System configuration parameter processing method, system, equipment, medium and product

Abstract

The invention discloses a system configuration parameter processing method, system and device, a medium and a product, relates to the technical field of big data, cloud computing, data security and distribution, and can be used in the field of financial science and technology. The method comprises the following steps: initiating an application service starting request comprising a target data source to a configuration management center, so that the configuration management center determines encrypted access information, a second public key and a first shared component according to the target data source; acquiring encrypted access information, a second public key and a first shared component fed back by the configuration management center; wherein the encrypted access information comprises an encrypted user name and an encrypted user password; determining target access information of the target data source according to the encrypted access information, a second public key and a first shared component; the target access information comprises a user name and a user password; and accessing the target data source by adopting the target access information to complete a business service. According to the scheme, the security of the access information is improved.

Description

Technical Field

[0001] This invention relates to the fields of big data, cloud computing, data security and distributed technologies, and can be used in the field of financial technology. In particular, it relates to a method, system, device, medium and product for processing system configuration parameters. Background Technology

[0002] Financial institutions' data centers have adopted cloud computing, with various business functions implemented using distributed service combinations. In the data centers of large financial institutions, there can be hundreds of thousands or even millions of distributed service nodes. In fulfilling their respective financial service capabilities, these distributed service nodes mostly need to access relevant financial business data, which is typically stored in distributed databases, caching systems, data lakes, message middleware, and other storage systems. To ensure data access security, these storage systems need to assign a corresponding login user, password, and authorized access scope to each visitor (server node).

[0003] A service node may need to access multiple data sources simultaneously, such as caches and databases; conversely, a data source (such as a database) may need to provide data access services to multiple service nodes, thus forming a many-to-many relationship. This necessitates setting up a large number of data access login users and passwords. For example, assuming 6 nodes need to access 3 databases simultaneously, 6 x 3, or a total of 18 login users and passwords, would be required. Therefore, to implement authorized access control, large financial institution data centers need to configure a large number of login users and passwords on servers for login permission verification when accessing data resources. Summary of the Invention

[0004] This invention provides a method, system, device, medium, and product for processing system configuration parameters to ensure the accuracy of obtaining parameter information such as user accounts and passwords.

[0005] According to one aspect of the present invention, a method for processing system configuration parameters is provided, applied to an application server, comprising:

[0006] A request to start an application service, including the target data source, is sent to the configuration management center so that the configuration management center can determine the encrypted access information, the second public key, and the first shared component based on the target data source.

[0007] Obtain the encrypted access information, the second public key, and the first shared component fed back by the configuration management center; wherein, the encrypted access information includes the encrypted username and user password;

[0008] Based on the encrypted access information, the second public key, and the first shared component, the target access information of the target data source is determined; the target access information includes the username and the user password.

[0009] The target data source is accessed using the target access information to complete the business service.

[0010] According to another aspect of the present invention, a method for processing system configuration parameters is provided, applied to a configuration management center, comprising:

[0011] In response to an application service startup request initiated by the application server, which includes a target data source, the system uses the target data source as an index to retrieve encrypted access information and public key information locally. The encrypted access information includes an encrypted username and password. The public key information includes a first public key, a second public key, and a combined public key. The first public key is generated by the configuration management center, and the second public key is generated by the application server.

[0012] Based on the first public key, find the corresponding first private key locally;

[0013] The first shared component is calculated using the first private key and the joint public key;

[0014] The encrypted access information, the second public key, and the first shared component are fed back to the application server.

[0015] According to another aspect of the present invention, a method for processing system configuration parameters is provided, applied to a system user management terminal, comprising:

[0016] Link the target data source and randomly generate target access information for the target data source according to role permissions; the target access information includes username and user password;

[0017] Generate a third public-private key pair; the third public-private key pair includes a third public key and a third private key;

[0018] Access the configuration management center and randomly select a first public key and a second public key from the configuration management center;

[0019] The target access information is encrypted using the first public key, the second public key, and the third private key to obtain encrypted access information.

[0020] The target data source, the encrypted access information, and the public key information are sent to the configuration management center for storage; wherein, the public key information includes a first public key, a second public key, and a combined public key.

[0021] According to another aspect of the present invention, a system for processing system configuration parameters is provided, comprising a system user control terminal, a configuration management center, and an application server; wherein,

[0022] The system user management terminal is used to generate target access information for the target data source, encrypt the target access information to obtain encrypted access information, and store the encrypted access information in the configuration management center.

[0023] The configuration management center is used to store encrypted access information and public key information, and to provide the public key information to the outside world; wherein the public key information includes a first public key, a second public key, and a combined public key; wherein the first public key is generated by the configuration management center; and the second public key is generated by the application server.

[0024] The application server is used to obtain the encrypted access information and public key information of the target data source from the configuration management center, and decrypt the encrypted access based on the public key information and the local second private key to obtain the target access information, and log in to the target data source based on the target access information.

[0025] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0026] At least one processor, and

[0027] A memory communicatively connected to the at least one processor; wherein,

[0028] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the system configuration parameter processing method according to any embodiment of the present invention.

[0029] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the system configuration parameter processing method described in any embodiment of the present invention.

[0030] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the system configuration parameter processing method according to any embodiment of the present invention.

[0031] The technical solution of this invention involves initiating an application service startup request, including a target data source, to a configuration management center. This allows the configuration management center to determine encrypted access information, a second public key, and a first shared component based on the target data source. The system then obtains the encrypted access information, second public key, and first shared component returned by the configuration management center. The encrypted access information includes an encrypted username and password. Based on the encrypted access information, second public key, and first shared component, target access information for the target data source is determined. This target access information includes the username and password. The target access information is then used to access the target data source to complete the business service. This technical solution minimizes the occurrence of plaintext when the application server uses the user password, preventing decryption key leakage and ensuring the security of the access information.

[0032] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart of a system configuration parameter processing method provided by an embodiment of the present invention;

[0035] Figure 2 This is a flowchart of a system configuration parameter processing method provided by an embodiment of the present invention;

[0036] Figure 3 This is a flowchart of a system configuration parameter processing method provided by an embodiment of the present invention;

[0037] Figure 4 This is an architecture diagram of a system for processing system configuration parameters according to an embodiment of the present invention;

[0038] Figure 5 This is a schematic diagram of a system configuration parameter processing device provided according to an embodiment of the present invention;

[0039] Figure 6 This is a schematic diagram of a system configuration parameter processing device provided according to an embodiment of the present invention;

[0040] Figure 7This is a schematic diagram of a system configuration parameter processing device provided according to an embodiment of the present invention;

[0041] Figure 8 This is a schematic diagram of the structure of an electronic device that implements the system configuration parameter processing method of the embodiments of the present invention. Detailed Implementation

[0042] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0043] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0044] Furthermore, it should be noted that the information collected in the technical solution of this invention is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data all comply with the relevant laws, regulations and standards of relevant countries and regions, necessary confidentiality measures have been taken, and public order and good morals are not violated. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0045] Figure 1 This is a flowchart illustrating a method for processing system configuration parameters according to an embodiment of the present invention. This embodiment is applicable to situations requiring the security of system configuration parameters such as user accounts and passwords. The method can be executed by a system configuration parameter processing device, which can be implemented in hardware and / or software. This device can be configured in an electronic device that carries the system configuration parameter processing function, such as an application server. Here, the application server refers to the server of the requesting party; the requesting party refers to the party that needs to access the target data source. Figure 1As shown, the method includes:

[0046] S110. Initiate an application service startup request, including the target data source, to the configuration management center so that the configuration management center can determine the encrypted access information, the second public key, and the first shared component based on the target data source.

[0047] In this embodiment, the application service startup request refers to an access startup request used to access the target data source, specifically requesting the target access information for logging into the target data source, including the username and password. The target data source refers to the data source the user wants to access; it should be noted that the data source includes, but is not limited to, databases, caches, and big data. Encrypted access information refers to data after the target access information has been encrypted. The second public key is generated by the application server and stored in the configuration management center, used to encrypt the target access information. It can be understood that having the configuration management center manage the public key facilitates encryption of the target access information by the user system management terminal, avoiding direct interaction between the user system management terminal and the application server.

[0048] The so-called first shared component is generated by the configuration management center based on the first private key and the combined public key, and is used to encrypt the target access information; the first private key is the private key in the public-private key pair generated by the configuration management center; the combined public key is the public key generated by the system user management terminal.

[0049] The configuration management center is used to store various configuration information of the application server, including but not limited to public key information and encrypted access information.

[0050] Specifically, the application server initiates an application service startup request to the configuration management center, including the target data source; correspondingly, after receiving the application service startup request, the configuration management center retrieves the encrypted access information, the second public key, and the first shared component from the local machine based on the index of the target data source, and feeds back the encrypted access information, the second public key, and the first shared component to the application server.

[0051] S120: Obtain the encrypted access information, second public key, and first shared component from the configuration management center.

[0052] The encrypted access information includes the encrypted username and password.

[0053] Specifically, the application server obtains the encrypted access information, the second public key, and the first shared component from the configuration management center.

[0054] S130. Determine the target access information of the target data source based on the encrypted access information, the second public key, and the first shared component.

[0055] The target access information includes the username and password.

[0056] An alternative approach is to use a second public key and a first shared component to decrypt the encrypted access information to obtain the target access information.

[0057] Another alternative approach is to look up the corresponding second private key locally based on the second public key; calculate the second shared component based on the second private key and the combined public key; combine the first shared component and the second shared component to obtain the shared point; use the shared point to call the key derivation function to calculate the symmetric encryption key; and decrypt the encrypted access information using the symmetric encryption key based on the symmetric encryption algorithm to obtain the target access information of the target data source.

[0058] It should be noted that the second public key and the second private key are public and private key pairs that are randomly generated in advance by the application server. The second public key is stored in the configuration management center, and the second private key is stored locally on the application server.

[0059] Specifically, using the second public key as an index, the corresponding second private key is found locally on the application server. The second private key and the joint public key are multiplied to obtain the second shared component. The first shared component and the second shared component are added to obtain the shared point. Based on the shared point, the key derivation function is called to obtain the symmetric encryption key. Based on the symmetric encryption algorithm, the encrypted access information is decrypted using the symmetric encryption key to obtain the target access information of the target data source.

[0060] It is understandable that data security is ensured by decrypting encrypted access information using public and private keys from different endpoints.

[0061] S140. Use target access information to access the target data source in order to complete the business service.

[0062] Specifically, the requester can access the target data source through the application server using the target access information to complete the business service.

[0063] The technical solution of this invention involves initiating an application service startup request, including a target data source, to a configuration management center. This allows the configuration management center to determine encrypted access information, a second public key, and a first shared component based on the target data source. The system then obtains the encrypted access information, second public key, and first shared component returned by the configuration management center. The encrypted access information includes an encrypted username and password. Based on the encrypted access information, second public key, and first shared component, target access information for the target data source is determined. This target access information includes the username and password. The target access information is then used to access the target data source to complete the business service. This technical solution minimizes the occurrence of plaintext when the application server uses the user password, preventing decryption key leakage and ensuring the security of the access information.

[0064] Figure 2This is a flowchart illustrating a method for processing system configuration parameters according to an embodiment of the present invention. This embodiment is applicable to situations requiring the security of system configuration parameters such as user accounts and passwords. The method can be executed by a system configuration parameter processing device, which can be implemented in hardware and / or software. This device can be configured in an electronic device that performs system configuration parameter processing functions, such as a configuration management center. Figure 2 As shown, the method includes:

[0065] S210. In response to the application service startup request initiated by the application server, which includes the target data source, the encrypted access information and public key information are retrieved locally using the target data source as an index.

[0066] The encrypted access information includes the encrypted username and password; the public key information includes a first public key, a second public key, and a combined public key; the first public key is generated by the configuration management center; and the second public key is generated by the application server.

[0067] Specifically, the configuration management center responds to the application service startup request initiated by the application server, which includes the target data source, and queries the encrypted access information and public key information locally using the target data source as an index.

[0068] S220. Find the corresponding first private key from the local machine based on the first public key.

[0069] It should be noted that the first public-private key pair is generated by the configuration management center and stored locally in the configuration management center.

[0070] S230. The first shared component is calculated using the first private key and the joint public key.

[0071] Specifically, the first shared component is obtained by multiplying the first private key and the joint public key.

[0072] S240, The encrypted access information, the second public key, and the first shared component are fed back to the application server.

[0073] Specifically, the encrypted access information, the second public key, and the first shared component are fed back to the application server.

[0074] The technical solution provided in this invention, in response to an application service startup request initiated by an application server, including a target data source, retrieves encrypted access information and public key information locally using the target data source as an index; retrieves the corresponding first private key locally based on the first public key; calculates a first shared component using the first private key and the combined public key; and feeds back the encrypted access information, the second public key, and the first shared component to the application server. In this technical solution, the configuration management center stores and distributes system parameter information such as public key information and encrypted access information. This ensures that when the application server node is subjected to a security threat, the target access information cannot be restored simply by the configuration management center not providing the shared component, thus guaranteeing the security of the access information.

[0075] Figure 3 This is a flowchart illustrating a method for processing system configuration parameters according to an embodiment of the present invention. This embodiment is applicable to situations requiring the security of system configuration parameters such as user accounts and passwords. The method can be executed by a system configuration parameter processing device, which can be implemented in hardware and / or software. This device can be configured in an electronic device that carries the function of processing system configuration parameters, such as a system user management terminal. Figure 3 As shown, the method includes:

[0076] S310: Link the target data source and randomly generate target access information for the target data source according to role permissions.

[0077] The target access information includes the username and password;

[0078] Specifically, the system's user management terminal can link with the target data source and randomly generate target access information for the target data source according to different role permissions.

[0079] S320, Generate a third public-private key pair.

[0080] The third public-private key pair includes a third public key and a third private key.

[0081] S330. Access the configuration management center and randomly select the first and second public keys from the configuration management center.

[0082] Specifically, in the user system management terminal access configuration management, any first public key and a second public key are randomly selected from the configuration management center.

[0083] S340. Based on the first public key, the second public key, and the third private key, encrypt the target access information to obtain encrypted access information.

[0084] An alternative approach involves calculating a joint public key using a first public key and a second public key; calculating the shared point of the elliptic curve based on a third private key and the joint public key; using the shared point to call a key derivation function to calculate a symmetric encryption key; and encrypting the target access information using the symmetric encryption key based on a symmetric encryption algorithm to obtain encrypted access information.

[0085] Specifically, the first and second public keys are added together to obtain the joint public key. Then, the third private key and the joint public key are multiplied by a dot to obtain the shared point of the elliptic curve. The shared point is used to call the key derivation function to calculate the symmetric encryption key. Then, based on the symmetric encryption algorithm, the target access information is encrypted using the symmetric encryption key to obtain the encrypted access information.

[0086] It is understandable that encrypting target access information based on public keys from different endpoints and local private keys can ensure data security.

[0087] S350: Send the target data source, encrypted access information, and public key information to the configuration management center for storage.

[0088] The public key information includes a first public key, a second public key, and a combined public key.

[0089] Specifically, the data source information, encrypted access information, and public key information of the target data source are sent to the configuration management center for storage.

[0090] The technical solution provided in this invention, by linking to a target data source and randomly generating target access information for the target data source according to role permissions, includes a username and password. A third public-private key pair is generated, comprising a third public key and a third private key. A configuration management center is accessed, and a first and second public key are randomly selected from the configuration management center. The target access information is encrypted using the first, second, and third public keys to obtain encrypted access information. The target data source, encrypted access information, and public key information are sent to the configuration management center for storage. The public key information includes the first public key, the second public key, and a combined public key. In this technical solution, the system user management terminal encrypts the target access information based on the three-party public-private key pair, ensuring that the symmetric key obtained each time is different, thus guaranteeing the security of the access information.

[0091] Figure 4 This is an architecture diagram of a system for processing system configuration parameters according to an embodiment of the present invention. This embodiment is applicable to situations where the security of system configuration parameters such as user accounts and passwords needs to be ensured. Figure 4 As shown, the system includes a system user management terminal 100, a configuration management center 101, and an application server 102; among which,

[0092] The system user management terminal 100, also known as the UCM system user management terminal C, is used to generate target access information for the target data source, encrypt the target access information to obtain encrypted access information, and store the encrypted access information in the configuration management center; where UCM refers to User Centralized Management.

[0093] Specifically, the system user management terminal randomly generates target access information, username, and password for the target data source, and randomly generates a public-private key pair (i.e., a third public-private key pair). It randomly selects a first public key from the configuration management center and a second public key generated by the application server. Based on the first and second public keys, it calculates a joint public key. Based on the third private key and the joint public key, it calculates a shared point. Based on the shared point, it calls the Key Derivation Function (KDF) to generate a symmetric encryption key. The target access information is then encrypted using the symmetric encryption key to obtain encrypted access information, which is then transmitted to the configuration management center.

[0094] The configuration management center 101, also known as configuration management center A, is used to store encrypted access information and public key information, and to provide the public key information to the outside world; wherein the public key information includes a first public key, a second public key, and a combined public key; wherein the first public key is generated by the configuration management center; and the second public key is generated by the application server.

[0095] Specifically, the configuration management process generates a batch of initial public-private key pairs and stores these public keys in the shared public key directory of the configuration management center. It also stores encrypted access information sent by the system user management terminal, i.e., the user and password ciphertext. The system retrieves application service startup requests initiated by the application server, sends encrypted access information of the target data source back to the application server, and calculates the first shared component, sending it back to the application server.

[0096] The application server 102, also known as the application server system X, is used to obtain the encrypted access information and public key information of the target data source from the configuration management center, and decrypt the encrypted access based on the public key information and the local second private key to obtain the target access information, and log in to the target data source based on the target access information.

[0097] Specifically, the application server obtains the encrypted access information and public key information of the target data source from the configuration management center, decrypts the encrypted access based on the public key information and the local second private key to obtain the target access information, that is, calculates the shared point based on the second private key, and calls the KDF key derivation function based on the shared point to generate a symmetric encryption key, decrypts the encrypted access information key using the symmetric encryption key to obtain the target access information, and logs into the target data source based on the target access information.

[0098] It should be noted that the DH (Diffie-Hellman) key exchange principle of this invention introduces the "three-party key negotiation" cryptographic technology, uses the national cryptographic SM2 algorithm curve to complete ECDH key negotiation, namely Elliptic Curve Diffie-Hellman key exchange (ECDH), and uses the negotiated key to achieve encryption protection of important user and password information.

[0099] The technical solution of this invention is environmentally feasible. The system user management terminal, configuration management center, and application server can all have built-in password modules or access external password modules, and the three are independent of each other. User and password information is stored directly in the provider's encrypted form at the intermediate node (configuration management center). Since the intermediate node does not have the private key of the target node (application server), it has no decryption capability, thus achieving secure protection of important information.

[0100] When using ECDH key negotiation, the initiating node (system user management terminal) can generate a public and private key each time, and the intermediate node (configuration management center) and the user node (application server) can also generate or use multiple key pairs each time to ensure that the symmetric key used to encrypt the user and password is different each time, achieving the effect of "one key per user".

[0101] For a node (application server) to decrypt ciphertext and obtain the user and password, the following conditions must be met: the intermediate node (configuration management center) must use its private key to calculate and provide the shared component information. Therefore, if a node is found to be under security threat, control can be achieved (obtaining all other information) simply by preventing the intermediate node from providing the shared component information, thus preventing the plaintext from being recovered.

[0102] Figure 5 This is a schematic diagram of a system configuration parameter processing device according to an embodiment of the present invention. This embodiment is applicable to situations requiring security of system configuration parameters such as user accounts and passwords. The system configuration parameter processing device can be implemented in hardware and / or software, and can be configured in an electronic device that carries the system configuration parameter processing function, such as an application server. Here, the application server refers to the server of the requesting party; the requesting party refers to the party that needs to access the target data source. Figure 5 As shown, the device includes:

[0103] The request initiation module 510 is used to initiate an application service startup request, including the target data source, to the configuration management center so that the configuration management center can determine the encrypted access information, the second public key, and the first shared component based on the target data source.

[0104] The parameter information acquisition module 520 is used to acquire the encrypted access information, the second public key, and the first shared component fed back by the configuration management center; wherein, the encrypted access information includes the encrypted username and user password;

[0105] The target access information determination module 530 is used to determine the target access information of the target data source based on the encrypted access information, the second public key, and the first shared component; the target access information includes the username and the user password.

[0106] The data source access module 540 is used to access the target data source using target access information in order to complete business services.

[0107] The technical solution of this invention involves initiating an application service startup request, including a target data source, to a configuration management center. This allows the configuration management center to determine encrypted access information, a second public key, and a first shared component based on the target data source. The system then obtains the encrypted access information, second public key, and first shared component returned by the configuration management center. The encrypted access information includes an encrypted username and password. Based on the encrypted access information, second public key, and first shared component, target access information for the target data source is determined. This target access information includes the username and password. The target access information is then used to access the target data source to complete the business service. This technical solution minimizes the occurrence of plaintext when the application server uses the user password, preventing decryption key leakage and ensuring the security of the access information.

[0108] Optionally, the target access information determination module 530 is used for:

[0109] Find the corresponding second private key locally based on the second public key;

[0110] The second shared component is calculated based on the second private key and the first shared component;

[0111] The first shared component and the second shared component are combined to obtain the shared point;

[0112] The symmetric encryption key is calculated by calling the key derivation function using the shared point.

[0113] Based on the symmetric encryption algorithm, the encrypted access information is decrypted using the symmetric encryption key to obtain the target access information of the target data source.

[0114] Optionally, the second public key is generated by the application server and stored in the configuration management center.

[0115] The system configuration parameter processing device provided in this embodiment of the invention can execute the system configuration parameter processing method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0116] Figure 6 This is a schematic diagram of a system configuration parameter processing device according to an embodiment of the present invention. This embodiment is applicable to situations where the security of system configuration parameters such as user accounts and passwords needs to be ensured. The system configuration parameter processing device can be implemented in hardware and / or software, and can be configured in an electronic device that carries the system configuration parameter processing function, such as a configuration management center. Figure 6 As shown, the device includes:

[0117] The request-response module 610 is used to respond to an application service startup request initiated by the application server, which includes a target data source. Using the target data source as an index, it searches for encrypted access information and public key information locally. The encrypted access information includes an encrypted username and password. The public key information includes a first public key, a second public key, and a combined public key. The first public key is generated by the configuration management center, and the second public key is generated by the application server.

[0118] The private key lookup module 620 is used to look up the corresponding first private key from the local machine based on the first public key;

[0119] The first shared component determination module 630 is used to calculate the first shared component using the first private key and the joint public key;

[0120] Parameter information feedback 640 is used to send encrypted access information, the second public key, and the first shared component back to the application server.

[0121] The technical solution of this invention involves initiating an application service startup request, including a target data source, to a configuration management center. This allows the configuration management center to determine encrypted access information, a second public key, and a first shared component based on the target data source. The system then obtains the encrypted access information, second public key, and first shared component returned by the configuration management center. The encrypted access information includes an encrypted username and password. Based on the encrypted access information, second public key, and first shared component, target access information for the target data source is determined. This target access information includes the username and password. The target access information is then used to access the target data source to complete the business service. This technical solution minimizes the occurrence of plaintext when the application server uses the user password, preventing decryption key leakage and ensuring the security of the access information.

[0122] The system configuration parameter processing device provided in this embodiment of the invention can execute the system configuration parameter processing method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0123] Figure 7This is a schematic diagram of a system configuration parameter processing device according to an embodiment of the present invention. This embodiment is applicable to situations where the security of system configuration parameters such as user accounts and passwords needs to be ensured. The system configuration parameter processing device can be implemented in hardware and / or software, and can be configured in an electronic device that carries the system configuration parameter processing function, such as a system user management terminal. Figure 7 As shown, the device includes:

[0124] The target access information generation module 710 is used to link with the target data source and randomly generate target access information for the target data source according to role permissions; the target access information includes username and user password;

[0125] The public-private key pair generation module 720 is used to generate a third public-private key pair; the third public-private key pair includes a third public key and a third private key.

[0126] The public key selection module 730 is used to access the configuration management center and randomly select the first and second public keys from the configuration management center.

[0127] The encrypted access information determination module 740 is used to encrypt the target access information based on the first public key, the second public key and the third private key to obtain encrypted access information;

[0128] The parameter information storage module 750 is used to send the target data source, encrypted access information, and public key information to the configuration management center for storage; wherein, the public key information includes a first public key, a second public key, and a combined public key.

[0129] The technical solution provided in this invention, by linking to a target data source and randomly generating target access information for the target data source according to role permissions, includes a username and password. A third public-private key pair is generated, comprising a third public key and a third private key. A configuration management center is accessed, and a first and second public key are randomly selected from the configuration management center. The target access information is encrypted using the first, second, and third public keys to obtain encrypted access information. The target data source, encrypted access information, and public key information are sent to the configuration management center for storage. The public key information includes the first public key, the second public key, and a combined public key. In this technical solution, the system user management terminal encrypts the target access information based on the three-party public-private key pair, ensuring that the symmetric key obtained each time is different, thus guaranteeing the security of the access information.

[0130] Optionally, the encrypted access information determination module 740 is used for:

[0131] The joint public key is calculated using the first and second public keys;

[0132] Calculate the shared points of the elliptic curve based on the third private key and the joint public key;

[0133] The symmetric encryption key is calculated by calling the key derivation function using the shared point.

[0134] Based on the symmetric encryption algorithm, the target access information is encrypted using a symmetric encryption key to obtain encrypted access information.

[0135] The system configuration parameter processing device provided in this embodiment of the invention can execute the system configuration parameter processing method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0136] According to embodiments of the present invention, the present invention also provides an electronic device, a readable storage medium, and a computer program product.

[0137] Figure 8 This is a schematic diagram of the structure of an electronic device that implements the system configuration parameter processing method of the embodiments of the present invention. Figure 8 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0138] like Figure 8 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0139] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0140] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the processing methods for system configuration parameters.

[0141] In some embodiments, the system configuration parameter processing method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the system configuration parameter processing method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the system configuration parameter processing method by any other suitable means (e.g., by means of firmware).

[0142] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0143] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0144] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0145] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor), and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0146] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0147] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0148] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0149] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for processing system configuration parameters, characterized in that, Used in application servers, including: A request to start an application service, including the target data source, is sent to the configuration management center so that the configuration management center can determine the encrypted access information, the second public key, and the first shared component based on the target data source. Obtain the encrypted access information, the second public key, and the first shared component fed back by the configuration management center; wherein, the encrypted access information includes the encrypted username and user password; Based on the encrypted access information, the second public key, and the first shared component, the target access information of the target data source is determined; the target access information includes the username and the user password. The target data source is accessed using the target access information to complete the business service.

2. The method according to claim 1, characterized in that, Based on the encrypted access information, the second public key, and the first shared component, the target access information of the target data source is determined, including: Based on the second public key, find the corresponding second private key locally; The second shared component is calculated based on the second private key and the first shared component; The first shared component and the second shared component are combined to obtain a shared point; The shared point is used to call the key derivation function to calculate the symmetric encryption key; Based on a symmetric encryption algorithm, the encrypted access information is decrypted using a symmetric encryption key to obtain the target access information of the target data source.

3. The method according to claim 1 or 2, characterized in that, The second public key is generated by the application server and stored in the configuration management center.

4. A method for processing system configuration parameters, characterized in that, Applied to configuration management centers, including: In response to an application service startup request initiated by the application server, which includes a target data source, the system uses the target data source as an index to retrieve encrypted access information and public key information locally. The encrypted access information includes an encrypted username and password. The public key information includes a first public key, a second public key, and a combined public key. The first public key is generated by the configuration management center, and the second public key is generated by the application server. Based on the first public key, find the corresponding first private key locally; The first shared component is calculated using the first private key and the joint public key; The encrypted access information, the second public key, and the first shared component are fed back to the application server.

5. A method for processing system configuration parameters, characterized in that, Applied to the system user management terminal, including: Link the target data source and randomly generate target access information for the target data source according to role permissions; the target access information includes username and user password; Generate a third public-private key pair; the third public-private key pair includes a third public key and a third private key; Access the configuration management center and randomly select a first public key and a second public key from the configuration management center; The target access information is encrypted using the first public key, the second public key, and the third private key to obtain encrypted access information. The target data source, the encrypted access information, and the public key information are sent to the configuration management center for storage; wherein, the public key information includes a first public key, a second public key, and a combined public key.

6. The method according to claim 5, characterized in that, The target access information is encrypted using the first public key, the second public key, and the third private key to obtain encrypted access information, including: Calculate the joint public key using the first public key and the second public key; Calculate the shared points of the elliptic curve based on the third private key and the joint public key; The shared point is used to call the key derivation function to calculate the symmetric encryption key; Based on a symmetric encryption algorithm, the target access information is encrypted using the symmetric encryption key to obtain encrypted access information.

7. A system for processing system configuration parameters, characterized in that, This includes the system user management terminal, configuration management center, and application server; among which, The system user management terminal is used to generate target access information for the target data source, encrypt the target access information to obtain encrypted access information, and store the encrypted access information in the configuration management center. The configuration management center is used to store encrypted access information and public key information, and to provide the public key information to the outside world; wherein the public key information includes a first public key, a second public key, and a combined public key; wherein the first public key is generated by the configuration management center; and the second public key is generated by the application server. The application server is used to obtain the encrypted access information and public key information of the target data source from the configuration management center, and decrypt the encrypted access based on the public key information and the local second private key to obtain the target access information, and log in to the target data source based on the target access information.

8. An electronic device, characterized in that, The electronic device includes: At least one processor, and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the system configuration parameter processing method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the method for processing system configuration parameters as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method for processing system configuration parameters according to any one of claims 1-6.

Images