User certificate dynamic updating method and device, equipment and medium

Abstract

The invention provides a user certificate dynamic updating method. The method can be applied to the technical fields of financial science and technology and big data. The method comprises the following steps: acquiring a first user credential which is being used by a client; and monitoring the use duration of the first user voucher, and generating a second user voucher based on a preset user voucher management strategy in response to the situation that the use duration of the first user voucher reaches a preset threshold. And in response to the fact that the use duration of the first user credential reaches the user credential use period, obtaining a user permission corresponding to the first user credential, and opening the user permission which is the same as the user permission corresponding to the first user credential for the second user credential. The use of the first user credential is stopped. And starting the second user voucher to complete dynamic updating of the user voucher. The invention further provides a user certificate dynamic updating device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of financial technology, specifically to the field of big data technology, and in particular to a method, apparatus, device, medium and program product for dynamically updating user credentials. Background Art

[0002] With the rapid development of the data economy, enterprises, including banks, are increasingly demanding secure database password management. Current database password management relies primarily on static strategies requiring manual intervention: password rotation requires downtime for maintenance, and manually triggered restarts to update configurations. The same password may be shared by multiple databases.

[0003] This database password management solution has the following problems: password modification requires downtime, affecting the business continuity of related nodes; manual intervention is frequent, operational efficiency is low, and human errors are easily introduced; the password update cycle is long and the risk of exposure is high; and the sharing of passwords among multiple databases increases the risk of lateral attack threats. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for dynamically updating user credentials.

[0005] According to a first aspect of the present disclosure, a method for dynamically updating user credentials is provided, the method comprising: obtaining a first user credential currently being used by a client, presetting a user credential management policy, the user credential management policy comprising: a user credential usage cycle; monitoring the usage duration of the first user credential, and in response to the usage duration of the first user credential reaching a preset threshold, generating a second user credential based on the preset user credential management policy, wherein the usage status of the second user credential is an unused status; in response to the usage duration of the first user credential reaching the user credential usage cycle, obtaining a user right corresponding to the first user credential, and granting the second user credential the same user right as the user right corresponding to the first user credential; stopping the use of the first user credential and updating the usage status of the first user credential to a stopped-use status; and enabling the second user credential and updating the usage status of the second user credential to a used status, to complete the dynamic update of the user credentials.

[0006] According to an embodiment of the present disclosure, the user credential management strategy also includes: client identification, obtaining the first user credential being used by the client, including: obtaining the client identification from the metadata table, verifying the legitimacy of the client identification; and if the legitimacy verification of the client identification passes, obtaining the first user credential whose usage status is used from the credential storage table.

[0007] According to an embodiment of the present disclosure, the user credential management policy also includes: username length, user password length, and generating a second user credential based on the preset user credential management policy, including: generating a unique second user credential username that meets the username length through a random number generator based on the username length; generating a user password for the second user credential that meets the user password length through a cryptographic random number generator based on the user password length; and mapping the username of the second user credential and the user password of the second user credential one-to-one to generate the second user credential.

[0008] According to an embodiment of the present disclosure, opening the same user rights as the user rights corresponding to the first user credential for the second user credential includes: constructing a user rights structure model based on the user rights corresponding to the first user credential; mirroring the user rights structure model to generate a user rights image; applying the user rights image to the second user credential to generate the user rights corresponding to the second user credential; and performing consistency verification on the user rights corresponding to the second user credential. If the verification is successful, it indicates that the same user rights as the user rights corresponding to the first user credential have been successfully opened for the second user credential.

[0009] According to an embodiment of the present disclosure, a user permission structure model is constructed based on the user permission corresponding to the first user credential, including: querying a database of user permissions corresponding to the first user credential; obtaining direct permissions, inherited permissions and attribute permissions in the database of user permissions corresponding to the first user credential; and constructing a permission tree structure model based on the direct permissions, the inherited permissions and the attribute permissions.

[0010] According to an embodiment of the present disclosure, consistency verification is performed on the user rights corresponding to the second user credentials, including: model lightweight structure consistency verification is performed on the user rights corresponding to the second user credentials; or interface gateway verification access control consistency verification is performed on the user rights corresponding to the second user credentials.

[0011] According to an embodiment of the present disclosure, the method further includes: sending the second user credential with the usage status updated to the used status to the client through a message queue of the distributed event stream platform.

[0012] According to a second aspect of the present disclosure, a user credential dynamic update device is provided, which includes: a first acquisition module, used to acquire a first user credential being used by a client, and a preset user credential management policy, wherein the user credential management policy includes: a user credential usage cycle; a first generation module, used to monitor the usage time of the first user credential, and in response to the usage time of the first user credential reaching a preset threshold, generate a second user credential based on the preset user credential management policy, wherein the usage status of the second user credential is an unused state; a second acquisition module, used to acquire the user rights corresponding to the first user credential in response to the usage time of the first user credential reaching the user credential usage cycle, and open the user rights corresponding to the first user credential to the second user credential that are the same as the user rights corresponding to the first user credential; a first update module, used to stop using the first user credential and update the usage status of the first user credential to a stopped usage state; and a second update module, used to enable the second user credential and update the usage status of the second user credential to a used state to complete the dynamic update of the user credential.

[0013] According to an embodiment of the present disclosure, the first acquisition module includes: a first verification module, which is used to obtain the client identifier from the metadata table and verify the legitimacy of the client identifier; and a third acquisition module, which is used to obtain the first user credential whose usage status is used from the credential storage table if the legitimacy verification of the client identifier passes.

[0014] According to an embodiment of the present disclosure, the first generation module includes: a second generation module, which is used to generate a unique second user credential username that meets the username length through a random number generator based on the username length; a third generation module, which is used to generate a user password for the second user credential that meets the user password length through a cryptographic random number generator based on the user password length; and a fourth generation module, which is used to perform a one-to-one mapping between the username of the second user credential and the user password of the second user credential to generate the second user credential.

[0015] According to an embodiment of the present disclosure, the second acquisition module includes: a fifth generation module for constructing a user authority structure model based on the user authority corresponding to the first user credential; a sixth generation module for mirroring the user authority structure model to generate a user authority image; a seventh generation module for applying the user authority image to the second user credential to generate the user authority corresponding to the second user credential; and an eighth generation module for performing consistency verification on the user authority corresponding to the second user credential, where if the verification is successful, it indicates that the user authority corresponding to the second user credential that is the same as the user authority corresponding to the first user credential has been successfully opened for the second user credential.

[0016] According to an embodiment of the present disclosure, the fifth generation module includes: a first query module for querying a database of user permissions corresponding to the first user credential; a fourth acquisition module for acquiring direct permissions, inherited permissions and attribute permissions in a database of user permissions corresponding to the first user credential; and an eighth generation module for constructing a permission tree structure model based on the direct permissions, the inherited permissions and the attribute permissions.

[0017] According to a third aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned user credential dynamic update method.

[0018] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which executable instructions or computer programs are stored. When the instructions or computer programs are executed by a processor, the processor executes the above-mentioned user credential dynamic update method.

[0019] According to a fifth aspect of the present disclosure, a computer program product is further provided, comprising a computer program, which implements the above-mentioned method for dynamically updating user credentials when executed by a processor.

[0020] This disclosure uses a user credential management policy to generate a second user credential for the client's current first user credential, dynamically updating it. This reduces the risk of credential leakage and enhances data security; avoids service interruptions and improves system reliability; reduces operational costs, reduces human errors, and agilely manages processes; and seamlessly switches user credentials, enhancing user experience. This addresses the existing technical issues of password modification requiring downtime, impacting the business continuity of associated nodes; frequent manual intervention, low operational efficiency, and the susceptibility to human error; long password update cycles, high exposure risks, and the exacerbation of lateral attack threats by sharing passwords across multiple repositories. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0022] Figure 1 A diagram schematically illustrates an application scenario of a method and apparatus for dynamically updating user credentials according to an embodiment of the present disclosure;

[0023] Figure 2 Schematically shows a flow chart of a method for dynamically updating user credentials according to an embodiment of the present disclosure;

[0024] Figure 3Schematically shows a flow chart for obtaining a first user credential in a method for dynamically updating user credentials according to an embodiment of the present disclosure;

[0025] Figure 4 Schematically shows a flow chart of generating a second user credential in a method for dynamically updating user credentials according to an embodiment of the present disclosure;

[0026] Figure 5 Schematically shows a flow chart of opening permissions for a second user credential in a method for dynamically updating user credentials according to an embodiment of the present disclosure;

[0027] Figure 6 Schematically shows a flow chart of constructing a permission structure model in a method for dynamically updating user credentials according to an embodiment of the present disclosure;

[0028] Figure 7 A system diagram schematically illustrates a specific embodiment of a method for dynamically updating user credentials according to an embodiment of the present disclosure;

[0029] Figure 8 Schematically shows a structural block diagram of a device for dynamically updating user credentials according to an embodiment of the present disclosure; and

[0030] Figure 9 A block diagram of an electronic device suitable for implementing a method for dynamically updating user credentials according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0031] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0032] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0033] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0034] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0035] The accompanying drawings illustrate some block diagrams and / or flow charts. It should be understood that some blocks in the block diagrams and / or flow charts, or combinations thereof, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable control device, so that when executed by the processor, these instructions may create a device for implementing the functions / operations described in the block diagrams and / or flow charts.

[0036] An embodiment of the present disclosure provides a method for dynamically updating user credentials, the method comprising: obtaining a first user credential being used by a client, presetting a user credential management policy, the user credential management policy comprising: a user credential usage cycle. Monitoring the usage duration of the first user credential, and in response to the usage duration of the first user credential reaching a preset threshold, generating a second user credential based on the preset user credential management policy, wherein the usage status of the second user credential is an unused state. In response to the usage duration of the first user credential reaching the user credential usage cycle, obtaining the user rights corresponding to the first user credential, and opening the same user rights as those corresponding to the first user credential for the second user credential. Stopping use of the first user credential, and updating the usage status of the first user credential to a stopped state. And enabling the second user credential, and updating the usage status of the second user credential to a used state, to complete the dynamic update of user credentials.

[0037] According to the disclosed embodiments, a technical approach to dynamically update the first user credential currently in use on a client by generating a second user credential through a user credential management policy reduces the risk of credential leakage and enhances data security; avoids service interruptions and improves system reliability; reduces operational costs, reduces human errors, and agilely manages processes; and seamlessly switches user credentials, enhancing the user experience. This addresses the technical issues of existing technologies, such as password changes requiring downtime, impacting the business continuity of associated nodes; frequent manual intervention, low operational efficiency, and the susceptibility to human error; long password update cycles, high exposure risks, and the increased risk of lateral attack threats due to shared passwords across multiple repositories.

[0038] Figure 1 The following schematically illustrates an application scenario diagram of the method and apparatus for dynamically updating user credentials according to an embodiment of the present disclosure. Figure 1 The examples shown are merely examples of scenarios in which the embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0039] like Figure 1 As shown, the application scenario 100 according to this embodiment may include an application scenario in which user credentials are dynamically updated. A network 104 is used as a medium for providing a communication link between a first terminal device 101, a second terminal device 102, a third terminal device 103, and a server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0040] A user may use a first terminal device 101, a second terminal device 102, or a third terminal device 103 to interact with a server 105 via a network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, or the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (for example only).

[0041] The first terminal device 101 , the second terminal device 102 , and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0042] The server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process received data such as user requests, and feed back processing results (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal devices.

[0043] It should be noted that the user credential dynamic update method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the user credential dynamic update device provided in the embodiment of the present disclosure can generally be set in the server 105. The user credential dynamic update method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the user credential dynamic update device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0044] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0045] The following will be based on Figure 1 The scene described by Figures 2 to 7 The user credential dynamic update method of the disclosed embodiment is described in detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present disclosure, and the embodiments of the present disclosure are not limited in this respect. On the contrary, the embodiments of the present disclosure can be applied to any applicable scenario.

[0046] Figure 2 The flowchart of the method for dynamically updating user credentials according to an embodiment of the present disclosure is schematically shown.

[0047] like Figure 2 As shown, the method 200 includes steps S201 to S205.

[0048] Step S201: obtaining a first user credential currently being used by a client, and presetting a user credential management policy, wherein the user credential management policy includes: a user credential usage period, a client identifier, a user name length, and a user password length.

[0049] For example, the user credential usage period can be a fixed period or a dynamic period that changes over time, and the client identifier is unique.

[0050] Figure 3 The flowchart of obtaining the first user credential in the method for dynamically updating user credentials according to an embodiment of the present disclosure is schematically shown.

[0051] like Figure 3 As shown, the method 300 includes steps S301-S302.

[0052] Step S301: Obtain the client identifier from the metadata table and verify the legitimacy of the client identifier.

[0053] For example, the client identifier may be obtained from the metadata table of the node database, and the rule validity and format validity of the client identifier may be verified.

[0054] Step S302: If the legitimacy of the client identifier is verified to be passed, a first user credential whose usage status is "used" is obtained from a credential storage table.

[0055] By obtaining the client identifier from the metadata table and the first user credential from the credential storage table, the client identifier and the first user credential are stored separately, thereby achieving the technical effect of data isolation, reducing the risk of data leakage, and improving data security.

[0056] Return to reference Figure 2 In step S202, the usage time of the first user credential is monitored. In response to the usage time of the first user credential reaching a preset threshold, a second user credential is generated based on the preset user credential management policy, and the usage status of the second user credential is unused.

[0057] Figure 4 The flowchart of generating the second user credential in the method for dynamically updating user credentials according to an embodiment of the present disclosure is schematically shown.

[0058] like Figure 4 As shown, the method 400 includes steps S401 to S403.

[0059] Step S401: Generate a unique second user credential username that meets the username length through a random number generator according to the username length.

[0060] Step S402: Generate a user password of a second user credential that meets the length of the user password using a cryptographic random number generator according to the length of the user password.

[0061] Step S403: Map the user name of the second user credential and the user password of the second user credential one to one to generate the second user credential.

[0062] The technical means of generating the second user credential by using the username length and the user password length achieves the technical effect of improving the robustness and reliability of the second user credential.

[0063] Return to reference Figure 2In step S203, in response to the first user credential usage time reaching the user credential usage period, the user rights corresponding to the first user credential are obtained, and the user rights corresponding to the first user credential are opened for the second user credential.

[0064] Figure 5 The flowchart of granting permission to the second user credential in the method for dynamically updating user credentials according to an embodiment of the present disclosure is schematically shown.

[0065] like Figure 5 As shown, the method 500 includes steps S501 to S504.

[0066] Step S501: construct a user authority structure model based on the user authority corresponding to the first user credential.

[0067] Figure 6 The flowchart of constructing the authority structure model in the method for dynamically updating user credentials according to an embodiment of the present disclosure is schematically shown.

[0068] like Figure 6 As shown, the method 600 includes steps S601 to S603.

[0069] Step S601: query a database of user rights corresponding to the first user credential.

[0070] For example, a database query language may be used to query a database of user permissions corresponding to the first user credential.

[0071] Step S602: Obtain direct permissions, inherited permissions, and attribute permissions in a database of user permissions corresponding to the first user credential.

[0072] For example, you can query direct permission data, then query user inherited permission data and user attribute permission data.

[0073] Step S603: constructing a permission tree structure model according to the direct permission, the inherited permission and the attribute permission.

[0074] For example, the direct permission data can be used, and then the user inherited permission data and user attribute permission data can be queried to construct a permission tree to generate a permission tree structure model.

[0075] By constructing a permission tree structure model based on direct permissions, inherited permissions and attribute permissions in a database of user permissions corresponding to a first user credential, the technical effect of improving the efficiency and reliability of generating user permissions corresponding to a second user credential is achieved.

[0076] Return to reference Figure 5In step S502, the user authority structure model is mirrored to generate a user authority mirror.

[0077] For example, you can copy the permission tree structure, remove one-time permission data, delete expired permissions, and add permission inheritance tags to generate user permission mirror data.

[0078] Step S503: Apply the user permission mirroring to the second user credential to generate user permissions corresponding to the second user credential.

[0079] For example, the user permission mirror data is applied to the second user's credentials, and the permission cache is refreshed.

[0080] Step S504 : performing consistency verification on the user rights corresponding to the second user credential. If the verification succeeds, it indicates that the user rights corresponding to the first user credential are successfully opened for the second user credential.

[0081] For example, the user permissions corresponding to the second user credentials can be verified for consistency with the model lightweight structure, or the user permissions corresponding to the second user credentials can be verified for consistency with the interface gateway verification and access control. By performing the technical means of performing the model lightweight structure and interface gateway verification and access control consistency verification, the technical effect of improving the efficiency and reliability of consistency verification is achieved.

[0082] In addition to unit consistency testing to compare the user permissions corresponding to the second user's credentials with the lightweight structure of the permissions model, and integration testing to verify access control through the interface gateway, penetration verification can also be performed by attempting to unauthorized access to sensitive resources using the user permissions corresponding to the second user's credentials. Performance testing can also be performed to measure changes in permission decision latency. Disaster recovery testing can also be performed to simulate permission rollback in the event of a failure.

[0083] By constructing a user authority structure model, generating mirrored permissions, and further generating user authority technical means corresponding to the second user credentials, the technical effect of improving the accuracy and reliability of the user authority corresponding to the generated second user credentials is achieved.

[0084] Return to reference Figure 2 In step S204, the first user credential is stopped from being used, and the use state of the first user credential is updated to a stopped use state.

[0085] Step S205 : activating the second user credential and updating the usage status of the second user credential to a used status, so as to complete the dynamic update of the user credential.

[0086] For example, the second user credential, whose usage status is updated to "used," can be sent to the client via the message queue of the distributed event stream platform, thereby achieving state synchronization between the server and the client. This technical approach of sending via the message queue of the distributed event stream platform improves the efficiency of dynamic updates of user credentials.

[0087] Figure 7 A system diagram schematically illustrates a specific embodiment of the method for dynamically updating user credentials according to an embodiment of the present disclosure.

[0088] like Figure 7 As shown, the system 700 includes: a human-machine password management system for user lifecycle management, dynamic password generation, authority allocation, and distributed event stream platform message publishing; a human-machine password management system database for storing user configuration, password ciphertext, node identification and status information; a business node for receiving distributed event stream platform messages, decrypting passwords, updating local configurations, and connecting to databases; and a business database for storing business data.

[0089] The human-machine password management system is specifically used to: maintain the business database configuration, periodically randomly generate a new temporary user and password based on the username length, password length, user life cycle and other rules pre-configured by the business node identifier, and store it in its own database. Perform regular scans, enable new users, and log out expired users one by one. Connect to the corresponding business database to generate users and authorize them. Monitor the IP address and connected database status of the business node through the distributed event stream platform based on the node identifier. Generate an encrypted password based on the node identifier and user and share it with the monitored business node through the distributed event stream platform. After receiving the information that the business node has successfully connected to the database using a new user, the distributed event stream platform updates the connection monitoring information.

[0090] Business nodes are client nodes specifically used to dynamically obtain the encrypted business database account and password from the distributed event streaming platform, then decrypt the encrypted account and password locally, update the in-memory database user password, and create a new database connection. Upon successful database connection update, the distributed event streaming platform reports the node ID, IP address, and database connection information to the human-machine password management system.

[0091] The specific workflow of system 700 is as follows: The human-machine password management system pre-configures user configurations, including database username length, password length, user lifecycle, business node identifier, and business node public key. Business nodes periodically use the distributed event stream platform to report node database connection status to the human-machine password management system for monitoring. The human-machine password management system periodically scans user configurations. If a user's lifecycle is nearing, it automatically creates a new user with a random usage period and corresponding password, setting the status to "unused." It then uses the previous version of the user to connect to the corresponding database, adding the new version user and granting the original user permissions. The human-machine password management system periodically monitors users in both "unused" and "in-use" states. If the expiration date is reached, the user status is changed to "expired." The database user and encrypted password are encrypted using a specific key based on the node identifier and pushed to the business node via the distributed event stream platform. The business node obtains the temporary user and password ciphertext from the distributed event stream platform, decrypts them, obtains the plaintext, updates the in-memory database configuration, and reestablishes the database connection. Once the connection is successfully reestablished, the business node notifies the human-machine password management system via the distributed event stream platform. The human-machine password management system then sets the temporary user's status to "in-use" and disconnects monitoring of the old user and business node. The HMI password management system regularly monitors expired users in the database to see if they have all been disconnected. Once all expired users have been disconnected, their status is reset to deletable. If a user's renewal has expired at this time, they can be reactivated. The HMI password management system periodically deletes deletable users from the database, reclaiming their database permissions and resetting their status to deleted.

[0092] This embodiment enables parallel switching through temporary users, avoiding service interruptions. Dynamic password rotation cycles are shortened to minutes, and passwords for each database are managed independently. This reduces manual operations, lowers error rates, and improves the experience for operations and maintenance personnel.

[0093] Figure 8 The following schematically shows a structural block diagram of a device for dynamically updating user credentials according to an embodiment of the present disclosure.

[0094] like Figure 8 As shown, the apparatus 800 includes: a first acquisition module 801 , a first generation module 802 , a second acquisition module 803 , a first update module 804 and a second update module 805 .

[0095] The first acquisition module 801 is configured to acquire a first user credential currently in use by the client and to pre-set a user credential management policy, wherein the user credential management policy includes: a user credential usage period, a client identifier, a username length, and a user password length. In one embodiment, the first acquisition module 801 may be configured to execute step S201 described above.

[0096] The first acquisition module 801 includes: a first verification module and a third acquisition module.

[0097] The first verification module is used to obtain the client identifier from the metadata table and verify the legitimacy of the client identifier. In one embodiment, the first verification module can be used to execute step S301 described above, which will not be repeated here.

[0098] The third acquisition module is configured to acquire the first user credential whose usage status is used from the credential storage table if the legitimacy verification of the client identifier passes. In one embodiment, the third acquisition module may be configured to execute step S302 described above, which will not be described in detail here.

[0099] The first generation module 802 is configured to monitor the usage duration of the first user credential and, in response to the usage duration of the first user credential reaching a preset threshold, generate a second user credential based on the preset user credential management policy, where the usage status of the second user credential is unused. In one embodiment, the first generation module 802 can be configured to execute step S202 described above.

[0100] The first generating module 802 includes: a second generating module, a third generating module and a fourth generating module.

[0101] The second generating module is configured to generate a unique second user credential username that meets the username length through a random number generator according to the username length. In one embodiment, the second generating module can be configured to execute step S401 described above, which will not be described in detail here.

[0102] The third generation module is configured to generate a user password of the second user credential that matches the user password length using a cryptographic random number generator based on the user password length. In one embodiment, the third generation module can be configured to execute step S402 described above, which will not be described in detail herein.

[0103] The fourth generating module is configured to map the username of the second user credential to the user password of the second user credential one-to-one to generate the second user credential. In one embodiment, the fourth generating module may be configured to execute step S403 described above, which will not be described in detail herein.

[0104] The second acquisition module 803 is configured to, in response to the first user credential being used for a period of time equal to the user credential usage period, acquire the user rights corresponding to the first user credential and grant the second user credential the same user rights as those corresponding to the first user credential. In one embodiment, the second acquisition module 803 may be configured to execute step S203 described above.

[0105] The second acquisition module 803 includes: a fifth generation module, a sixth generation module, a seventh generation module and a second verification module.

[0106] The fifth generation module is configured to construct a user authority structure model based on the user authority corresponding to the first user credential. In one embodiment, the fifth generation module may be configured to execute step S501 described above.

[0107] The fifth generating module includes: a first query module, a fourth acquiring module and an eighth generating module.

[0108] The first query module is configured to query a database of user permissions corresponding to the first user credential. In one embodiment, the first query module may be configured to execute step S601 described above, which will not be described in detail herein.

[0109] The fourth acquisition module is used to obtain direct permissions, inherited permissions, and attribute permissions in the user permissions database corresponding to the first user credential. In one embodiment, the fourth acquisition module can be used to execute step S602 described above, which will not be repeated here.

[0110] The eighth generation module is used to construct a permission tree structure model according to the direct permission, the inherited permission and the attribute permission. In one embodiment, the eighth generation module can be used to execute step S603 described above, which will not be repeated here.

[0111] The sixth generation module is used to perform mirroring on the user authority structure model to generate a user authority mirror. In one embodiment, the sixth generation module can be used to execute step S502 described above, which will not be described in detail here.

[0112] The seventh generating module is configured to apply the user rights mirroring to the second user credential to generate user rights corresponding to the second user credential. In one embodiment, the seventh generating module may be configured to execute step S503 described above, which will not be described in detail herein.

[0113] The second verification module is configured to verify the consistency of the user rights corresponding to the second user credential. If the verification succeeds, it indicates that the second user credential has been granted the same user rights as those corresponding to the first user credential. In one embodiment, the second verification module can be configured to execute step S504 described above, which will not be described in detail here.

[0114] The first updating module 804 is configured to stop using the first user credential and update the usage status of the first user credential to a stopped usage status. In one embodiment, the first updating module 804 may be configured to execute step S204 described above, which will not be described in detail herein.

[0115] The second updating module 805 is used to enable the second user credential and update the usage status of the second user credential to the used status to complete the dynamic update of the user credential. In one embodiment, the second updating module 805 can be used to execute the step S205 described above, which will not be repeated here.

[0116] According to embodiments of the present disclosure, any multiple modules among the first acquisition module 801, the first generation module 802, the second acquisition module 803, the first update module 804, and the second update module 805 can be combined into a single module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in a single module. According to embodiments of the present disclosure, at least one of the first acquisition module 801, the first generation module 802, the second acquisition module 803, the first update module 804, and the second update module 805 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented in hardware or firmware through any other reasonable means of circuit integration or packaging, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or any appropriate combination of any of these. Alternatively, at least one of the first acquisition module 801 , the first generation module 802 , the second acquisition module 803 , the first update module 804 and the second update module 805 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0117] Figure 9 A block diagram of an electronic device suitable for implementing a method for dynamically updating user credentials according to an embodiment of the present disclosure is schematically shown.

[0118] like Figure 9 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage unit 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present disclosure.

[0119] Various programs and data required for the operation of the electronic device 900 are stored in the RAM 903. The processor 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. The processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs may also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 may also perform various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0120] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 908 including a hard disk; and a communication section 909 including a network interface card such as a LAN card or a modem. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. Removable media 911, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 910 as needed, so that computer programs read from the removable media can be installed in the storage section 908 as needed.

[0121] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when executed, implements the method according to the embodiments of the present disclosure.

[0122] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above, and / or one or more memories other than ROM 902 and RAM 903.

[0123] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to enable the computer system to implement the user credential dynamic update method provided by the embodiments of the present disclosure.

[0124] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the processor 901 executes the computer program. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0125] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0126] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from a removable medium 911. When the computer program is executed by the processor 901, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0127] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0128] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0129] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0130] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for dynamically updating user credentials, characterized in that: The method includes: Obtaining a first user credential currently being used by the client, and presetting a user credential management policy, wherein the user credential management policy includes: a user credential usage period; monitoring a usage duration of the first user credential, and generating a second user credential based on the preset user credential management policy in response to the usage duration of the first user credential reaching a preset threshold, wherein the usage status of the second user credential is an unused status; In response to the first user credential being used for a period of time that reaches the user credential usage period, obtaining the user rights corresponding to the first user credential, and granting the second user credential the same user rights as those corresponding to the first user credential; Stop using the first user credential and update the usage status of the first user credential to a stopped usage status; and The second user credential is enabled, and the usage status of the second user credential is updated to a used status, so as to complete the dynamic update of the user credential.

2. The method according to claim 1, characterized in that The user credential management strategy further includes: client identification, obtaining the first user credential currently being used by the client, including: Obtaining the client identifier from the metadata table and verifying the legitimacy of the client identifier; and If the legitimacy verification of the client identifier is passed, a first user credential whose usage status is "used" is obtained from the credential storage table.

3. The method according to claim 1, characterized in that The user credential management policy further includes: username length, user password length, and generating a second user credential based on the preset user credential management policy includes: Generating a unique second user credential username that matches the username length using a random number generator based on the username length; Generating a user password of a second user credential that matches the length of the user password using a cryptographic random number generator according to the length of the user password; and The user name of the second user credential and the user password of the second user credential are mapped one to one to generate the second user credential.

4. The method according to claim 1, wherein Enabling the same user rights as those corresponding to the first user credential for the second user credential includes: Building a user authority structure model based on the user authority corresponding to the first user credential; Performing mirroring on the user authority structure model to generate a user authority mirror image; Applying the user permission mirror to the second user credential to generate user permissions corresponding to the second user credential; and A consistency verification is performed on the user rights corresponding to the second user credential. If the verification is successful, it indicates that the user rights corresponding to the first user credential are successfully opened for the second user credential.

5. The method according to claim 4, characterized in that Constructing a user authority structure model based on the user authority corresponding to the first user credential includes: querying a database of user permissions corresponding to the first user credential; Obtaining direct permissions, inherited permissions, and attribute permissions in a database of user permissions corresponding to the first user credential; and A permission tree structure model is constructed according to the direct permission, the inherited permission and the attribute permission.

6. The method according to claim 4, characterized in that Performing consistency verification on the user rights corresponding to the second user credential includes: Performing model lightweight structure consistency verification on the user authority corresponding to the second user credential; or Perform interface gateway authentication access control consistency verification on the user rights corresponding to the second user credential.

7. The method according to any one of claims 1 to 6, characterized in that The method further includes: The second user credentials with the usage status updated to the used status are sent to the client through the message queue of the distributed event stream platform.

8. A user credential dynamic update device, characterized in that: The device includes: A first acquisition module is configured to acquire a first user credential currently being used by a client and to preset a user credential management policy, wherein the user credential management policy includes: a user credential usage period; a first generating module configured to monitor a usage duration of the first user credential and, in response to the usage duration of the first user credential reaching a preset threshold, generate a second user credential based on the preset user credential management policy, wherein the usage status of the second user credential is an unused status; a second acquisition module configured to, in response to the first user credential being used for a period of time that reaches the user credential usage period, acquire user rights corresponding to the first user credential, and grant the second user credential the same user rights as those corresponding to the first user credential; a first updating module, configured to stop using the first user credential and update the usage status of the first user credential to a stopped-use status; and The second updating module is configured to enable the second user credential and update the usage status of the second user credential to a used status, so as to complete the dynamic update of the user credential.

9. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, The method further comprises the step of executing the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images