Password modification method and device, equipment and storage medium

Abstract

The invention discloses a password modification method and device, equipment and a storage medium, and relates to the field of password management, and the method comprises the steps: extracting password storage information from a target heterogeneous system, and constructing a knowledge base based on a feature vector of the password storage information; and when a password modification instruction is received, determining the type of a to-be-modified medium based on a corresponding target asset, a network protocol type and the knowledge base, determining a physical address of the to-be-modified medium by using the type, overwriting the to-be-modified medium located at the physical address to obtain a modified medium, and performing password modification on the modified medium. The password modification operation is completed; the target assets comprise the to-be-modified medium; and after password modification is completed, testing on a protocol layer and a service layer of the target heterogeneous system by using the modified medium to judge whether a preset login operation can be performed through the modified medium. Therefore, cross-platform silent password change can be realized when the password is changed.

Description

Technical Field

[0001] The present invention relates to the field of password management, and in particular to a password modification method, device, equipment and storage medium. Background Art

[0002] In enterprise IT operations, regularly changing the passwords of large-scale assets is essential to meet security compliance and management requirements. However, traditional scripted password change solutions have gradually exposed systemic failures in practical applications, making them difficult to adapt to the increasingly complex hybrid architecture environment.

[0003] Traditional solutions face challenges at the interaction layer, such as blocking password expiration notifications and automatically blocking abnormal pop-up notifications. For example, they fail to recognize non-standard login interfaces like Windows CredSSP (Credential Security Support Provider protocol) errors or Linux PAM (Pluggable Authentication Modules) alerts, and lack the ability to handle peer policy pop-up notifications. At the service layer, password changes can trigger blue screens (BSODs) due to password changes associated with the Windows LSASS (Local Security Authority Subsystem Service) process, PAM module exceptions caused by multiple Linux processes modifying shadow files (the file used to store user password information), and process restarts triggered by network device configuration writes. Furthermore, for web-based password changes in B / S (browser / server) architectures, traditional solutions are unable to handle JavaScript dynamic forms, CSRF token validation, or anti-automation protection systems, resulting in significant adaptability issues. In addition, traditional solutions also have some defects in terms of automation processes, storage media management, verification mechanisms and security compliance.

[0004] Therefore, how to implement a cross-platform encryption solution that can silently change the encryption is a technical problem that needs to be solved urgently. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a password modification method, apparatus, device, and storage medium that can achieve cross-platform silent password modification when modifying passwords. The specific solution is as follows:

[0006] In a first aspect, the present application provides a password modification method, comprising:

[0007] Extracting password storage information from a target heterogeneous system and building a knowledge base based on feature vectors of the password storage information;

[0008] Upon receiving a password change instruction, the type of the medium to be modified is determined based on the corresponding target asset, the network protocol type, and the knowledge base, and the physical address of the medium to be modified is determined using the type, and the medium to be modified located at the physical address is overwritten to obtain a modified medium, thereby completing the password change operation; the target asset includes the medium to be modified;

[0009] After the password modification is completed, the modified medium is used to perform a test at the protocol layer and the service layer of the target heterogeneous system to determine whether a preset login operation can be performed through the modified medium.

[0010] Optionally, constructing a knowledge base based on the feature vector of the password storage information includes:

[0011] Classifying the password storage information to obtain corresponding configuration files, binary files, and network protocols;

[0012] extracting first characteristic information from the configuration file using a first preset regular expression, extracting second characteristic information from the binary file using a first preset magic number, and parsing the network protocol using traffic mirroring technology to obtain corresponding third characteristic information;

[0013] The first feature information, the second feature information, and the third feature information are fused into target feature information, and the target feature information is feature-vectorized to obtain a target feature vector, and a knowledge base is constructed using the target feature vector.

[0014] Optionally, determining the type of the medium to be modified based on the corresponding target asset, the network protocol type, and the knowledge base includes:

[0015] Matching the medium to be modified in the knowledge base using the network protocol type, the IP address of the target asset, a second preset regular expression, and a second preset magic number to obtain a file type identification code;

[0016] The type of the medium to be modified is determined based on the file type identification code.

[0017] Optionally, determining the physical address of the medium to be modified by using the type includes:

[0018] When the type is a user account, parsing a master file table in a local file system, searching the master file table for a file record related to the medium to be modified, and extracting a logical storage identifier of the medium to be modified from the file record;

[0019] Converting the logical storage identifier into a target physical sector to determine the physical address of the medium to be modified;

[0020] When the type is a network device, a random access memory is read in the network device through a preset interface, and the physical address of the medium to be modified is determined based on the random access memory and a preset characteristic character string.

[0021] Optionally, overwriting the medium to be modified at the physical address to obtain the modified medium includes:

[0022] Writing new password data to a primary buffer of the target heterogeneous system and writing pre-verification data to a backup buffer of the target heterogeneous system so as to verify the new password data using the pre-verification data; the pre-verification data including a backup of the new password data;

[0023] The new password data in the primary buffer is written to the medium to be modified at the physical address to obtain a modified medium.

[0024] Optionally, writing the new password data in the primary buffer to the medium to be modified at the physical address includes:

[0025] When the type is a user account, the corresponding access control list is modified to obtain the corresponding operation authority;

[0026] After obtaining the operation authority, mounting the registry corresponding to the medium to be modified to a virtual disk to determine the user key storage area in the medium to be modified;

[0027] Converting the new password data in the primary buffer into an NTLM hash value, and encrypting the NTLM hash value using a preset stream encryption algorithm to obtain target password data;

[0028] Writing the target password data into the user key storage area;

[0029] When the type is a network device, resetting a test access port in a preset interface in the network device and adjusting the network device to a data shift mode so that the network device receives the new password data;

[0030] The new password data is encrypted and the obtained encrypted data is written into the password storage area of the data register in the network device, and the encrypted data in the password storage area is written into the random access memory using the instruction register of the network device.

[0031] Optionally, the using the modified medium to test at the protocol layer and the service layer of the target heterogeneous system to determine whether a preset login operation can be performed through the modified medium includes:

[0032] When the target heterogeneous system includes a secure shell protocol, performing a preset non-interactive login using the modified medium through the secure shell protocol and obtaining a corresponding protocol layer login result;

[0033] When the target heterogeneous system includes a browser / server architecture, accessing a target login page, logging in on the target login page using the modified medium via the HTTP protocol or the HTTPS protocol, and obtaining a corresponding protocol layer login result;

[0034] If the protocol layer login result indicates that the login is successful, querying the current number of client connections in a preset database of the target heterogeneous system, and determining a connection ratio between the number of client connections and a preset maximum number of connections of the preset database;

[0035] Acquire session data of a target application in the target heterogeneous system using a preset server management interface, and determine a corresponding number of sessions based on the session data;

[0036] The connection number ratio, the session number and the protocol layer login result are input into a preset large model, so that the output result of the preset large model is used as the login test result.

[0037] In a second aspect, the present application provides a password modification device, comprising:

[0038] A knowledge base construction module is used to extract password storage information from the target heterogeneous system and construct a knowledge base based on the feature vector of the password storage information;

[0039] a password modification module configured to, upon receiving a password modification instruction, determine the type of the medium to be modified based on the corresponding medium to be modified, the network protocol type, and the knowledge base, determine the physical address of the medium to be modified using the type, overwrite the medium to be modified at the physical address to obtain a modified medium, and complete the password modification operation; the target asset includes the medium to be modified;

[0040] The password testing module is used to use the modified medium to test the protocol layer and service layer of the target heterogeneous system after completing the password modification to determine whether the preset login operation can be performed through the modified medium.

[0041] In a third aspect, the present application provides an electronic device, comprising:

[0042] Memory, used to store computer programs;

[0043] The processor is used to execute the computer program to implement the aforementioned password modification method.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned password modification method is implemented.

[0045] In this application, password storage information is extracted from the target heterogeneous system and a knowledge base is constructed based on the feature vector of the password storage information. When a password change instruction is received, the type of the medium to be modified is determined based on the corresponding target asset, network protocol type, and the knowledge base, and the type is used to determine the physical address of the medium to be modified. The medium to be modified located at the physical address is overwritten to obtain the modified medium to complete the password change operation. The target asset contains the medium to be modified. After the password change is completed, the modified medium is tested at the protocol layer and service layer of the target heterogeneous system to determine whether the preset login operation can be performed through the modified medium. As can be seen from the above, the present application extracts password storage information from the target heterogeneous system and constructs a feature vector knowledge base. Secondly, after receiving the password change instruction, the type of the medium to be modified is determined based on the target asset, network protocol type, and the knowledge base, and then the physical address is located and the medium to be modified at the physical address is overwritten. Finally, after the change is completed, the validity of the modified medium is verified through protocol layer and service layer testing. In this way, the present application can achieve silent password change across platforms when changing passwords, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0047] Figure 1 A flowchart of a password modification method disclosed in this application;

[0048] Figure 2 A flowchart of a specific password modification method disclosed in this application;

[0049] Figure 3 This is a schematic diagram of the structure of a password modification device disclosed in this application;

[0050] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0052] Currently, during the password modification process, the interactive layer faces problems such as the blocking of password invalidation prompts and the automation of abnormal pop-up window truncation, and the peer policy pop-up window lacks the handle capture capability. At the service layer, password modification may cause blue screens caused by password modification associated with the Windows LSASS process, PAM module exceptions caused by multiple Linux processes modifying shadow files, and process restarts triggered by network device configuration writing. Moreover, for the Web-based password modification scenario of the B / S architecture, traditional solutions cannot handle JavaScript dynamic forms, CSRF Token verification, and anti-automation protection systems, and their adaptability is seriously insufficient. In addition, traditional solutions also have some defects in terms of automated processes, storage media management, verification mechanisms, and security compliance. To this end, the present application provides a password modification method, device, equipment, and storage medium that can achieve silent cross-platform password modification when modifying passwords.

[0053] See also Figure 1 As shown, an embodiment of the present invention discloses a password modification method, comprising:

[0054] Step S11: extract password storage information from the target heterogeneous system, and construct a knowledge base based on the feature vector of the password storage information.

[0055] The target heterogeneous system in this embodiment includes a variety of subsystems with different architectures or types, and the forms and locations of their password storage information vary. To effectively extract this password storage information, it is first necessary to classify the password storage information in the target heterogeneous system. This classification reveals that this password storage information primarily exists in configuration files, binary files, and network protocols. Configuration files typically store parameters required for system operation in plain text or a specific format, including configurations that may involve passwords. Binary files store data in binary-encoded form, which may contain encrypted or unencrypted password information. Network protocols may also transmit password-related content during data transmission.

[0056] After the classification is completed, the corresponding extraction technology is used for different types of files. For configuration files, the first preset regular expression is used for parsing. Regular expressions have powerful text pattern matching capabilities. Matching rules can be pre-set based on common password formats, field naming and other features in the configuration file, thereby extracting the first characteristic information, such as the password string or related parameters identified by a specific field name in the configuration file. For binary files, the second characteristic information is extracted with the help of the first preset magic number. The magic number is a specific byte sequence in the binary file used to identify the file type. Through the preset magic number pattern related to the password, the area in the binary file that may contain password information can be located and extracted. For network protocols, traffic mirroring technology is used for parsing. This technology can capture the protocol data transmitted in the network in real time, and through the analysis of the protocol message, the third characteristic information involving password transmission is obtained, such as the password field transmitted during the identity authentication process.

[0057] Furthermore, after extracting various types of feature information, the first, second, and third feature information are fused to form target feature information. This target feature information is then subjected to feature vectorization, converting it into a computer-processable numerical vector, known as the target feature vector. Finally, a knowledge base is constructed using the generated target feature vector. This knowledge base is used to store and manage feature vector data related to password storage information, providing data support and reference for subsequent password modification operations. By analyzing and processing feature vectors, password information in target heterogeneous systems can be more accurately located and modified.

[0058] Step S12: When a password change instruction is received, the type of the medium to be modified is determined based on the corresponding target asset, the network protocol type, and the knowledge base, and the physical address of the medium to be modified is determined using the type. The medium to be modified located at the physical address is overwritten to obtain the modified medium to complete the password change operation; the target asset includes the medium to be modified.

[0059] In this embodiment, it should be noted that, in operation and maintenance audit products, regular re-encryption of large-scale assets is a rigid requirement to meet the requirements of security compliance and security management. In this context, the triggering sources of password change instructions include regular system security policy updates, user-initiated password change requests, or forced modification operations after security risks are detected.

[0060] When receiving a password change instruction, the specific location of the media to be modified must be located first. This process relies on the coordinated processing of the target asset, network protocol type, and knowledge base. The target asset refers to the specific device or system component containing the password information to be changed, such as a server, network switch, or terminal device, which has its own unique identifier for location. The network protocol type determines the format and rules for password information transmission over the network, which requires analysis based on protocol characteristics. Network protocols include but are not limited to SSH (Secure Shell), RDP (Remote Desktop Protocol), and SNMP (Simple Network Management Protocol).

[0061] When determining the type of media to be modified, a multi-dimensional information matching process is performed within the knowledge base. Specifically, the network protocol type, the target asset's IP address, a second preset regular expression, and a second preset magic number are used as matching criteria. These matching criteria are then compared with the knowledge base to obtain a file type identifier, which corresponds to the specific type of media to be modified. For example, LINUX_SHADOW_V1 (i.e., version 1 of the shadow file in the Linux system) and CISCO_IOS_V2 (i.e., version 2 of the IOS operating system in a network device) are examples of file type identifiers.

[0062] After determining the type of the medium to be modified based on the file type identification code, the type information needs to be further converted into a physical storage address. In a specific embodiment, if the type is a user account, its password information is usually stored in a specific area of the local file system. At this time, the system parses the master file table (i.e., MFT table) in the local file system (i.e., NTFS, New Technology FileSystem), which records the logical storage information of all files in the file system. By searching the master file table for the file record related to the medium to be modified, the logical storage identifier of the medium can be extracted. For example, the LCN (Logical Cluster Number) in "LCN=0x1F4" is the logical cluster number, which is the logical storage identifier. Subsequently, the logical address to physical address mapping mechanism of the file system is used to convert the logical storage identifier into the target physical sector, thereby determining the specific physical address of the medium to be modified in the storage device.

[0063] In a specific embodiment, if the medium to be modified is a network device, its password information may be stored in the device's random access memory or non-volatile storage medium. In this case, data in the random access memory is remotely read through a pre-set interface provided by the network device. Since the password information in the random access memory may be stored in a specific format or associated with a pre-set signature string, a match is performed based on the data content in the random access memory and the pre-set signature string to locate the physical address of the medium to be modified.

[0064] After locating the physical address, you need to overwrite the media at that physical address. During the overwriting process, ensure that the new password information is written in a manner that complies with the storage characteristics of the media to avoid data corruption or system anomalies caused by write errors.

[0065] Step S13: After completing the password modification, the modified medium is used to perform a test at the protocol layer and service layer of the target heterogeneous system to determine whether the preset login operation can be performed through the modified medium.

[0066] In this embodiment, after the password change operation is completed, the validity of the modified medium must be verified to ensure that the new password can be used to access the system normally and does not affect the stable operation of the target heterogeneous system. This verification process spans both the protocol layer and the service layer, simulating real login scenarios and combining multi-dimensional indicator analysis to comprehensively evaluate the effectiveness of the password change.

[0067] In one specific embodiment, when the target heterogeneous system includes a secure shell protocol, a preset non-interactive login test is first performed using the modified media through the protocol. Non-interactive login refers to completing the login process through an automated script or program without human intervention. This method can effectively verify the support of the new password at the SSH protocol level. During the test, a login request containing the modified media can be constructed and sent to the server. After receiving the request, the server will parse and verify the request according to the SSH protocol specification. In addition, the interactive information of this login process is recorded, including the response time, authentication result code, etc., and finally a protocol layer login result is generated. This result reflects the validity of the modified media at the SSH protocol level. If the login is successful, it indicates that the modified media can be correctly identified and verified by the SSH service; otherwise, it indicates that there may be a problem with the password modification and further investigation is required.

[0068] In one specific embodiment, when the target heterogeneous system includes a browser / server (i.e., B / S) architecture, a login test is performed by accessing the target login page and utilizing the HTTP (i.e., Hypertext Transfer Protocol) protocol or the HTTPS (i.e., Hypertext Transfer Protocol Secure) protocol. First, the browser behavior is simulated, and an HTTP / HTTPS request is sent to the target login page to obtain the login page resources. Subsequently, the modified media is automatically filled in on the login page, and the login form is submitted. After receiving the login request, the server processes the request, including operations such as verifying the validity of the password and managing the session state. Furthermore, the entire login process is monitored, and based on the data collected during the login process, a protocol-layer login result for the B / S architecture is generated.

[0069] If the protocol layer login result indicates a successful login, further testing will be conducted at the target heterogeneous system's service layer. First, the target heterogeneous system's pre-set database will be queried for the current number of client connections. The obtained number of client connections is then compared with the database's pre-set maximum number of connections to calculate the connection ratio. This ratio is a key indicator of database resource utilization. A high ratio may indicate a system performance bottleneck and require optimization; a low ratio may indicate underutilized resources. By analyzing the connection ratio, the impact of password changes on database connection management can be assessed.

[0070] At the same time, the session data of the target application in the target heterogeneous system is obtained using the pre-set server management interface. This session data includes, but is not limited to, status information about the interaction between the user and the application, including login status, operation history, and permission information. Based on the obtained session data, the corresponding number of sessions is determined, which reflects the scale of the currently active user base. Changes in the number of sessions can indirectly reflect the impact of password changes on user access behavior. For example, an abnormal decrease in the number of sessions may prompt a new password, preventing some users from logging in normally.

[0071] To comprehensively assess the system status after the password change, this embodiment introduces a pre-set large model for data analysis. The pre-set large model uses the connection ratio, number of sessions, and protocol layer login results as input parameters. By analyzing and processing these input parameters, the large model outputs login test results. These results comprehensively consider multiple indicators at the protocol and service layers, fully reflecting the effectiveness and stability of the modified media in the target heterogeneous system.

[0072] As can be seen above, this application extracts password storage information from the target heterogeneous system and constructs a feature vector knowledge base. Secondly, after receiving the password change instruction, it determines the type of media to be modified based on the target asset, network protocol type, and knowledge base, and then locates the physical address and overwrites the media to be modified at that physical address. Finally, after the modification is completed, the validity of the modified media is verified through protocol layer and service layer testing. In this way, this application can achieve silent password modification across platforms when changing passwords, thereby improving the user experience.

[0073] See also Figure 2 As shown, in order to ensure the security of password modification operations while improving data writing reliability, the embodiment of the present application further provides a specific password modification method, including:

[0074] Step S21: write the new password data into the main buffer of the target heterogeneous system, and write the pre-verification data into the backup buffer of the target heterogeneous system, so as to verify the new password data using the pre-verification data; the pre-verification data includes a backup of the new password data.

[0075] In this embodiment, password modification for the target heterogeneous system utilizes a dual-buffer write mechanism. Through the collaborative operation of a primary buffer (also known as the Active buffer) and a standby buffer (also known as the Standby buffer), reliable storage and verification of new password data are achieved. The primary buffer is a dedicated area in system memory used to temporarily store pending password data. Its high-speed read and write capabilities enable rapid response to user password modification requests. Upon receiving a password modification instruction, the new password data is first written to the primary buffer, awaiting further processing.

[0076] At the same time, pre-verification data corresponding to the new password data is generated and written to the backup buffer. This pre-verification data contains a complete backup of the new password data, along with a checksum generated based on that data. By storing this pre-verification data in a separate backup buffer, the integrity of the new password data in the primary buffer can be verified in subsequent operations, preventing errors or tampering during transmission or storage.

[0077] Step S22: Write the new password data in the primary buffer into the medium to be modified at the physical address to obtain a modified medium.

[0078] In this embodiment, when the medium to be modified is a user account, the password writing process involves multiple levels of data processing and permission control. First, the corresponding access control list (ACL) is modified to obtain the necessary operation permissions. The ACL defines the access rights of a user or process to system resources. By modifying the ACL, the user's permission level can be temporarily increased, ensuring the smooth operation of subsequent operations.

[0079] After obtaining permission to operate, the registry corresponding to the media to be modified is mounted to the virtual disk. The registry is the core database for storing system configuration information, including user account passwords. By mounting the registry to the virtual disk, password data can be manipulated without affecting system operations. After mounting, the user key storage area on the media to be modified is located, which stores encrypted user password information.

[0080] Next, the new password data in the primary buffer undergoes format conversion and encryption. First, the new password data is converted into an NTLM (NT LAN Manager) hash value. Then, the NTLM hash value is re-encrypted using a pre-set stream cipher algorithm to generate the target password data. The pre-set stream cipher algorithm can be RC4 (Rivest Cipher 4). This double encryption mechanism further enhances password security, making it difficult for attackers to crack the password even if the data is illegally obtained during storage.

[0081] Finally, the target password data is written to the user key storage area, completing the user account password change. The write operation adheres to strict transaction processing principles to ensure data integrity and consistency. If an exception occurs during the write process, an automatic rollback operation can be performed to ensure that the original password data is not affected.

[0082] When the medium to be modified is a network device, the password writing process must be tailored to the hardware characteristics of the network device. First, the test access port in the preset interface of the network device is reset. This operation clears temporary data and status within the interface, ensuring the stability of subsequent data transmission. The preset interface can be a JTAG (Joint Test Action Group) interface, a hardware debugging and testing interface. The test access port can be controlled by a TAP (Test Access Port) controller, which manages the status and data flow of the test interface. Simultaneously, the network device is set to data shift mode, which allows the device to receive new password data from external input and temporarily store it in a specific buffer.

[0083] During the data transmission phase, the new password data is encrypted to generate encrypted data. The encryption algorithm is selected based on the type of network device and the supported protocols. The encrypted data is then written to the password storage area of the network device's data register. The data register is a high-speed storage unit used for temporary data storage within the device, enabling rapid response to read and write operations on the password data.

[0084] Finally, the encrypted data in the password storage area is written to the random access memory using the network device's instruction register. The instruction register is responsible for parsing and executing control instructions. By sending a specific write command to it, the password data can be transferred from the temporary storage area to the official running memory, thus completing the network device password change. During this process, the integrity of the data transmission and the device's response status can be monitored in real time to ensure the reliability of the password change operation.

[0085] As can be seen from the above, in this application, the main buffer quickly responds to the password modification instruction to write the new password data, and the backup buffer synchronously stores the pre-verification data, including data backup and verification values, to provide protection for data integrity verification, effectively preventing data errors or tampering during transmission and storage. Then, different operations are implemented according to the type of media to be modified. For user accounts, permissions are obtained by modifying the access control list, the registry is mounted to locate the key storage area, and the target password data is written after hash conversion and secondary encryption. The transaction processing and rollback mechanism ensure data integrity. For network devices, reset the test access port, adjust the data shift mode, encrypt the data according to the device characteristics, write to the random access memory through the data register and instruction register, and monitor in real time to ensure operation reliability. In this way, this application significantly improves the reliability of data writing through double buffer verification and multi-dimensional protection, and can eliminate cross-platform operation problems based on media type adaptation processing.

[0086] Accordingly, see Figure 3 As shown, the embodiment of the present application provides a password modification device, including:

[0087] A knowledge base construction module 11 is used to extract password storage information from the target heterogeneous system and construct a knowledge base based on the feature vector of the password storage information;

[0088] The password modification module 12 is configured to, upon receiving a password modification instruction, determine the type of the medium to be modified based on the corresponding medium to be modified, the network protocol type, and the knowledge base, determine the physical address of the medium to be modified using the type, and overwrite the medium to be modified at the physical address to obtain a modified medium, thereby completing the password modification operation; the target asset includes the medium to be modified;

[0089] The password testing module 13 is used to perform a test at the protocol layer and service layer of the target heterogeneous system using the modified medium after completing the password modification to determine whether the preset login operation can be performed through the modified medium.

[0090] As can be seen above, this application extracts password storage information from the target heterogeneous system and constructs a feature vector knowledge base. Secondly, after receiving the password change instruction, it determines the type of media to be modified based on the target asset, network protocol type, and knowledge base, and then locates the physical address and overwrites the media to be modified at that physical address. Finally, after the modification is completed, the validity of the modified media is verified through protocol layer and service layer testing. In this way, this application can achieve silent password modification across platforms when changing passwords, thereby improving the user experience.

[0091] In some specific implementations, the knowledge base construction module 11 specifically includes:

[0092] An information classification unit, configured to classify the password storage information to obtain corresponding configuration files, binary files, and network protocols;

[0093] an information extraction unit, configured to extract first characteristic information from the configuration file using a first preset regular expression, extract second characteristic information from the binary file using a first preset magic number, and parse the network protocol using traffic mirroring technology to obtain corresponding third characteristic information;

[0094] The knowledge base construction unit is used to fuse the first feature information, the second feature information and the third feature information into target feature information, perform feature vectorization on the target feature information to obtain a target feature vector, and use the target feature vector to construct a knowledge base.

[0095] In some specific implementations, the password modification module 12 specifically includes:

[0096] a medium matching unit, configured to match the medium to be modified in the knowledge base using the network protocol type, the IP address of the target asset, a second preset regular expression, and a second preset magic number to obtain a file type identification code;

[0097] The type determining unit is configured to determine the type of the medium to be modified based on the file type identification code.

[0098] In some specific implementations, the password modification module 12 specifically includes:

[0099] an identifier extraction unit, configured to, when the type is a user account, parse a master file table in a local file system, search the master file table for a file record related to the medium to be modified, and extract a logical storage identifier of the medium to be modified from the file record;

[0100] A first address determining unit, configured to convert the logical storage identifier into a target physical sector to determine a physical address of the medium to be modified;

[0101] The second address determining unit is configured to, when the type is a network device, read a random access memory in the network device through a preset interface, and determine the physical address of the medium to be modified based on the random access memory and a preset characteristic string.

[0102] In some specific implementations, the password modification module 12 specifically includes:

[0103] a first data writing unit, configured to write new password data into a primary buffer of the target heterogeneous system and to write pre-verification data into a backup buffer of the target heterogeneous system, so as to verify the new password data using the pre-verification data; the pre-verification data including a backup of the new password data;

[0104] The second data writing unit is configured to write the new password data in the primary buffer into the medium to be modified at the physical address to obtain a modified medium.

[0105] In some specific implementations, the second data writing unit specifically includes:

[0106] A list modification subunit, for modifying the corresponding access control list to obtain corresponding operation permissions when the type is a user account;

[0107] a storage area determination subunit, configured to, after obtaining the operation permission, mount the registry corresponding to the medium to be modified to a virtual disk, so as to determine the user key storage area in the medium to be modified;

[0108] a hash value encryption subunit, configured to convert the new password data in the primary buffer into an NTLM hash value, and encrypt the NTLM hash value using a preset stream encryption algorithm to obtain target password data;

[0109] A first password writing subunit, configured to write the target password data into the user key storage area;

[0110] a device adjustment subunit, configured to, when the type is a network device, reset a test access port in a preset interface in the network device and adjust the network device to a data shift mode so that the network device receives the new password data;

[0111] The second password writing subunit is used to encrypt the new password data and write the obtained encrypted data into the password storage area of the data register in the network device, and use the instruction register of the network device to write the encrypted data in the password storage area into the random access memory.

[0112] In some specific implementations, the password testing module 13 specifically includes:

[0113] a first login testing unit configured to, when a secure shell protocol is included in the target heterogeneous system, perform a preset non-interactive login using the modified medium through the secure shell protocol and obtain a corresponding protocol layer login result;

[0114] A second login testing unit is configured to, when the target heterogeneous system includes a browser / server architecture, access a target login page, log in on the target login page using the modified medium via the HTTP protocol or the HTTPS protocol, and obtain a corresponding protocol layer login result;

[0115] a ratio determining unit, configured to query a preset database of the target heterogeneous system for a current number of client connections if the protocol layer login result indicates that the login is successful, and determine a ratio between the number of client connections and a preset maximum number of connections in the preset database;

[0116] a quantity determining unit, configured to obtain session data of a target application in the target heterogeneous system by using a preset server management interface, and determine a corresponding session quantity based on the session data;

[0117] The result determination unit is used to input the connection number ratio, the session number and the protocol layer login result into a preset large model, so as to use the output result of the preset large model as the login test result.

[0118] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 4This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be construed as limiting the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the password modification method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0119] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0120] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0121] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the password modification method executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program capable of performing other specific tasks.

[0122] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the password modification method disclosed above is implemented. The specific steps of this method can be referred to the corresponding contents disclosed in the above embodiments and will not be repeated here.

[0123] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0124] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0125] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0126] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0127] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A password modification method, characterized in that: include: Extracting password storage information from a target heterogeneous system and building a knowledge base based on feature vectors of the password storage information; Upon receiving a password change instruction, the type of the medium to be modified is determined based on the corresponding target asset, the network protocol type, and the knowledge base, and the physical address of the medium to be modified is determined using the type, and the medium to be modified located at the physical address is overwritten to obtain a modified medium, thereby completing the password change operation; the target asset includes the medium to be modified; After the password modification is completed, the modified medium is used to perform a test at the protocol layer and the service layer of the target heterogeneous system to determine whether a preset login operation can be performed through the modified medium.

2. The password modification method according to claim 1, characterized in that: The constructing of a knowledge base based on the feature vector of the password storage information includes: Classifying the password storage information to obtain corresponding configuration files, binary files, and network protocols; extracting first characteristic information from the configuration file using a first preset regular expression, extracting second characteristic information from the binary file using a first preset magic number, and parsing the network protocol using traffic mirroring technology to obtain corresponding third characteristic information; The first feature information, the second feature information, and the third feature information are fused into target feature information, and the target feature information is feature-vectorized to obtain a target feature vector, and a knowledge base is constructed using the target feature vector.

3. The password modification method according to claim 1, wherein: The determining the type of the medium to be modified based on the corresponding target asset, the network protocol type, and the knowledge base includes: Matching the medium to be modified in the knowledge base using the network protocol type, the IP address of the target asset, a second preset regular expression, and a second preset magic number to obtain a file type identification code; The type of the medium to be modified is determined based on the file type identification code.

4. The password modification method according to claim 1, wherein: The determining the physical address of the medium to be modified by using the type includes: When the type is a user account, parsing a master file table in a local file system, searching the master file table for a file record related to the medium to be modified, and extracting a logical storage identifier of the medium to be modified from the file record; Converting the logical storage identifier into a target physical sector to determine the physical address of the medium to be modified; When the type is a network device, a random access memory is read in the network device through a preset interface, and the physical address of the medium to be modified is determined based on the random access memory and a preset characteristic character string.

5. The password modification method according to claim 1, wherein: Overwriting the medium to be modified at the physical address to obtain a modified medium includes: Writing new password data to a primary buffer of the target heterogeneous system and writing pre-verification data to a backup buffer of the target heterogeneous system so as to verify the new password data using the pre-verification data; the pre-verification data including a backup of the new password data; The new password data in the primary buffer is written to the medium to be modified at the physical address to obtain a modified medium.

6. The password modification method according to claim 5, characterized in that: Writing the new password data in the primary buffer to the medium to be modified at the physical address includes: When the type is a user account, the corresponding access control list is modified to obtain the corresponding operation authority; After obtaining the operation authority, mounting the registry corresponding to the medium to be modified to a virtual disk to determine the user key storage area in the medium to be modified; Converting the new password data in the primary buffer into an NTLM hash value, and encrypting the NTLM hash value using a preset stream encryption algorithm to obtain target password data; Writing the target password data into the user key storage area; When the type is a network device, resetting a test access port in a preset interface in the network device and adjusting the network device to a data shift mode so that the network device receives the new password data; The new password data is encrypted and the obtained encrypted data is written into the password storage area of the data register in the network device, and the encrypted data in the password storage area is written into the random access memory using the instruction register of the network device.

7. The password modification method according to any one of claims 1 to 6, characterized in that: The testing of the target heterogeneous system's protocol layer and service layer using the modified medium to determine whether the preset login operation can be performed through the modified medium includes: When the target heterogeneous system includes a secure shell protocol, performing a preset non-interactive login using the modified medium through the secure shell protocol and obtaining a corresponding protocol layer login result; When the target heterogeneous system includes a browser / server architecture, accessing a target login page, logging in on the target login page using the modified medium via the HTTP protocol or the HTTPS protocol, and obtaining a corresponding protocol layer login result; If the protocol layer login result indicates that the login is successful, querying the current number of client connections in a preset database of the target heterogeneous system, and determining a connection ratio between the number of client connections and a preset maximum number of connections of the preset database; Acquire session data of a target application in the target heterogeneous system using a preset server management interface, and determine a corresponding number of sessions based on the session data; The connection number ratio, the session number and the protocol layer login result are input into a preset large model, so that the output result of the preset large model is used as the login test result.

8. A password modification device, characterized in that: include: A knowledge base construction module is used to extract password storage information from the target heterogeneous system and construct a knowledge base based on the feature vector of the password storage information; a password modification module configured to, upon receiving a password modification instruction, determine the type of the medium to be modified based on the corresponding medium to be modified, the network protocol type, and the knowledge base, determine the physical address of the medium to be modified using the type, overwrite the medium to be modified at the physical address to obtain a modified medium, and complete the password modification operation; the target asset includes the medium to be modified; The password testing module is used to use the modified medium to test the protocol layer and service layer of the target heterogeneous system after completing the password modification to determine whether the preset login operation can be performed through the modified medium.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the password modification method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, the password modification method according to any one of claims 1 to 7 is implemented.

Images