Automatic account discovery and security check system based on dameng database protocol

Abstract

The application relates to the field of network security and discloses an automatic account discovery and security checking system based on a dream database protocol, remote connection is established through a dream database driver, account query is performed on a system view of the dream database to obtain the usernames of all users and the account locking state, each account is encapsulated into a structured object containing a username field, a first Boolean field and a second Boolean field; the accounts are filtered according to a special account list; whether a system administrator account is in a locking state is judged according to the account locking state, and the value of the first Boolean field is set; a password strategy query is performed on an initialization parameter view of the dream database, password security strategy compliance checking is performed according to a password strategy configuration value, and the value of the second Boolean field is set; and each structured object is serialized into a standard format string and output. The application can complete automatic checking on the security of dream database accounts without deploying an agent.

Description

Technical Field

[0001] This invention relates to the field of network security, specifically to an automated account discovery and security check system based on the DM database protocol. Background Technology

[0002] With the large-scale deployment of domestically developed databases in key industries such as finance and energy, DM Database has become an important part of the domestic database ecosystem. DM Database accounts carry critical permissions such as business access, operation and maintenance management, data synchronization, and audit queries, and are the core object of data asset security protection.

[0003] Currently, account security checks in the DM database primarily rely on administrators manually connecting to the database and executing queries one by one. This method is inefficient in large-scale asset inspection scenarios involving hundreds or thousands of database instances and is prone to account omissions. Furthermore, DM database differs from existing mainstream database products in its system table structure, account management model, and password policy parameters. General-purpose security inspection tools are difficult to adapt directly, and there is a lack of automated data collection capabilities for DM database's unique system views and initialization parameter views. This results in reliance on manual operation for obtaining account lockout status and global password security policy configuration information, making it difficult to achieve routine compliance assessments.

[0004] Furthermore, core business accounts, third-party system accounts, and built-in system accounts typically require specific permission configurations during operation and maintenance. Including these accounts in routine checks can generate alarms unrelated to business operations, increasing the noise burden on security operations. Existing check solutions generally lack the ability to flexibly filter such accounts. The check results also lack a unified structured data model, making it difficult to interface with upstream asset management and security operations platforms. This hinders the centralized display and subsequent handling of account lists, account lockout status, and password policy compliance. Summary of the Invention

[0005] This invention aims to solve the technical problems in the existing technology of DM database account security checks relying on manual operation, general tools being unable to adapt to the unique data model of DM database, lacking unified structured output, and lacking a flexible filtering mechanism for special accounts.

[0006] The objective of this invention can be achieved through the following technical solutions: An automated account discovery and security check system based on the DM database protocol includes: The database connection module is used to receive the address, port, username, password and special account list of the Dameng database as input parameters, establish a remote connection to the Dameng database and schedule the main inspection process. The account auto-discovery module is used to perform account queries on the system view of the DM database to obtain the usernames and account lock status of all database users, and encapsulate each account into a structured object containing a username field, a first boolean field, and a second boolean field; The special account filtering module compares the current account name with the special account list. If the current account name exists in the special account list, the account is skipped. The account status check module is used to determine whether the current account is a system administrator account and is in a locked state based on the account lock status. If so, the first boolean field is set to a value indicating that there is a security risk; otherwise, the default value is retained. The password security check module is used to perform a password policy query on the initialization parameter view of the DM database to obtain the password policy configuration value, parse the password policy configuration value bit by bit, and determine whether each configuration bit meets the corresponding security requirements according to the preset password security check requirements; when each configuration bit meets the corresponding security requirements, the second boolean field is kept at the default value indicating compliance; otherwise, the second boolean field is set to a value indicating that there is a security risk. The inspection result output module is used to serialize each structured object into a standard format string and output it.

[0007] Preferably, the system view is a user management view, including the user's username information field and account lock status information field; the initialization parameter view is a global initialization parameter configuration view, including the password policy configuration parameter field; and the system administrator account is the super administrator account preset by the DM database.

[0008] Preferably, the account auto-discovery module iterates through the query results of the user management view, creates a structured object for each record, sets the username field to the username information field value of the current row, determines whether the current account is in the special account list, and if not, appends the structured object to the result list used to store the structured objects of the accounts to be checked.

[0009] Preferably, the password security check module traverses the query results of the global initialization parameter configuration view, obtains the parameter values ​​corresponding to the password policy configuration parameters, parses the parameter values ​​bit by bit, and judges whether the corresponding configuration bits meet the corresponding security requirements for each preset password security check requirement; when at least one configuration bit does not meet the corresponding security requirement, the second Boolean field of all structured objects in the result list is uniformly set to a value indicating that there is a security risk; when all configuration bits meet the corresponding security requirements, the second Boolean field is kept as a value indicating compliance.

[0010] Preferably, the database connection module establishes a remote connection through the DM database driver. The connection string format is a combination of address and port, and the special account list is preprocessed. When the value of the special account list is empty, it is set to an empty list; otherwise, it is parsed into multiple independent accounts according to the delimiter.

[0011] Preferably, the first Boolean field indicates that the system administrator account is not locked, with a true value indicating compliance and a false value indicating a security risk; the second Boolean field indicates whether the database password security policy meets the preset security check requirements, with a true value indicating that the database password security policy meets the preset security check requirements and a false value indicating that the database password security policy does not meet the preset security check requirements.

[0012] Preferably, the inspection result output module serializes each structured object into a standard format string. Each structured object corresponds to a data object containing a username field, a first boolean field, and a second boolean field in the serialization result. The standard format string is used by the security operation platform and the asset management system to parse the data, obtain the account list, determine the system administrator account lock status, and determine the compliance of the password policy.

[0013] The beneficial effects of this invention are: (1) This invention establishes a remote connection based on the DM database driver to complete account discovery and security checks. It does not require the deployment of agent programs or the installation of additional components on the target database server, which can reduce the deployment cost and operation and maintenance complexity in large-scale asset inspection scenarios. At the same time, the connection resources are released after a single connection completes all query and inspection logic, which has little impact on the target database service.

[0014] (2) This invention performs account queries on the system view of the DM database to automatically obtain the list of all database users and their locking status, forming a complete account security profile, replacing the traditional manual query method; at the same time, it performs password policy queries on the initialization parameter view of the DM database to obtain the global password security policy configuration status, and evaluates the database security situation from both the account level and the global level, which is conducive to discovering security risks at the account management and policy configuration levels.

[0015] (3) This invention excludes designated accounts from the scope of security checks through a special account filtering mechanism. It can flexibly configure whitelist accounts according to different operation and maintenance scenarios, avoid false alarms for core operation and maintenance accounts and business whitelist accounts, and help reduce alarm noise in security operations. At the same time, it uses a structured object containing a username field, a first boolean field and a second boolean field as a unified data model to serialize the inspection results into a standard format string format for output, which is convenient for upstream security operation platforms and asset management systems to directly parse, and realize centralized display and subsequent handling of account lists, system administrator account lock status and password policy compliance. Attached Figure Description

[0016] The present invention will now be further described with reference to the accompanying drawings.

[0017] Figure 1 This is a diagram of the overall system architecture. Figure 2 This is a flowchart for the safety inspection process. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] like Figure 1 As shown, the automated account discovery and security check system based on the DM database protocol provided by the present invention includes a database connection module, an automatic account discovery module, a special account filtering module, an account status check module, a password security check module, and a check result output module.

[0020] The following combination Figure 2 The illustrated process, taking the automated account discovery and security check of a specific DM database instance as an example, illustrates the specific implementation of the present invention. In this embodiment, the target database's IP address is 10.10.10.226, the port number is 5236, the login username is SYSDBA, the login password is SYSDBA_dm001, and the special account list is passed in comma-separated string format, with a value of null indicating no special accounts.

[0021] Step S1: Parameter reception and parsing.

[0022] The system receives input parameters, including a database address field, a port field, a login username field, a login password field, and a special account list field. The database address field records the Internet Protocol address of the target DM database server; in this embodiment, this value is 10.10.10.226. The port field records the listening port number of the target DM database service; the default port number for DM database is 5236, and in this embodiment, the port field value is 5236. The login username and password fields are used to authenticate the identity when establishing a database connection; in this embodiment, the login username is SYSDBA, and the login password is SYSDBA_dm001. The special account list field specifies the set of account names to be excluded during the security check. This field is passed in string form, with multiple account names separated by commas. When this field is null, it indicates that no special accounts are configured for the current check task.

[0023] The system preprocesses the special account list field. First, it reads the original string value of the special account list field and checks if it is null. If null, it means no accounts need to be excluded in this check, and the system initializes the special account list as an empty list. If the value is not null, the system splits the string using commas as delimiters, storing each resulting account name as an independent element in the special account list. After this preprocessing, the system initializes the list to an empty set for subsequent account filtering. This preprocessing mechanism ensures that the system can correctly parse the special account configuration under different input conditions, avoiding parsing errors caused by differences in input format.

[0024] Step S2: Establishing a database connection.

[0025] The system calls the connection method of the DM database driver to establish a remote connection to the DM database. The DM database driver is the official Python programming language interface driver provided by DM database, offering a standard database connection interface. The system constructs a connection string, which is a combination of an address field and a port field, specifically address followed by a colon and then the port, for example, 10.10.10.226:5236. The system passes the parsed login username, password, and the constructed connection string as parameters to the DM database driver's connection method. The connection method initiates a Transmission Control Protocol (TCP) connection request to the target address and port. Upon receiving the request, the target database service performs authentication and verification. After successful authentication, the system obtains an active database connection object. This connection object holds the network session with the target database, and all subsequent query operations are completed through this connection object. After a successful connection, the system outputs a connection success message to the console, such as an INFO-level log message, to provide feedback on the connection status to operations and maintenance personnel. This connection establishment method does not require the installation of any agent programs or additional components on the target database server. It can be completed solely by relying on the standard interface provided by the DM database driver, reducing the invasiveness of system deployment and the complexity of operation and maintenance.

[0026] Step S3: Account automatically discovered.

[0027] After obtaining a database connection object, the system creates a cursor object using that connection object. A cursor object is a standard object in the database programming interface used to execute Structured Query Language (SCL) statements and retrieve result sets. The system executes an account query statement using the cursor object, which queries the system view of the DM database.

[0028] The DM database's system views include a user management view, which stores account information for all users within the database. The user management view contains username and account lock status fields. The username field records the user's login name, and the account lock status field indicates whether the user's account is currently locked. System-executed account query statements operate on this user management view, retrieving the username and account lock status field values ​​for each record in the view.

[0029] The system receives the result set returned by the account query statement. The result set consists of multiple records, each corresponding to a user account in the Dameng database. The system iterates through the result set, executing the following sub-steps for each record currently encountered.

[0030] In sub-step S31, the system reads the field value from the username information field of the current record; this field value is the account name string. The system creates a structured object containing three fields: a username field, a first boolean field, and a second boolean field. The system assigns the read account name string to the username field of this structured object.

[0031] In sub-step S32, the system reads the value of the account lock status information field from the current record. The value of the account lock status information field indicates whether the account is currently locked. This field has two possible values: locked and unlocked. The system temporarily stores this field value for use by the subsequent account status check module.

[0032] In sub-step S33, the system retrieves the preprocessed list of special accounts from step S1 and compares the name of the current account with each element in the list. If the current account name matches an element in the list, it means the account belongs to the exclusion scope pre-specified by the operations and maintenance personnel. The system does not perform subsequent security checks on this account, skips the current record, does not create the corresponding structured object, and continues to traverse the next record in the result set. If the current account name is not in the list of special accounts, it means the account needs to be included in the security check scope, and the system proceeds to sub-step S34.

[0033] In sub-step S34, the system appends the structured object corresponding to the current record to the result list used to store the structured objects of the accounts to be checked. The result list is a collection used to store the structured objects of all accounts that need to be output. This result list is initialized to an empty list before traversal begins. After processing each record that meets the filtering conditions, the structured object corresponding to that record is appended to the end of the result list used to store the structured objects of the accounts to be checked.

[0034] The automatic account discovery process automatically enumerates all user accounts in the DM database, avoiding the problem of missed accounts during manual queries. A special account filtering mechanism intervenes during the account discovery stage to ensure that excluded accounts never enter the check results list, reducing redundant calculations in subsequent processing steps.

[0035] Step S4: Check the system administrator account lockout status.

[0036] The system performs a system administrator account lock status check on each structured object in the result list. First, the system reads the username field of the current structured object to obtain the account's name string. The system then compares this name string with the default system administrator account name. The system administrator account is the default super administrator account of the DM database, which has the highest administrative privileges in the database and is responsible for critical operational operations such as database creation, configuration modification, user management, permission allocation, and audit log management. The DM database generates this super administrator account by default after installation and initialization.

[0037] If the current account name is the same as the preset system administrator account name, the system further reads the account lock status information field value temporarily stored in step S3. The system determines whether the account lock status information field value indicates a locked state. If the field value indicates a locked state, it means that the system administrator account cannot be used for login and operation and maintenance, which may affect emergency response and operation and maintenance intervention capabilities in emergency situations. In this case, the system sets the first Boolean field of the current structured object to a value indicating a security risk; in this embodiment, this value is a logical false value. If the field value indicates an unlocked state, it means that the system administrator account is available, and the system keeps the first Boolean field at its default value; in this embodiment, the default value is a logical true value, indicating that the check is in a compliant state.

[0038] If the current account name is different from the preset system administrator account name, it means that the current account is not a system administrator account, and the system does not check its system administrator account lock status. The first boolean field remains unchanged at its default value. The system executes the above judgment logic on all structured objects in the result list in sequence. This check process automatically completes the special check on the system administrator account lock status, eliminating the need for manual login to the database to check the account status one by one, thus ensuring the accuracy and consistency of the check results.

[0039] Step S5: Password security policy compliance check.

[0040] The system creates a new cursor object using the database connection object created in step S2 to execute the password policy query statement. The password policy query statement queries the global initialization parameter configuration view of the DM database. The DM database stores all global initialization parameters in this global initialization parameter configuration view, with each parameter stored as a record containing a parameter field and a parameter value field. The password security policy configuration parameter is one of the global initialization parameters; its value determines whether the database enables a global password complexity policy.

[0041] The global initialization parameter configuration view contains password policy configuration parameter fields. Password policy query statements executed by the system look up these fields in this view and retrieve the corresponding parameter value; this value is the password policy configuration value.

[0042] The system receives the result set returned by the password policy query statement. The result set consists of records, each corresponding to a global initialization parameter. The system iterates through each record in the result set and performs the following operations on the currently iterated record: The system reads the parameter field value of the record and determines whether the parameter field value matches the preset password policy parameter name. If they match, it means that the current record is the password security policy configuration parameter, and the system reads the parameter value field value of the record, which is the password policy configuration value.

[0043] After obtaining the password policy configuration value, the system performs bitwise parsing. Based on pre-set password security check requirements, it determines the corresponding configuration bits for each password security check and performs a compliance check on the value of each configuration bit. For any password security check, if the value of the corresponding configuration bit does not meet the preset security requirements, the password security check is deemed unqualified; if the value of the corresponding configuration bit meets the preset security requirements, the password security check is deemed qualified.

[0044] When the password policy configuration value is empty, is null, or cannot obtain a valid configuration bit value that meets the preset password security check requirements, the system determines that the password security policy check is unqualified, and iterates through all structured objects in the result list, setting the second boolean field of each structured object to a value that indicates a security risk.

[0045] When the password policy configuration value can be correctly parsed and the configuration bits corresponding to each password security check requirement meet the preset security requirements, the system determines that the password security policy check is qualified and keeps the second Boolean field of all structured objects in the result list as a value indicating compliance.

[0046] Therefore, the compliance of a cryptographic security policy is not judged solely by whether the cryptographic policy configuration parameters are empty. Instead, it is determined by checking each specific cryptographic security policy corresponding to each configuration bit in the cryptographic policy parameters. Only when all configuration bits required by each check item meet the preset security requirements is the cryptographic security policy deemed to have passed the check.

[0047] The second Boolean field indicates whether the database password security policy meets the preset password security check requirements. A true value indicates that the database password security policy meets the preset security check requirements, while a false value indicates that the database password security policy does not meet the preset security check requirements.

[0048] This password policy checking process automates the compliance check of the actual configuration status of the global password security policy by parsing the password policy configuration parameters bit by bit and performing a compliance check on the configuration bits corresponding to each password security policy. This eliminates the need for manual database login and analysis of initialization parameters, improving the comprehensiveness and accuracy of password policy compliance judgments. All accounts share the same global password policy configuration status; therefore, the value of the second boolean field is consistent across all accounts in the result list. The system completes the setting of this field through a single query and batch assignment, improving execution efficiency.

[0049] Step S6: Check the structured output of the results.

[0050] After completing the system administrator account lockout status check in step S4 and the password security policy compliance check in step S5, the result list contains multiple structured objects. Each structured object's username field records the account name, the first boolean field records the system administrator account lockout status check result, and the second boolean field records the password security policy compliance check result.

[0051] The system performs a serialization operation on the structured objects in the result list. Serialization is the process of converting structured data in memory into a standard format string. In this embodiment, a lightweight data exchange format (JEE) is used as the serialization target format. The system calls the serialization method to convert each structured object in the result list into a data object in this JEE format. Each data object contains three key-value pairs, corresponding to the username field, the first boolean field, and the second boolean field of the structured object, respectively. The system uses the serialization method to convert the entire result list into a standard format string. The character encoding of this string is set to support Chinese characters, ensuring that if the account name contains Chinese characters, it can be correctly encoded and transmitted. The serialized standard format string is formatted with indentation to enhance human-computer readability and facilitate direct viewing and debugging by maintenance personnel.

[0052] The system outputs a standard format string generated after serialization as the inspection result. This standard format string is provided for parsing by the upstream security operations platform and asset management system. Upon receiving this standard format string, the upstream platform uses the corresponding parsing method to reconstruct a list of data objects. From each data object, it reads the username field to obtain the account list, reads the first boolean field to obtain the inspection result of the system administrator account lockout status, and reads the second boolean field to obtain the inspection result of password policy compliance. Based on the values ​​of the above fields, the upstream platform performs subsequent handling operations such as alarm generation and baseline non-compliance work order creation, forming a complete closed loop from security inspection to alarm handling.

[0053] Step S7: Exception handling and resource release.

[0054] During the execution of steps S2 to S5 above, if an exception occurs in the database connection or query operation, the system will capture the exception and output an error message. Exceptions include, but are not limited to, network connection timeouts, authentication failures, syntax errors in structured query statements, non-existent views, or insufficient permissions. The system will record the exception details in the error message for maintenance personnel to troubleshoot.

[0055] After the exception handling process concludes and after step S6 of the normal workflow is completed, the system performs resource release operations. These operations include closing cursor objects and database connection objects. Cursor objects and database connection objects consume session and memory resources on the database server after use; failure to release them promptly may lead to the database service running out of connections. The system ensures that these resources are properly closed in the final execution step, regardless of whether the process ends normally or is interrupted abnormally. This mechanism guarantees resource utilization efficiency and service stability under long-term operation and large-scale asset inspection scenarios.

[0056] In real-world operations and maintenance scenarios, the DM database account lockout status check and password policy compliance check only reflect the static security configuration status of the account at the time of the check, but cannot assess the potential security risk exposure of the account before the check. Specifically, although an account may be unlocked and its password policy may be enabled at the time of the check, the account's password may not have been updated since its creation, or the last password change may have exceeded the time threshold required by the enterprise security baseline, or the account may be in a dormant state that has not been used for a long time but is still available. These risk exposures are not reflected in the account lockout status information field in the user management view or the password policy configuration parameters in the global initialization parameter configuration view, but they constitute an important dimension of account security risk assessment.

[0057] In existing technologies, information such as the last password modification time, account creation time, and last login time of a database account is stored in different fields of the system view. There is a lack of a unified automated collection mechanism that can integrate the above time-dimensional information with the account lock status and password policy configuration to form a comprehensive account security assessment result covering both configuration status and time dimensions.

[0058] To address the aforementioned technical problems, this invention also provides a preferred embodiment. This embodiment, based on the foregoing embodiments, further integrates an account time-dimensional risk exposure check function. This function, in addition to checking account lockout status and password policy compliance, comprehensively assesses the account's time-dimensional risk exposure by correlating and analyzing the account's creation time, last password modification time, and last login time. The system in this embodiment, based on the aforementioned database connection module, automatic account discovery module, special account filtering module, account status check module, password security check module, and check result output module, further includes an account time-dimensional risk assessment module.

[0059] The specific implementation method is as follows: During the automatic account discovery process in step S3, the system's account query statement retrieves the username information field and the account lock status information field, as well as the account creation time field, the last password modification time field, and the last login time field from the user management view. The account creation time field records the time the account was created in the database, the last password modification time field records the time the account's password was last modified, and the last login time field records the time the account was last successfully authenticated. These three time fields are inherent fields of the DM database user management view and are stored within that view.

[0060] When creating a structured object, in addition to setting the username field, the system also stores the account creation time, the last password modification time, and the last login time in a temporary field corresponding to the structured object for subsequent time-based risk assessment.

[0061] After the password security policy compliance check in step S5 is completed, the system triggers the account time dimension risk assessment module. This module performs the following risk assessment sub-steps for each structured object in the result list.

[0062] In sub-step S5A1, the system reads the username field of the current structured object to obtain the account name, and reads the last modified password time field value from the temporary field. The system obtains the current system time, calculates the time difference between the current system time and the last modified password time, and obtains the duration of the password not being modified. The system compares this duration with a preset maximum password validity period threshold. The maximum password validity period threshold is preset as a global system configuration parameter, for example, set to 90 days, corresponding to the enterprise information security baseline requirement for periodic password changes. If the duration of the password not being modified exceeds the maximum password validity period threshold, it means that the password for this account has exceeded the maximum validity period allowed by the enterprise security baseline since the last modification, and the risk of the password being cracked accumulates and increases over time. In this case, the system marks the account's time dimension risk level as the first risk level.

[0063] In sub-step S5A2, the system reads the last login time field value of the account from the temporary field. If this field value is empty, it means that the account has never been used since its creation. The system further reads the account creation time field value from the temporary field, calculates the time difference between the current system time and the account creation time, and obtains the duration of the account's existence. The system compares this duration with a preset dormant account judgment threshold. The dormant account judgment threshold is preset as a system global configuration parameter, for example, set to 180 days. If the duration of the account's existence exceeds the dormant account judgment threshold, it means that the account has been in a dormant state for a long time without being used, but is still available. Such dormant accounts increase the attack surface of the database and may be used by attackers as a penetration entry point. Operations personnel, lacking awareness of the account's usage, cannot take timely measures to disable or clean up the account. In this case, the system marks the account's time dimension risk level as the second risk level.

[0064] In sub-step S5A3, the system reads the last login time field value of the account from the temporary field. If this field value is not empty, the system obtains the current system time, calculates the time difference between the current system time and the last login time of the account, and obtains the duration of account inactivity. The system compares this duration with a preset idle account judgment threshold. The idle account judgment threshold is preset as a global system configuration parameter, for example, set to 90 days. If the duration of account inactivity exceeds the idle account judgment threshold, it means that although the account has been used, it has been in an idle state for a long time. Such idle accounts also constitute a security risk. Their passwords may have been forgotten and not included in the regular password change management, or the corresponding maintenance personnel may have left the company or the business may have been shut down but the account has not been cleaned up. In this case, the system marks the time dimension risk level of the account as the third risk level.

[0065] In sub-step S5A4, the system synthesizes the judgment results of sub-steps S5A1 to S5A3 above and generates a comprehensive time-dimensional risk assessment value for the current structured object. If none of the above three sub-steps trigger any risk level flag, it indicates that the password change frequency of the account meets the security baseline requirements, the account is in active use, and the usage frequency is normal. The system sets the comprehensive time-dimensional risk assessment value of the account to a value indicating no risk. If at least one of the above three sub-steps triggers a risk level flag, the system sets the comprehensive time-dimensional risk assessment value of the account to a value indicating the existence of time-dimensional risk.

[0066] In sub-steps S5A2 and S5A3, the last login time field value may be unavailable due to database version or permission configuration issues, resulting in a null value. In this case, the system cannot determine idle accounts based on the last login time. The system stores the "last login time unavailable" flag as a separate risk warning in the structured object, reminding operations personnel to check the account's usage status during subsequent output.

[0067] After completing the time-dimensional risk assessment, the system stores the comprehensive value of the time-dimensional risk assessment as the third Boolean field of each structured object. A true value in the third Boolean field indicates that the comprehensive time-dimensional risk assessment result for the account is no risk, while a false value indicates that the comprehensive time-dimensional risk assessment result for the account is at risk.

[0068] The system then proceeds to step S6, which involves the structured output of the inspection results. In step S6, the system serializes the username field, the first boolean field, the second boolean field, and the third boolean field of each structured object into a standard format string. Each structured object corresponds to a data object containing the aforementioned four fields in the serialization result.

[0069] This embodiment also provides a preferred implementation, where the maximum password validity period threshold, dormant account determination threshold, and idle account determination threshold can be configured separately according to account type. The system pre-stores the account type identifier for each account, with different threshold parameters corresponding to different account types. For example, the maximum password validity period threshold for system administrator accounts is set to 60 days, and for ordinary business accounts it is set to 90 days; the dormant account determination threshold for core business accounts is set to 365 days, and for temporary accounts it is set to 30 days. The system reads the threshold parameters corresponding to the current account in sub-steps S5A1 to S5A3 for comparison and judgment. This implementation allows time-dimensional risk assessment to adapt to the differentiated security management needs of different types of accounts, avoiding overly lenient password change requirements for system administrator accounts or overly lenient cleanup requirements for temporary accounts due to uniform thresholds, thus improving the granularity of risk assessment.

[0070] In this embodiment, firstly, a time-dimensional risk assessment mechanism is introduced into the account security check, incorporating the account's password modification time, account creation time, and last login time into the security assessment system. This expands the security check from static configuration status assessment to time-dimensional risk exposure assessment, overcoming the shortcomings of existing solutions that only check the current account lock status and password policy configuration status, thus forming a security assessment architecture covering both static configuration assessment and time-dimensional risk assessment. Secondly, information collection is completed using the inherent time field in the DM database user management view, without adding additional query operations or data collection methods, maintaining the lightweight characteristic of the system completing all checks in a single connection. Thirdly... By comprehensively assessing three dimensions—the duration of unmodified passwords, the duration of account existence, and the duration of account inactivity—the system achieves a refined classification and evaluation of account time-related risks. It distinguishes between three different types of time-related risks: password expiration risk, dormant account risk, and idle account risk. This provides differentiated alerting criteria for upstream security operations platforms, preventing the categorization of all time-related issues into the same risk type, which would lead to inconsistent handling strategies. Finally, the system supports configuring threshold parameters separately for each account type, enabling it to adapt to the differentiated management requirements of different accounts in terms of password change frequency, dormancy assessment cycle, and idleness assessment cycle, thus improving the flexibility and accuracy of risk assessment.

[0071] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the present invention should still fall within the scope of the present invention.

Claims

1. An automated account discovery and security check system based on the DM database protocol, characterized in that, include: The database connection module is used to receive the address, port, username, password and special account list of the Dameng database as input parameters, establish a remote connection to the Dameng database and schedule the main inspection process. The account auto-discovery module is used to perform account queries on the system view of the DM database to obtain the usernames and account lock status of all database users, and encapsulate each account into a structured object containing a username field, a first boolean field, and a second boolean field; The special account filtering module compares the current account name with the special account list. If the current account name exists in the special account list, the account is skipped. The account status check module is used to determine whether the current account is a system administrator account and is in a locked state based on the account lock status. If so, the first boolean field is set to a value indicating that there is a security risk; otherwise, the default value is retained. The password security check module is used to perform a password policy query on the initialization parameter view of the DM database to obtain the password policy configuration value, parse the password policy configuration value bit by bit, and determine whether each configuration bit meets the corresponding security requirements according to the preset password security check requirements; when each configuration bit meets the corresponding security requirements, the second boolean field is kept at the default value indicating compliance; otherwise, the second boolean field is set to a value indicating that there is a security risk. The inspection result output module is used to serialize each structured object into a standard format string and output it.

2. The automated account discovery and security check system based on the DM database protocol according to claim 1, characterized in that, The system view is a user management view, including the user's username information field and account lock status information field; the initialization parameter view is a global initialization parameter configuration view, including the password policy configuration parameter field; the system administrator account is the super administrator account preset by the DM database.

3. The automated account discovery and security check system based on the DM database protocol according to claim 2, characterized in that, The automatic account discovery module iterates through the query results of the user management view, creates the structured object for each record, sets the username field to the username information field value of the current row, determines whether the current account is in the special account list, and if not, appends the structured object to the result list used to store the structured objects of the accounts to be checked.

4. The automated account discovery and security check system based on the DM database protocol according to claim 2, characterized in that, The password security check module iterates through the query results of the global initialization parameter configuration view, obtains the parameter values ​​corresponding to the password policy configuration parameter fields, parses the parameter values ​​bit by bit, and determines whether the corresponding configuration bits meet the security requirements for each preset password security check requirement. When at least one corresponding configuration bit does not meet the security requirements, the second boolean field of all structured objects in the result list is uniformly set to a value indicating a security risk. When all corresponding configuration bits meet the security requirements, the compliant value of the second boolean field is maintained.

5. The automated account discovery and security check system based on the DM database protocol according to claim 1, characterized in that, The database connection module establishes a remote connection through the DM database driver. The connection string format is a combination of address and port, and the special account list is preprocessed. When the value of the special account list is empty, it is set to an empty list; otherwise, it is parsed into multiple independent accounts according to the separator.

6. The automated account discovery and security check system based on the DM database protocol according to claim 4, characterized in that, The first Boolean field indicates that the system administrator account is not locked; a true value indicates compliance, and a false value indicates a security risk. The second Boolean field indicates whether the database password security policy meets the preset security check requirements; a true value indicates that the database password security policy meets the preset security check requirements, and a false value indicates that the database password security policy does not meet the preset security check requirements.

7. The automated account discovery and security check system based on the DM database protocol according to claim 1, characterized in that, The inspection result output module serializes each structured object into a standard format string. Each structured object corresponds to a data object containing a username field, a first boolean field, and a second boolean field in the serialization result. The standard format string is used by the security operation platform and the asset management system to parse the data, obtain an account list, determine the system administrator account lock status, and determine the compliance of password policies.

Images