System authority management system and method
By constructing an independent access control layer, the system achieves deconstruction, process-based, and temporary management of information system permissions, solving the problems of centralized permissions and auditing difficulties in existing technologies, and improving security and compliance.
Patent Information
- Application Number
- CN202512032398.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-30
- Publication Date
- 2026-04-03
AI Technical Summary
Existing information system access control models suffer from problems such as excessive centralization of permissions, lack of dynamic adjustment, and difficulty in auditing, resulting in high security risks and difficulty in meeting compliance requirements.
Build an independent access control layer, and through components such as access management server, unified access database, management console, agent program or standard API interface, realize access control deconstruction, process-oriented and temporary management, including resource and role management, approval workflow, comprehensive auditing and other functions.
It achieves the minimization of permissions, dynamic control, and full lifecycle auditing, reducing the risk of misoperation, improving management efficiency and compliance, and providing a complete chain of operational evidence.
Smart Images
Figure CN121786862A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information technology security, specifically to a system access control system and method. Background Technology
[0002] In existing technologies, information system access control typically employs a decentralized management model. Each information system, such as core business systems, databases, and network devices, independently sets up and maintains its own access control system. In this model, each information system administrator, especially the super administrator, possesses the highest administrative privileges within their managed system by default, allowing them to perform all operations without restriction. In common scenarios such as outsourced operations and maintenance, to ensure the continuity of operations and maintenance work, external operations and maintenance personnel are often granted high-level or even super administrator privileges on the corresponding information systems.
[0003] Traditional access control models have significant problems. First, excessive centralization of permissions means that if an account is stolen, abused, or misused, it could severely impact or even destroy the system, posing a high security risk. Second, permission granting is typically static and long-term, lacking dynamic adjustments based on tasks or temporary granting mechanisms. This means permissions may remain held unnecessarily, widening the risk window. Third, the allocation and use of permissions lack mandatory, standardized process oversight; approval and execution powers are not separated, failing to create effective internal checks and balances. Finally, operational audit logs are scattered across various systems, and local logs can be modified or deleted by administrators with high privileges, making post-incident tracing difficult, assigning responsibility challenging, and failing to meet stringent compliance audit requirements.
[0004] Therefore, existing technologies urgently need a solution that can centrally, dynamically, and process-orientedly control the highest management authority scattered across various information systems, in order to solve the problems of irregular use of permissions, high risks, and difficulty in auditing. Summary of the Invention
[0005] In view of the above, the purpose of this invention is to overcome the shortcomings of the prior art and provide a system permission management system and method. By constructing an independent permission control layer, the super management permissions of traditional information systems are deconstructed, streamlined, and temporarily modified to achieve full lifecycle security management that is approved in advance, controlled during the process, and auditable afterward.
[0006] To achieve the above objectives, the present invention provides the following technical solution:
[0007] On one hand, the present invention provides a system access control system, comprising:
[0008] The access control server is deployed in a separate security domain to host and run the system's management logic.
[0009] A unified permission database, associated with the permission management server, is used to store the resource catalog, role definitions, permission policies, approval process definitions, operation tickets, and audit logs of the target information system.
[0010] The management console communicates with the permission management server and provides a graphical user interface for administrators, security auditors, and approvers to configure policies, initiate operation requests, conduct approvals, and view reports.
[0011] The proxy program or standard API interface is deployed on or connected to various target information systems to receive and execute authorized instructions from the permission management server and to block the original local super administrator direct operation channel of the target information system.
[0012] The permission management server includes a resource and role management module, which is used to establish and maintain the resource model of the target information system and encapsulate system operation permissions into technical roles based on specific tasks.
[0013] The approval workflow engine is used to define and execute electronic approval processes; the authorization and work order generation module is used to generate time-sensitive and one-time electronic operation work orders after the approval process is completed. The electronic operation work orders bind operation permissions with operator identity and time window.
[0014] The operation execution and agent communication module is used to securely send the operation instructions carrying the electronic operation work order to the agent program or standard API interface of the target information system.
[0015] The comprehensive audit log module is used to automatically and completely record the entire lifecycle logs from operation application, approval, authorization, execution to result feedback.
[0016] Furthermore, the resource and role management module deconstructs the traditional system administrator identity into multiple independent technical roles, which include at least one of user account administrator, log auditor, and backup operator. Each technical role contains only the minimum set of system operation permissions necessary to perform its specific duties.
[0017] Furthermore, the approval workflow engine allows for the dynamic configuration of different approval paths and approvers based on the risk level of the operation, the type of target resource, or the identity of the applicant.
[0018] Furthermore, the validity period of the electronic work order is preset according to the operation type. The corresponding permissions will automatically expire after the operation is completed, or the work order will automatically expire after the validity period.
[0019] Furthermore, the agent program or standard API interface communicates with the permission management server using encrypted communication; after verifying the validity of the electronic work order, the agent program performs specific operations on the target information system on behalf of the applicant and feeds back the operation results to the permission management server.
[0020] Furthermore, the log information recorded by the comprehensive audit log module is independent of the local logs of each target information system, and the audit log data in the unified permission database has an anti-tampering design.
[0021] On the other hand, the present invention provides a system access control method, applied to the above-mentioned system, comprising the following steps:
[0022] Access control modeling steps: Through the resource and role management module, establish the resource model of the target information system and define multiple technical roles based on the principle of least privilege;
[0023] Operation application steps: Receive user-initiated requests for high-privilege or sensitive operations targeting the target information system through the management console;
[0024] Process approval steps: Through the approval workflow engine, the operation application is triggered into an electronic approval process according to predefined rules and then transferred to the corresponding approver for approval;
[0025] Work order authorization steps: After the approval process is completed, an electronic work order is generated through the authorization and work order generation module, which is bound to the current operator's identity and time window;
[0026] Instruction execution steps: Through the operation execution and agent communication module, the operation instructions carrying the electronic operation work order are sent to the agent program or standard API interface of the target information system, which then executes the specific operation after verifying the validity of the work order;
[0027] Audit logging steps: The entire process from operation application to completion is recorded through the comprehensive audit log module and stored in a unified permission database.
[0028] Furthermore, in the process approval step, if the operation application involves items in a preset high-risk operation list, at least two levels of approval process will be forcibly triggered.
[0029] Furthermore, the electronic work order generated in the work order authorization step is a one-time voucher, and the duration of the time window is dynamically determined according to the operation type of the operation application.
[0030] Furthermore, the method also includes an optimization and adjustment step, which periodically analyzes the frequency of permission use, approval rate and abnormal operation patterns based on the log data recorded by the comprehensive audit log module, and dynamically optimizes and adjusts the permission set of the technical role and the rules of the approval workflow engine accordingly.
[0031] The beneficial effects of this invention are as follows:
[0032] 1. By deconstructing broad system administrator privileges into multiple technical roles based on specific tasks, the scope of operation for a single administrator is fundamentally limited, adhering to the principle of least privilege and significantly reducing the impact of misoperation or malicious operation.
[0033] 2. All high-level operations must go through a predefined, configurable electronic approval process, which separates approval authority from execution authority, forming an effective supervision and checks and balances mechanism within the organization and reducing unauthorized or unapproved operations.
[0034] 3. Through the electronic work order mechanism, permissions can be applied for, temporarily granted, and automatically revoked as needed. This completely changes the model of holding high-privilege accounts in a static state for a long time and greatly reduces the time window during which permissions may be abused. It is especially suitable for temporary access scenarios such as outsourcing.
[0035] 4. The system automatically records full lifecycle operation logs independent of the target system's local logs, and the logs are tamper-proof, providing a complete chain of evidence that is non-repudiable and can be accurately traced back to the specific applicant, approver, and execution time, greatly enhancing the ability to investigate security incidents and conduct compliance audits.
[0036] 5. By centrally managing the privileged access policies, roles, and processes of all information systems through a unified platform, the previous situation where each system's permission policies were independent has been changed, improving management efficiency, policy consistency, and the ability to respond to changes. Attached Figure Description
[0037] Figures 1-6 This is a flowchart of the system. Detailed Implementation
[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0039] This application discloses a system permission management system, which mainly includes a permission management server, a unified permission database, a management console, an agent program or standard API interface, an approval workflow engine, an authorization and work order generation module, an operation execution and agent communication module, and a comprehensive audit log module.
[0040] The access control server, as the core of the system, is deployed in a separate network area with a higher level of security. It is responsible for executing all access control policies and logic.
[0041] The unified permission database is directly associated with the permission management server, storing all configuration data and process data, including resource directories of all target systems, such as server restarts, creation of DB users, etc., as well as defined technical roles, such as account administrators and auditors, permission policies, electronic approval process templates, generated operation work orders, and full audit logs.
[0042] A management console is typically a web application that provides a visual interface for users, such as system administrators, security officers, and approval leaders. Users can use it to configure the system, such as defining roles, setting up approval workflows, initiating permission requests, processing pending tasks, and viewing various reports and audit logs.
[0043] For target systems capable of installing proxies, such as servers, lightweight proxy programs are deployed. For systems that do not support proxies but provide management APIs, such as cloud databases, their standard API interfaces are used for integration. For network devices, dedicated proxies may be deployed. The function of these proxies or interfaces is to receive authorization instructions from the access control server, execute specific operations on the target system, and block the original direct operation channels that could be accessed through the local super administrator account. All communication links are protected using encryption protocols such as TLS.
[0044] The access control server contains the following functional modules:
[0045] The Resource and Role Management module aims to refine the traditional, vague, and broad concept of a system administrator. Administrators first define specific resources for the target system in this module, such as reading the ` / etc / passwd` file, deleting user table records, and querying CPU usage. Then, these resource permissions are combined into technical roles tailored to specific responsibilities. For example, a user account administrator role might only include permissions to create users, reset passwords, and disable accounts; a log auditor role might only include permissions to read all system logs and export log files. This implements the principle of least privilege.
[0046] The approval workflow engine allows administrators to define flexible electronic approval processes. For example, rules can be set requiring two levels of approval—the immediate supervisor and the security department—for all deletion operations. Rules can also include any operation initiated by outsourced personnel requiring approval from an internal contact person. When an operation request is triggered, the engine will automatically assign the task to the appropriate approver according to the rules.
[0047] The authorization and work order generation module generates a unique electronic work order once an operation request has passed all approvals. This work order includes the permitted operation, the authorized operator's identity, a limited valid time window (e.g., 30 minutes), and a digital signature to ensure integrity. Essentially, this work order is a temporary, one-time operation credential.
[0048] The operation execution and agent communication module is responsible for securely transmitting the operation instructions, which encapsulate the electronic operation work order, to the agent program on the target system or sending them via the API interface. It acts as a bridge between the access control server and the specific execution terminal.
[0049] The comprehensive audit log module automatically captures and records all critical events occurring in the system, forming an inseparable log chain. This log chain includes: when the applicant initiated what operation request, which approvers the request passed through, when what type of work order was generated, when the work order was sent for execution, and whether the proxy execution was successful or failed. All these logs are centrally stored in a unified permissions database.
[0050] This invention also provides a system permission management method, comprising the following steps:
[0051] Permission modeling steps. Through the management console, in the resource and role management module, system administrators can organize and model the resources of target information systems that need to be included in management, such as business systems, databases, and network devices, and create multiple technical roles that conform to the principle of least privilege.
[0052] Application process. For example, an administrator user, User A, who needs to create a new user account, logs into the system through the management console. They select the "Create User" operation under the "User Account Management" role, specify the target system (e.g., the business system), fill in the necessary parameters, and then submit the application.
[0053] Workflow approval steps. The approval workflow engine receives the application. Based on preset rules, the engine automatically generates an approval task and notifies department manager User B. User B views the application details through the management console and approves or rejects the application.
[0054] Work order authorization steps. Assuming approval, the authorization and work order generation module acts immediately. It generates an electronic work order, specifying that user A is authorized to perform a user creation operation on the business system within the next 15 minutes. This work order is digitally signed and bound to user A's current session.
[0055] Instruction execution steps. The operation execution and agent communication module encrypts the work order and the specific user creation instruction and sends it to the agent program on the business system. The agent program first verifies the validity of the work order. Only after successful verification does it call the underlying command or API on the business system to actually create the user.
[0056] Once created, the agent will return the execution result to the permission management server.
[0057] Audit logging steps. Throughout the process, the comprehensive audit log module synchronously records: application records, approval records, work order generation records, and instruction sending and execution result records. All these records form a complete audit chain with timestamps and associated IDs, stored in a unified access database for future querying and auditing.
[0058] Furthermore, in the process approval step, if the requested operation belongs to the preset high-risk operation list, such as batch deleting users or modifying the core database table structure, the approval workflow engine can force approval from at least two levels, such as the technical lead and the security director, or more levels; otherwise, the process cannot continue.
[0059] Furthermore, the electronic work order generated during the work order authorization process is designed as a one-time use credential. Once the agent program uses the work order to perform an operation, the work order becomes invalid and cannot be used again, even if it is still within its validity period. The validity period of the work order can be dynamically set according to the operation type; for example, querying logs can be set to 2 hours, while restarting the server may only be set to 10 minutes.
[0060] Furthermore, the method also includes optimization and adjustment steps. The system periodically analyzes audit logs in the unified permission database and generates reports, such as the usage frequency of each technical role, the approval rate of various operations, and the patterns of frequently rejected operation applications. Based on this data analysis, system administrators can optimize system configurations, such as adjusting the permission scope of a role to make it more reasonable, modifying the rules of an approval process to improve efficiency, or adding new monitoring and alarm rules for abnormal operation patterns.
[0061] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A system access control system, characterized in that, include: The access control server is used to host and run the system's management logic. A unified permission database, associated with the permission management server, is used to store the resource catalog, role definitions, permission policies, approval process definitions, operation tickets, and audit logs of the target information system. The management console communicates with the permission management server and provides a graphical user interface for administrators, security auditors, and approvers to configure policies, initiate operation requests, conduct approvals, and view reports. The proxy program or standard API interface is deployed on or connected to various target information systems to receive and execute authorized instructions from the permission management server and to block the original local super administrator direct operation channel of the target information system. The permission management server includes a resource and role management module, which is used to establish and maintain the resource model of the target information system and encapsulate system operation permissions into technical roles based on specific tasks. An approval workflow engine is used to define and execute electronic approval processes; The authorization and work order generation module is used to generate time-sensitive and one-time electronic work orders after the approval process is completed. The electronic work order binds operation permissions with operator identity and time window. The operation execution and agent communication module is used to securely send the operation instructions carrying the electronic operation work order to the agent program or standard API interface of the target information system. The comprehensive audit log module is used to automatically and completely record the entire lifecycle logs from operation application, approval, authorization, execution to result feedback.
2. The system access control system according to claim 1, characterized in that, It also includes a resource and role management module, which deconstructs the system administrator identity into multiple independent technical roles, including at least one of user account administrator, log auditor, and backup operator.
3. A system access control system according to claim 1, characterized in that, The approval workflow engine allows for dynamic configuration of different approval paths and approvers based on the risk level of the operation, the type of target resource, or the identity of the applicant.
4. A system access control system according to claim 1, characterized in that, The validity period of the electronic work order is preset according to the operation type. The corresponding permissions will automatically expire after the operation is completed, or the work order will automatically expire after the validity period.
5. A system access control system according to claim 1, characterized in that, The agent program or standard API interface communicates with the permission management server using encrypted communication. After verifying the validity of the electronic work order, the agent program performs specific operations on the target information system on behalf of the applicant and feeds back the operation results to the permission management server.
6. A system access control system according to claim 1, characterized in that, The log information recorded by the comprehensive audit log module is independent of the local logs of each target information system, and the audit log data in the unified permission database has an anti-tampering module.
7. A system access control method, applied to the system as described in any one of claims 1-6, characterized in that, Includes the following steps: Access control modeling steps: Through the resource and role management module, establish the resource model of the target information system and define multiple technical roles based on the principle of least privilege; Operation application steps: Receive user-initiated requests for high-privilege or sensitive operations targeting the target information system through the management console; Process approval steps: Through the approval workflow engine, the operation application is triggered into an electronic approval process according to predefined rules and then transferred to the corresponding approver for approval; Work order authorization steps: After the approval process is completed, an electronic work order is generated through the authorization and work order generation module, which is bound to the current operator's identity and time window; Instruction execution steps: Through the operation execution and agent communication module, the operation instructions carrying the electronic operation work order are sent to the agent program or standard API interface of the target information system, which then executes the specific operation after verifying the validity of the work order; Audit logging steps: The entire process from operation application to completion is recorded through the comprehensive audit log module and stored in a unified permission database.
8. A system access control method according to claim 7, characterized in that, In the process approval steps, if the operation application involves items in a preset high-risk operation list, at least two levels of approval process will be forcibly triggered.
9. A system access control method according to claim 7, characterized in that, The electronic work order generated in the work order authorization step is a one-time voucher, and the duration of the time window is dynamically determined according to the operation type of the operation application.
10. A system access control method according to claim 7, characterized in that, It also includes optimization and adjustment steps, which periodically analyze the frequency of permission usage, approval rate and abnormal operation patterns based on the log data recorded by the comprehensive audit log module, and dynamically optimize and adjust the permission set of the technical role and the rules of the approval workflow engine accordingly.