and the trusted policy rollback log is recorded.

7. A configuration-based trusted entry and exit system with authority management, characterized in that: include: A determination module, used to determine the authority requirements for policy investment and withdrawal based on at least one of the user's location, device status, and operation history when the user logs into the trusted management platform; A generation module is used to use a configuration tool to generate a policy file that needs to be invested and withdrawn, wherein the policy file includes a policy file in JSON format of a trusted policy; A verification module is used to perform multi-level verification of user permissions based on the permission requirements, user permissions, device status, and time information. After the verification is passed, the policy file in JSON format is parsed and displayed; An acquisition module is used to obtain the device information selected by the user for policy withdrawal; The sending module is used to send the device information, policy files and user information to the trusted management platform and record the policy investment and withdrawal log.

8. The configuration-based trusted entry and exit system with authority management according to claim 7 is characterized in that: The configuration tool is used to generate the policy file that needs to be invested and withdrawn, including: When the trusted policy on the device needs to be cast or withdrawn, the configuration tool is used to display the file system on the device, and the policy is configured for the files that need trusted protection to form a policy file in JSON format.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the configuration-based trusted entry and exit method with authority management as described in any one of claims 1-6 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, the steps of the configuration-based trusted entry and exit method with authority management as described in any one of claims 1-6 are implemented.

Images