Concealed asset equipment account password security management method and system
By integrating asset equipment account passwords into the management platform required by the enterprise, access control and multi-factor authentication are implemented, the problem of account password leakage and management in traditional management methods is solved, and higher security and management efficiency are achieved.
Patent Information
- Application Number
- CN202510146706.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-02-10
- Publication Date
- 2025-04-25
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Traditional asset device account password management methods have the risk of account password leakage or being hacked, and centralized management is difficult to effectively manage a large number of devices, resulting in repetition and maintenance of account passwords.
Adopt the hidden asset device account password security management method, and through the account password management platform required by the enterprise, all asset account passwords are integrated, access control is implemented, dynamic passwords and multi-factor authentication are enabled, accounts are sorted, and account list system is established, and account disabling and password reset are realized through the platform.
Effectively prevent account password leakage, ensure the safe operation of asset equipment, reduce management burden, and improve security and traceability.
Smart Images
Figure CN119892480A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of enterprise management, and in particular to a method and system for securely managing account numbers and passwords of hidden asset equipment. Background Art
[0002] In recent years, with the rapid development of mobile Internet and the widespread application of smart Internet of Things technology, the number of assets and equipment has increased sharply, and the security management of equipment accounts and passwords has become increasingly prominent. Traditional asset and equipment account and password management methods, such as storing passwords in static files or databases, have risks such as account and password leakage and hacker attacks. At the same time, the large number of assets and equipment also makes it difficult to effectively manage traditional centralized management methods, resulting in problems such as duplication of accounts and passwords and difficulty in maintenance.
[0003] In order to solve the above problems, the existing technology mainly adopts the following methods in asset equipment account password management: First, account passwords are allocated based on unique device IDs, but there is a lack of effective password strength strategies and multi-factor authentication mechanisms, and there are still security risks. Second, a centralized password management system based on the cloud can be built. Although centralized management of account passwords can be achieved, the security of the cloud system has not been guaranteed and there is a risk of being attacked. Third, a management method based on biometric authentication such as face recognition and fingerprint recognition is adopted. Although security is improved, it is limited by device resources and application scenarios and is difficult to be widely used.
[0004] In view of the above-mentioned technical defects, a hidden asset equipment account password security management method and system solution are proposed. Summary of the invention
[0005] To solve the above problems, the present invention provides the following technical solutions:
[0006] A method for securely managing a hidden asset device account number and password, comprising:
[0007] Select an account and password management platform that meets the needs of the enterprise, integrate all the enterprise's asset accounts and passwords into the platform, and implement access control on the management platform;
[0008] Enable dynamic passwords for the company's asset accounts, combine the company's security policies, enable multi-factor authentication, and manage the generation, update, and application of dynamic passwords through the platform to ensure that no manual intervention is required;
[0009] Classify and sort all the asset and equipment accounts of the enterprise, and clearly identify the account owners; link the accounts with their responsible persons, trace the account users, and be able to grasp the account usage in real time; establish an account list system, regularly review and update, and confirm the use rights, usage and holders of each account;
[0010] In response to employee resignation, transfer or job change, an account recovery process is established, and an automated account disabling and password reset mechanism is implemented through the platform. Once an employee resigns or changes, the corresponding account will be automatically locked within the specified time and the password update will be triggered. A comprehensive password reset will be performed within the specified time after the employee resigns.
[0011] Furthermore, the account and password management platform for the selected enterprise needs integrates all the enterprise's asset account and passwords into the selected platform, including servers, network equipment, applications, and databases; classifies and labels asset accounts for easy search and permission allocation, implements multi-factor authentication, such as passwords combined with SMS verification codes, hardware tokens or biometrics, to enhance the security of identity authentication, and role-based access control, assigning different permissions according to the user's role and responsibilities. Ensure that users access the resources they need for their work, follow the principle of least privilege, grant users the minimum permissions necessary to complete the task, and implement approval processes for sensitive operations or high-privilege access to ensure that the operations are authorized.
[0012] Furthermore, the dynamic passwords enabled for the asset accounts of the enterprise ensure that users must pass identity authentication before accessing the management platform, support multi-factor authentication, role-based access control, create roles, assign specific permissions to each role, bind users to roles, restrict users from performing operations permitted by their roles, set up approval processes for important operations, record approval requests and results, ensure traceability, record all access and operation logs, monitor abnormal behavior in real time, regularly review access logs and permission configurations to ensure reasonable configurations, use automated tools for audits, and generate audit reports;
[0013] The generation of dynamic passwords includes building a dynamic password function, and the calculation formula is as follows:
[0014] TOTP=Truncate(HMAC-SHA-1(K,(T-T0) / X)),
[0015] Among them, TOTP is the dynamic key, Truncate is the truncation function to intercept the dynamic password, K is the user's current key, T0 is the starting time, and HMAC-SHA-1 is the hash function.
[0016] Furthermore, the enterprise classifies and organizes all asset equipment accounts to identify all asset equipment and their corresponding accounts, uses asset discovery tools to scan the network, records equipment information and accounts, classifies by equipment type, classifies by account permissions, uses a configuration management database or asset management system, assigns a person in charge to each account, and records the account creation date and usage information;
[0017] Collect enterprise account data and password data to establish a database, analyze and process the data in the database, match and screen abnormal point data and management accounts, and the calculation formula is as follows:
[0018]
[0019] Among them, d(x i ,c j ) is the abnormal point difference distance, is the i-th account, is the jth cluster;
[0020] The regression model is built based on the data parameters of the database. The calculation formula is as follows:
[0021]
[0022] Among them, w i is the number of logins, is the average number of logins.
[0023] Furthermore, the account recovery process established for employee resignation, transfer or job change includes integration with the enterprise's human resources management system, real-time acquisition of employee resignation, transfer or job change information, setting trigger events, and automatically triggering the account recovery process when the employee's status changes. On the day of the employee's resignation or job change, the system automatically locks all relevant accounts of the employee and revokes the employee's access rights to ensure that he or she can no longer access any enterprise resources. Within a specified time after the employee's resignation, the system automatically triggers the password reset process and notifies the relevant departments via email or text message to perform necessary manual confirmation or verification.
[0024] Furthermore, the account recovery process established for employee resignation, transfer or job change includes using the API interface to synchronize data with the HR system to ensure real-time updating of employee information, including changes in employment, resignation and transfer status, setting a trigger mechanism to automatically send notifications to the account management platform when the employee status changes, using scripts or API to call automation tools to lock the designated account, automatically performing the account lock operation at midnight on the day of the employee's resignation or job change, revoking the employee's access rights through the role management module, recording operation logs of account locks and revocations to ensure traceability, using password management tools to automatically trigger the password reset process, performing the password reset operation within a specified time after the employee's resignation, and the system automatically sending emails or text messages to notify relevant personnel for confirmation. After receiving the notification, the IT department performs necessary manual confirmation or verification.
[0025] According to another aspect of the present invention, a hidden asset equipment account password security management system is provided, comprising:
[0026] Authentication module: responsible for verifying the user's identity and ensuring that only authorized users can access the system. Authentication methods include multi-factor authentication, biometrics, and smart cards;
[0027] Account management module: used to create, update, delete and manage device accounts, ensure that the permissions of each account are set correctly, and prevent unauthorized access;
[0028] Password management module: responsible for generating, storing and managing device passwords, usually including automatic generation of strong passwords, regular password changes, and encrypted password storage functions to ensure password security;
[0029] Audit and log module: records all account and password related operation logs, including login attempts, password changes, and account creation, which helps track and audit system usage and detect and prevent potential security threats;
[0030] Secure communication module: ensures data encryption within the system and when communicating with external systems to prevent data from being stolen or tampered with during transmission;
[0031] Policy management module: Set and execute security policies, such as password complexity requirements, password validity period, and account lockout policies, to enhance the overall security of the system;
[0032] Emergency response module: Provides rapid response and recovery functions when security incidents occur, including account lockout, emergency password reset, and security alerts.
[0033] Furthermore, the management system provides a user-friendly interface to facilitate administrators and users to manage accounts and passwords, and allows the system to be integrated with other security systems or devices, such as network firewalls and intrusion detection systems, to form a complete security management system that continuously monitors the security status of the system, detects abnormal behavior, and issues alarms when potential threats are detected so that timely measures can be taken.
[0034] According to one aspect of the present invention, there is provided a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned method for secure management of hidden asset device account numbers and passwords when executing the computer program.
[0035] According to one aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the above-mentioned method for secure management of hidden asset device account numbers and passwords are implemented.
[0036] Compared with the prior art, the present invention has the following beneficial effects:
[0037] The present invention provides a hidden asset equipment account password security management method and system. By selecting an account password management platform required by an enterprise, all the asset account passwords of the enterprise are integrated into the platform, and access control is implemented on the management platform; in combination with the enterprise's security policy, multi-factor authentication is enabled, and the generation, update and application process of dynamic passwords are managed through the platform; the account and its person in charge are linked to the account user; an account list system is established, and regular reviews and updates are made to confirm the use rights, usage and holder of each account; an automated account disabling and password reset mechanism is implemented through the platform, and when an employee resigns or changes, the corresponding account will be automatically locked within a specified time and a password update will be triggered. A comprehensive password reset is performed within a specified time after the employee resigns, which has the effect of effectively preventing account password leakage and ensuring the safe operation of hidden asset equipment. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings;
[0039] Figure 1 It is a schematic diagram of the overall framework of a hidden asset equipment account password security management method of the present invention;
[0040] Figure 2 A schematic diagram of a framework of a hidden asset equipment account and password security management system of the present invention;
[0041] Figure 3 The present invention is a schematic diagram of the structure of a computer device in a method for securely managing a hidden asset device account number and password. DETAILED DESCRIPTION
[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0043] like Figure 1-Figure 3 As shown, the present application provides a method for securely managing a hidden asset device account and password, including:
[0044] S1: Select the account and password management platform that meets the needs of the enterprise, integrate all the enterprise's asset accounts and passwords into the platform, and implement access control on the management platform;
[0045] S2: Enable dynamic passwords for the company's asset accounts, combine the company's security policies, enable multi-factor authentication, and manage the generation, update, and application of dynamic passwords through the platform to ensure that no manual intervention is required;
[0046] S3: Classify and organize all asset and equipment accounts of the enterprise, and clearly identify the account owners; link the accounts with their responsible persons, trace the account users, and be able to grasp the account usage in real time; establish an account list system, regularly review and update, and confirm the usage rights, usage and holders of each account;
[0047] S4: Establish an account recovery process for employees who resign, transfer or change positions, and implement an automated account disabling and password reset mechanism through the platform. Once an employee resigns or changes positions, the corresponding account will be automatically locked within the specified time and the password update will be triggered. A comprehensive password reset will be performed within the specified time after the employee resigns.
[0048] In one embodiment, a suitable account and password management platform is selected according to the specific needs of the enterprise, and factors to be considered include security, ease of use, scalability, supported authentication methods, and integration capabilities with existing systems.
[0049] Platform integration: Integrate all the company's asset accounts and passwords onto the selected platform to achieve centralized management.
[0050] Permission management: Implement strict access control on the management platform to ensure that only authorized users can access and manage account passwords.
[0051] Role allocation: Different roles and permissions are assigned according to user responsibilities and needs to implement the principle of least privilege.
[0052] Dynamic password: Enable a dynamic password for each asset account. The dynamic password is usually generated by a one-time password (OTP) generator to ensure that each password used is unique.
[0053] Multi-factor authentication: In combination with enterprise security policies, enable multi-factor authentication (MFA) to enhance account security. Common multi-factor authentication methods include SMS verification codes, hardware tokens, biometrics, etc.
[0054] Platform management: The platform automatically manages the generation, update and application of dynamic passwords, ensuring that no manual intervention is required and reducing the management burden.
[0055] Classification and organization: Classify and organize all the company's asset and equipment accounts, and clarify the purpose and importance of each account.
[0056] Responsibility attribution: Link each account to its responsible person to ensure that the usage of all accounts can be traced back to specific individuals.
[0057] Account list: Establish an account list system, regularly review and update the account list, and confirm the usage permissions, usage status and holders of each account.
[0058] Real-time monitoring: Monitor account usage in real time to ensure that all operations comply with security policies.
[0059] Logging: Record all account and password related operation logs, including login attempts, password changes, account creation, etc., for auditing and tracking.
[0060] Resignation process: Establish an automated account recovery process for employees who resign, transfer, or change positions.
[0061] Account disabling: The platform implements automated account disabling and password reset mechanisms. Once an employee leaves or changes jobs, their corresponding account will be automatically locked within a specified period of time and a password update will be triggered.
[0062] Comprehensive reset: Perform a comprehensive password reset within a specified time after an employee leaves the company to ensure that the former employee cannot continue to access corporate assets.
[0063] Security policy: Develop and implement enterprise security policies, including password complexity requirements, password expiration dates, account lockout policies, etc.
[0064] User training: Conduct safety training for employees regularly to improve their safety awareness and operational capabilities.
[0065] Feedback mechanism: Establish a feedback mechanism to collect feedback from users and administrators and continuously improve the functions and performance of the account and password management platform.
[0066] Regular assessment: Regularly conduct security assessments on the system to discover and fix potential security vulnerabilities.
[0067] Through these steps and features, enterprises can establish an efficient and secure account and password management system to effectively protect the security of their assets.
[0068] Specifically, the account and password management platform for the selected enterprise needs integrates all the enterprise's asset account and passwords into the selected platform, including servers, network equipment, applications, and databases; classifies and labels asset accounts for easy search and permission allocation, implements multi-factor authentication, such as passwords combined with SMS verification codes, hardware tokens or biometrics, to enhance the security of identity authentication, and role-based access control, assigning different permissions according to the user's role and responsibilities. Ensure that users access the resources they need for their work, follow the principle of least privilege, grant users the minimum permissions necessary to complete the task, and implement approval processes for sensitive operations or high-privilege access to ensure that the operations are authorized.
[0069] In one embodiment, logs are recorded for all accesses and operations, including login attempts, permission changes, password modifications, etc. Real-time monitoring: Monitor access and activities of the platform in real time to detect abnormal behavior in a timely manner. Regular auditing: Regularly review access logs and permission settings to ensure the rationality and security of permission allocation. User training: Provide security training to users to educate them on the importance of access control and how to use the platform correctly. Security awareness: Improve employees' security awareness to prevent social engineering attacks and other internal threats. Emergency response plan: Develop an emergency response plan to enable rapid response and recovery in the event of a security incident. Regular drills: Conduct emergency response drills regularly to ensure that the team is familiar with the process and can effectively respond to actual incidents. Through the above measures, enterprises can establish a secure and efficient account and password management platform, and protect the security of the company's sensitive information and assets through strict access control.
[0070] Specifically, the dynamic passwords enabled for the asset accounts of the enterprise ensure that users must pass identity authentication before accessing the management platform, support multi-factor authentication, role-based access control, create roles to assign specific permissions to each role, bind users to roles, restrict users from performing operations allowed by their roles, set up approval processes for important operations, record approval requests and results, ensure traceability, record all access and operation logs, monitor abnormal behavior in real time, regularly review access logs and permission configurations to ensure reasonable configurations, use automated tools for audits, and generate audit reports;
[0071] The generation of dynamic passwords includes building a dynamic password function, and the calculation formula is as follows:
[0072] TOTP=Truncate(HMAC-SHA-1(K,(T-T0) / X)),
[0073] Among them, TOTP is the dynamic key, Truncate is the truncation function to intercept the dynamic password, K is the user's current key, T0 is the starting time, and HMAC-SHA-1 is the hash function.
[0074] In one embodiment, a dynamic password technology is selected:
[0075] TOTP(Time-based One-time Password):
[0076] Principle: Generate a one-time password based on time synchronization.
[0077] Tools: Google Authenticator, Authy.
[0078] HOTP (Counter-based One-Time Password):
[0079] Principle: Generate a one-time password based on a counter.
[0080] Combined with multi-factor authentication:
[0081] step:
[0082] First factor: Password (static password).
[0083] Second factor: dynamic password (TOTP / HOTP).
[0084] Optional third factor: biometric (fingerprint, facial recognition) or hardware token.
[0085] Configure the dynamic password generator:
[0086] step:
[0087] Integrate a dynamic password generator into the management platform.
[0088] Generate a unique key (SecretKey) for each account.
[0089] The key is distributed to the user, and the user generates a dynamic password through a dynamic password generator (such as a mobile app). Verify the dynamic password:
[0090] step:
[0091] The user enters the dynamic password.
[0092] The platform verifies the validity of the password (based on time or counter).
[0093] Access is allowed after verification.
[0094] Automatic Update and Synchronization:
[0095] step:
[0096] The generation and verification of dynamic passwords must be based on the same time or counter.
[0097] Ensure that the platform is in sync with the user's device time (TOTP) or counter (HOTP).
[0098] The validity period of dynamic passwords in accordance with enterprise security policies:
[0099] Strategy: Set a validity period for dynamic passwords (such as 30 seconds) to ensure that the password becomes invalid within a short period of time.
[0100] The order of multi-factor authentication:
[0101] Policy: Define the authentication order, such as entering the password first and then the dynamic password.
[0102] Anomaly Detection:
[0103] Strategy: Detect abnormal use of dynamic passwords (such as multiple incorrect attempts in a short period of time) and trigger the lock mechanism.
[0104] Implementing access control includes identity authentication, permission management, access approval, log monitoring, and regular auditing. Enabling dynamic passwords combined with multi-factor authentication requires selecting TOTP or HOTP technology to ensure the generation and verification of dynamic passwords. Legally used algorithms include hash algorithms (SHA-256, bcrypt), HMAC-SHA-1, TOTP, and HOTP. Through these measures, enterprises can achieve efficient access control to the management platform and combine dynamic passwords with multi-factor authentication to further improve account security.
[0105] Specifically, the enterprise classifies and organizes all asset equipment accounts, identifies all asset equipment and their corresponding accounts, uses asset discovery tools to scan the network, records equipment information and accounts, classifies by equipment type, classifies by account permissions, uses a configuration management database or asset management system, assigns a person in charge to each account, and records the account creation date and usage information;
[0106] Collect enterprise account data and password data to establish a database, analyze and process the data in the database, match and screen abnormal point data and management accounts, and the calculation formula is as follows:
[0107]
[0108] Among them, d(x i ,c j ) is the abnormal point difference distance, is the i-th account, is the jth cluster;
[0109] The regression model is built based on the data parameters of the database. The calculation formula is as follows:
[0110]
[0111] Among them, w i is the number of logins, is the average number of logins.
[0112] In one embodiment, create a list of accounts:
[0113] Content: account name, device IP, account type, person in charge, creation date, etc.
[0114] Format: spreadsheet, database table, etc.
[0115] Regular review and update:
[0116] Frequency: Monthly, Quarterly.
[0117] content:
[0118] Check whether the account is still in use.
[0119] Check whether the account permissions are appropriate.
[0120] Confirm whether the responsible person information is accurate.
[0121] Permission review:
[0122] step:
[0123] Check that the permissions of each account are consistent with its responsibilities.
[0124] Disable or delete accounts that are no longer needed.
[0125] Algorithms and models
[0126] Anomaly Detection:
[0127] Purpose: Detect unusual account activity.
[0128] Algorithms: Statistical-based methods, machine learning models (such as Isolation Forest, One-ClassSVM).
[0129] By building multiple decision trees, the anomaly score of the sample is calculated.
[0130] Minimize privileges assessment:
[0131] Purpose: To ensure that account permissions are minimized.
[0132] Method: Role-based permission matrix analysis.
[0133] The rows represent users, the columns represent permissions, and the matrix elements represent whether the user has the permission.
[0134] Steps to monitor account usage in real time:
[0135] Log collection:
[0136] Purpose: Collect account login, operation and other logs.
[0137] Tool: SIEM (Security Information and Event Management) system.
[0138] Real-time monitoring:
[0139] Method: Set alarm rules to monitor abnormal login behavior.
[0140] Indicators: login location, time, frequency, etc.
[0141] Behavioral analysis:
[0142] Purpose: Analyze account behavior and identify potential risks.
[0143] Method: Establish a user behavior baseline and detect behaviors that deviate from the baseline.
[0144] Algorithms and models
[0145] Behavioral baseline establishment:
[0146] Algorithm: mean, standard deviation.
[0147] Account recovery process:
[0148] step:
[0149] Employee resignation processing:
[0150] step:
[0151] Revoke all account permissions of employees.
[0152] Disable or delete your account.
[0153] Reset the relevant passwords.
[0154] Automated Process:
[0155] Purpose: Reduce manual operations and improve efficiency.
[0156] Method: Integrate the human resources system to automatically trigger the account recovery process. Algorithm and model:
[0157] Process Automation:
[0158] Tool: RPA (Robotic Process Automation).
[0159] Principle: Simulate manual operations and automatically execute account recovery steps.
[0160] Through the above steps and the application of algorithm models, enterprises can effectively manage asset equipment accounts and ensure the security and compliance of accounts. The combination of regular review and real-time monitoring can timely discover and deal with potential security risks and protect the company's important assets.
[0161] Specifically, the account recovery process established for employee resignation, transfer or job change includes integration with the enterprise's human resources management system, real-time acquisition of employee resignation, transfer or job change information, setting trigger events, and automatically triggering the account recovery process when the employee's status changes. On the day of the employee's resignation or job change, the system automatically locks all relevant accounts of the employee and revokes the employee's access rights to ensure that the employee can no longer access any enterprise resources. Within a specified time after the employee's resignation, the system automatically triggers the password reset process and notifies the relevant departments via email or text message to perform necessary manual confirmation or verification.
[0162] Specifically, the account recovery process established for employee resignation, transfer or job change includes using the API interface to synchronize data with the HR system to ensure real-time updating of employee information, including changes in employment, resignation and transfer status, setting a trigger mechanism to automatically send notifications to the account management platform when the employee status changes, using scripts or API to call automation tools to lock the designated account, automatically performing the account lock operation at midnight on the day of the employee's resignation or job change, revoking the employee's access rights through the role management module, recording operation logs of account locking and permission revocation to ensure traceability, using password management tools to automatically trigger the password reset process, performing the password reset operation within a specified time after the employee's resignation, and the system automatically sending emails or text messages to notify relevant personnel for confirmation. After receiving the notification, the IT department performs necessary manual confirmation or verification.
[0163] In one embodiment, the specific examples are as follows:
[0164] importrequests
[0165]
[0166]
[0167] Through the above steps and technical implementations, enterprises can establish an automated account recovery process to ensure that accounts can be locked and passwords reset in a timely manner when employees leave, are transferred or change positions, thereby improving the company's information security level and reducing potential security risks.
[0168] According to another aspect of the present invention, a hidden asset equipment account password security management system is provided, comprising:
[0169] Authentication module: responsible for verifying the user's identity and ensuring that only authorized users can access the system. Authentication methods include multi-factor authentication, biometrics, and smart cards;
[0170] Account management module: used to create, update, delete and manage device accounts, ensure that the permissions of each account are set correctly, and prevent unauthorized access;
[0171] Password management module: responsible for generating, storing and managing device passwords, usually including automatic generation of strong passwords, regular password changes, and encrypted password storage functions to ensure password security;
[0172] Audit and log module: records all account and password related operation logs, including login attempts, password changes, and account creation, which helps track and audit system usage and detect and prevent potential security threats;
[0173] Secure communication module: ensures data encryption within the system and when communicating with external systems to prevent data from being stolen or tampered with during transmission;
[0174] Policy management module: Set and execute security policies, such as password complexity requirements, password validity period, and account lockout policies, to enhance the overall security of the system;
[0175] Emergency response module: Provides rapid response and recovery functions when security incidents occur, including account lockout, emergency password reset, and security alerts.
[0176] Specifically, the management system provides a user-friendly interface to facilitate administrators and users to manage accounts and passwords, and allows the system to be integrated with other security systems or devices, such as network firewalls and intrusion detection systems, to form a complete security management system that continuously monitors the security status of the system, detects abnormal behavior, and issues alarms when potential threats are detected so that timely measures can be taken.
[0177] In one embodiment, the present invention provides a method and system for secure management of accounts and passwords for hidden asset equipment. By selecting an account and password management platform that meets the needs of the enterprise, all the asset accounts and passwords of the enterprise are integrated into the platform, and access control is implemented on the management platform. In combination with the enterprise's security policy, multi-factor authentication is enabled, and the generation, update and application process of dynamic passwords are managed through the platform. Accounts are linked to their persons in charge and traced back to the users of the accounts. An account list system is established, and is regularly reviewed, updated, and the usage rights, usage and holders of each account are confirmed. An automated account disabling and password reset mechanism is implemented through the platform. When an employee resigns or changes, the corresponding account will be automatically locked within a specified time and a password update will be triggered. A comprehensive password reset will be performed within a specified time after the employee resigns, which has the effect of effectively preventing account and password leakage and ensuring the safe operation of hidden asset equipment.
[0178] The asset device account and password are encrypted and stored in a password safe. The account and password encryption process is completed in an independent privacy computing unit, and the account and password encryption key is stored in a high-security level password chip that complies with national password specifications. The asset account and password will not be leaked during use, ensuring the storage security of the account and password at the physical level.
[0179] The account and password of asset equipment must be strictly authorized for use. Which user, which computer terminal, at what time, which account and password is used, and which asset equipment to log in to access must be strictly authorized. There will be no situation where the account is used in violation of regulations, unauthorized use, or use by untrusted users.
[0180] To meet security and compliance requirements, asset equipment can automatically change passwords according to time nodes and password complexity. After the password is changed, the correctness can be automatically verified to meet the needs of changing the passwords of massive asset accounts. No human intervention is required, which greatly reduces the pressure on operation and maintenance personnel and saves enterprise operation and maintenance costs.
[0181] In order to achieve secure storage of asset accounts and passwords, compliant authorized use of accounts and passwords, and automatic password change of assets and equipment, we have designed and developed an asset and equipment account and password security management platform to centrally manage users, asset and equipment account and passwords, and asset and equipment access rights.
[0182] The asset account security storage, account password compliance authorization, and asset equipment automatic password change functions are integrated into the asset equipment account password security management platform, and the risks faced by the aforementioned asset account passwords are all concentrated on the asset equipment account password security management platform. However, the security platform itself will also face various unknown network attack risks. Once the security management platform is breached, the asset equipment account password will still face the security risks described in Chapter 3, and the problem has not been solved. We know that any service platform, as long as it is deployed on the network, will face the risk of network attacks, and in theory it is impossible to resist all unknown attack methods.
[0183] Since we know that it is almost impossible to passively resist all network attack risks, let's change to a different security idea: actively hide and avoid network attack risks, so that attackers cannot find the asset equipment account password security management platform, and thus cannot find the target of attack. By solving the network security problem of the asset equipment account password security management platform, the security risks faced by the aforementioned asset equipment account password can be fundamentally solved.
[0184] The asset device account password is encrypted and stored in the database by an independent password security chip. The asset device account password encryption key is stored in a special hardware storage area of the password security chip. Attackers cannot obtain the encryption key through the network layer or physical means. Therefore, the asset device account password encrypted and stored in the database is safe. Even if the database data is stolen, the attacker cannot obtain the plain text of the asset device account password. Untrusted users cannot obtain the plain text of the asset account password, which solves the risks faced by users who arbitrarily save asset account passwords in text files in the past.
[0185] The authorized security administrator logs in to the asset equipment account password security management platform and creates an asset authorization policy. The authorization policy specifies the user who wants to access the asset, which computer terminal is allowed to access, the time of access, the account and password to be used, and the asset equipment to be accessed. The user can only obtain asset equipment access rights if all security factors included in the policy are met, and finally log in to access the asset equipment according to the policy requirements. The authorization policy is also encrypted and stored in the database, so attackers have no chance to obtain the authorization policy. Even if the authorization policy is leaked, attackers cannot use it directly, ensuring that only legitimate users can access authorized asset equipment.
[0186] The authorized security administrator logs in to the asset equipment account password security management platform and creates an automatic password change policy for the asset equipment. The password change policy specifies the asset equipment platform type (network equipment, Linux server, Windows server, database, etc.) to be changed, the asset equipment to be changed, the password complexity, the automatic generation of a new password, the execution time of the password change task, etc. The password change task manager will automatically schedule and execute the password change policy and automatically verify whether the password has been changed successfully, without the need for manual participation in a large number of password change tasks. The password change policy is also encrypted and stored in the database, so attackers have no chance to obtain the password change policy. Even if the password change policy is leaked, attackers cannot use it directly, ensuring that the asset equipment account password will not be illegally changed.
[0187] The asset equipment account password security management platform is deployed in the enterprise intranet or border network. The network access service layer of the security platform rejects all network connection requests, does not respond to any requests, and runs silently in the front end of the security platform, making it impossible for attackers to detect the existence of the security platform. When a legitimate enterprise user wants to access the asset equipment through the security access platform, he can initiate a special login request to the network access service of the security platform through the security platform client. The access service will capture the request at this time, verify the user, device fingerprint and other login credentials. After the verification is passed, the security platform will silently release the login connection request of the user and the client. At this time, the security platform will still silently block all other requests not initiated by the client, realizing the hidden access capability of the security platform.
[0188] The system administrator adds the user information who wants to access the security platform and assigns the security platform login account and password to the user. After adding, the user can access the security platform through the security platform client.
[0189] The system administrator adds the asset devices to be securely accessed to the security platform, and the added asset devices can only be accessed through the security platform.
[0190] The system administrator adds the asset equipment account and password to the security platform. After adding, the asset account and password are encrypted and stored in the password safe to ensure that the asset equipment account and password will not be leaked. Only users who have passed security authentication can obtain the asset equipment account and password, thereby achieving the purpose of secure management and use of the asset equipment account and password.
[0191] The system administrator creates an asset authorization policy, which specifies the users who want to access the assets, which computer terminals are allowed to access, the time of access, the account and password to be used, and the asset devices to be accessed.
[0192] The user submits a terminal review application, and the system administrator reviews and confirms what terminal device the user uses to log in and access the assets. After the review is passed, the user terminal can normally access the asset equipment account and password security management platform.
[0193] The user uses the audited terminal device to log in to the security platform in a hidden manner through the security platform client, obtains the asset device access policy, and then accesses the asset device according to the policy requirements.
[0194] The network access service of the security platform verifies the user identity, user terminal fingerprint information, security platform client information, network access ticket, etc. After the verification is passed, the asset equipment account security management platform exposes the network connection information to the user terminal, and the security platform client can initiate a secure connection to the security platform.
[0195] Authentication is performed on user accounts, passwords, device fingerprints, and multiple factors. After the user identity information is authenticated, the user can enter the management page of the security platform, the asset device access page, and the log audit page to perform security operation and maintenance operations.
[0196] When the security client passes the authentication, the security client establishes a private secure connection with the network connection service, encrypting and protecting the communication between the security client and the security platform.
[0197] Centrally manage users, assets, equipment, accounts, and passwords to meet the core capabilities of trusted user management, asset and equipment security control, account and password secure encryption storage, asset and equipment password update strategy, user access authorization strategy, etc.
[0198] When the user and the terminal device are authenticated, the security platform client establishes a network connection with the security platform, and the user can securely access the asset device through the asset connection link on the security platform client.
[0199] The core of hidden access is a network hierarchical access control model, which adds network access authentication to the second, third, and fourth layers of the security platform network protocol stack, where network access authentication is completed at layer 2, network connection authentication is completed at layer 3, and network access permission authentication is completed at layer 4. After the user completes layer 2 access authentication, he is allowed to initiate layer 3 network connection authentication; after the user completes layer 3 network connection authentication, he is allowed to initiate layer 4 network access permission authentication. After completing layer 4 network permission access authentication, the user can access the security platform normally.
[0200] If the attacker fails authentication at any layer of the network access model, the attack traffic will be directly rejected, and no response will be given to the attacker, nor will the attacker's connection request be accepted, so that the attacker cannot discover the existence of the asset device account password security management platform on the network. At the same time, the connection request initiated by the security platform client can pass the second, third, and fourth layer authentication of the access control model, ultimately achieving the purpose of hidden access to the security platform.
[0201] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the above-mentioned method for secure management of hidden asset device account numbers and passwords are implemented.
[0202] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for secure management of hidden asset equipment account numbers and passwords are implemented.
[0203] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
[0204] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.
[0205] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.
Claims
1. A method for secure management of hidden asset equipment account and password, characterized in that: include: Select an account and password management platform that meets the needs of the enterprise, integrate all the enterprise's asset accounts and passwords into the platform, and implement access control on the management platform; Enable dynamic passwords for the company's asset accounts, combine the company's security policies, enable multi-factor authentication, and manage the generation, update, and application of dynamic passwords through the platform to ensure that no manual intervention is required; Classify and sort out all the asset and equipment accounts of the enterprise and clearly identify the owners of the accounts; The account is linked to its person in charge, and the user of the account can be traced back to the user, and the usage of the account can be monitored in real time; an account list system is established, and regular review, update, and confirmation of the use rights, usage and holder of each account; In response to employee resignation, transfer or job change, an account recovery process is established, and an automated account disabling and password reset mechanism is implemented through the platform. Once an employee resigns or changes, the corresponding account will be automatically locked within the specified time and the password update will be triggered. A comprehensive password reset will be performed within the specified time after the employee resigns.
2. A method for secure management of hidden asset equipment account and password according to claim 1, characterized in that: The account and password management platform selected for enterprise needs integrates all asset accounts and passwords of the enterprise into the selected platform, including servers, network equipment, applications, and databases; Classify and label asset accounts to facilitate search and permission allocation, implement multi-factor authentication, such as password combined with SMS verification code, hardware token or biometric recognition, to enhance the security of identity authentication, and assign different permissions based on user roles and responsibilities based on role-based access control. Ensure that users access the resources they need for their work, follow the principle of least privilege, grant users the minimum permissions necessary to complete the task, and implement approval processes for sensitive operations or high-privilege access to ensure that the operations are authorized.
3. A method for secure management of hidden asset equipment account and password according to claim 1, characterized in that: The above-mentioned enabling of dynamic passwords for the asset accounts of enterprises ensures that users must pass identity authentication before accessing the management platform, supports multi-factor authentication, role-based access control, creates roles, assigns specific permissions to each role, binds users to roles, restricts users from performing operations permitted by their roles, sets approval processes for important operations, records approval requests and results, ensures traceability, records all access and operation logs, monitors abnormal behavior in real time, regularly reviews access logs and permission configurations, ensures reasonable configurations, uses automated tools for audits, and generates audit reports; The generation of dynamic passwords includes building a dynamic password function, and the calculation formula is as follows: TOTP=Truncate(HMAC-SHA-1(K,(T-T0) / X)), Among them, TOTP is the dynamic key, Truncate is the truncation function to intercept the dynamic password, K is the user's current key, T0 is the starting time, and HMAC-SHA-1 is the hash function.
4. A method for secure management of hidden asset equipment account and password according to claim 1, characterized in that: The aforementioned classification and organization of all asset equipment accounts of the enterprise identifies all asset equipment of the enterprise and their corresponding accounts, uses asset discovery tools to scan the network, records equipment information and accounts, classifies by equipment type, classifies by account authority, uses a configuration management database or asset management system, assigns a person in charge to each account, and records the account creation date and usage information; Collect enterprise account data and password data to establish a database, analyze and process the data in the database, match and screen abnormal point data and management accounts, and the calculation formula is as follows: Among them, d(x i ,c j ) is the abnormal point difference distance, is the i-th account, is the jth cluster; The regression model is built based on the data parameters of the database. The calculation formula is as follows: Among them, w i is the number of logins, is the average number of logins.
5. A method for secure management of hidden asset equipment account and password according to claim 1, characterized in that: The establishment of an account recovery process for employees' resignation, transfer or job change includes integration with the company's human resources management system, real-time acquisition of employee resignation, transfer or job change information, setting trigger events, and automatically triggering the account recovery process when the employee's status changes. On the day of the employee's resignation or job change, the system automatically locks all relevant accounts of the employee and revokes the employee's access rights to ensure that he or she can no longer access any corporate resources. Within a specified time after the employee's resignation, the system automatically triggers the password reset process and notifies the relevant departments via email or text message to perform necessary manual confirmation or verification.
6. A method for secure management of hidden asset equipment account and password according to claim 5, characterized in that: The account recovery process established for employees' resignation, transfer or job change includes using the API interface to synchronize data with the HR system to ensure real-time updating of employee information, including changes in entry, resignation and transfer status, setting a trigger mechanism to automatically send notifications to the account management platform when the employee status changes, using scripts or API to call automation tools to lock the designated account, and automatically perform the account lock operation at midnight on the day of the employee's resignation or job change, revoking the employee's access rights through the role management module, and recording operation logs of account locking and permission revocation to ensure traceability, using password management tools to automatically trigger the password reset process, and performing the password reset operation within the specified time after the employee's resignation. The system automatically sends emails or text messages to notify relevant personnel for confirmation, and the IT department performs necessary manual confirmation or verification after receiving the notification.
7. A hidden asset equipment account password security management system, characterized in that: include: Authentication module: responsible for verifying the user's identity and ensuring that only authorized users can access the system. Authentication methods include multi-factor authentication, biometrics, and smart cards; Account management module: used to create, update, delete and manage device accounts, ensure that the permissions of each account are set correctly, and prevent unauthorized access; Password management module: responsible for generating, storing and managing device passwords, usually including automatic generation of strong passwords, regular password changes, and encrypted password storage functions to ensure password security; Audit and log module: records all account and password related operation logs, including login attempts, password changes, and account creation, which helps track and audit system usage and detect and prevent potential security threats; Secure communication module: ensures data encryption within the system and when communicating with external systems to prevent data from being stolen or tampered with during transmission; Policy management module: Set and execute security policies, such as password complexity requirements, password validity period, and account lockout policies, to enhance the overall security of the system; Emergency response module: Provides rapid response and recovery functions when security incidents occur, including account lockout, emergency password reset, and security alerts.
8. A hidden asset equipment account password security management system according to claim 7, characterized in that: The management system provides a user-friendly interface to facilitate administrators and users to manage accounts and passwords, and allows the system to be integrated with other security systems or devices, such as network firewalls and intrusion detection systems, to form a complete security management system that continuously monitors the security status of the system, detects abnormal behavior, and issues alarms when potential threats are detected so that timely measures can be taken.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of a method for securely managing the account and password of a hidden asset device as described in any one of claims 1 to 6 are implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a hidden asset device account password security management method described in any one of claims 1 to 6 are implemented.