CN106489151A - password management device - Google Patents

Abstract

The Password Management device and method that the present invention is disclosed directly below, the password of the user to multiple services providing from system can be provided effectively, and can be by inputting the information such as IP address, password as parameter in multiple network environment, thus effectively supporting password change, inquiring about the functions such as the account catalogue of final password update time and inquiry registration.

Description

password management device

technical field

The present invention relates to a structure of a password management device, in particular to a password management device capable of notifying a user of a password change time point.

Background technique

Activities of receiving and sending e-mails by accessing a plurality of information systems connected to the Internet or exchanging information through portal sites (portal sites) play an important part in daily life. In addition, more people exchange commodities through e-commerce, and more banking services that were mainly performed offline before can also be performed online through telephone banking (tele-banking) or online banking.

Information exchange and transactions of services and goods that are actively performed on the Internet are generally performed by connecting to a certain information system. In order to securely protect the above-mentioned connection to the information system, one of the most commonly used methods is to use Passwords set by individuals.

According to a survey of more than 2,500 people conducted by an international information protection company called Webroot in October 2012, more people do not pay enough effort in password management when using multiple information systems. This will become a hidden danger in the security aspect of the various information systems they use. Therefore, in an organization that manages valuable information in an information system, it is necessary to master a method capable of effectively managing passwords.

In order to eliminate the hidden dangers in the security aspect as mentioned above, the representative technology at home and abroad is QuestSoftware's TPAM (Total Privileged Account Management) technology. The TPAM of the said Quest Software company proposes the following effective password management scheme: the technology of providing one-time password (One Time Password) in real time to the user who wants to visit by managing the password of the management object information system; periodic, temporary password updates; and administrator notification technology, among others.

TPAM is known as a technology that provides a comprehensive password management function for more than 40 diverse environments, and provides a secure and effective password management function for an entire information system with only a single appliance.

However, the current situation is that companies and organizations that manage and operate multiple information systems cannot properly manage individual user passwords. That is, it is impossible to provide services such as suggesting that users perform periodic password replacement at an appropriate time point, or notifying the time point of the last password change.

In addition, in the current state where cloud service systems and the like that provide various services (operating system, database management system, network management, etc.) continue to be launched, there is a problem that there is no user account/password for these services. In the case of ad-hoc solutions for management, only manual operations by security managers are relied upon.

Contents of the invention

technical problem

Therefore, an object of the present invention is to provide a password management device that enables a service user who accesses a plurality of service systems that provide different services to access and manage passwords regardless of the platform of the service system.

Another object of the present invention is to provide a password management device that can manage passwords more securely by notifying the user of password changes and query timing (time).

The purpose of the present invention is not limited to the above-mentioned purpose, and other purposes and advantages of the present invention not mentioned can be understood from the following description, and the purpose of the present invention can be more clearly understood through the embodiments of the present invention. Furthermore, the objects and advantages of the present invention can be achieved by the means and their combinations set forth in the claims.

Technical solutions

According to the characteristics of the present invention for achieving the above object, the following password management device is provided, including: a user access processing unit remotely connected to management modules that provide different services according to the parameters included in the access request of the user terminal A certain management module; a password management execution unit, executing the user's password management request transmitted through the user access processing unit.

The management module includes: an operating system password management module, a database management system (DBMS) password management module and a network device password management module, and uses different platforms.

It further includes: a management control unit that provides password information to the user terminal, grasps the status of changed password information, or manages password update information via a system manager.

The password management device encapsulates and processes information sent and received when the user terminal requests remote access.

The user terminal is used to inquire about the list of users registered in the management control unit and information about the user's last password change.

The present invention also includes: a statistical information management module for storing user access time and user access request processing detailed information; a password information management module for managing password change information and backup information.

The terminal device is capable of ascertaining the latest password information assigned to each user through the password information management module.

Beneficial effect

According to the present invention constituted as described above, the security of the information system can be increased by shortening the password update cycle, and the possibility of loss of the password can be reduced, thereby enabling the user to set a complicated password. This reduces the possibility of users creating external security threats to the system, which ultimately increases the security gains gained from the use of passwords.

In addition, in the special management of the administrator (administrator) password, that is, when the password has not been updated, it can be notified by email and can perform operations such as forced update, so it has the effect of reducing security risks by managing weak passwords. In addition, the user's inconvenience caused when using the password is reduced, and the user can use the system more conveniently and safely. Also, a user can easily access a system that provides services based on different platforms to use a password management service.

Description of drawings

FIG. 1 is a system configuration diagram of a password management device according to a preferred embodiment of the present invention.

Fig. 2 is a flowchart of a password management method according to a preferred embodiment of the present invention.

Fig. 3 is a definition-related algorithm for querying the database and tables of the final password change time according to a preferred embodiment of the present invention.

Fig. 4 is a definition-related algorithm for returning DBMS items at the time of final password change according to a preferred embodiment of the present invention.

best practice

The above objects, features, and advantages will be described in detail with reference to the accompanying drawings, so that those with general knowledge in the technical field to which the present invention pertains can easily implement the technical idea of the present invention. In describing the present invention, when it is judged that the detailed description of the known technology related to the present invention will unnecessarily obscure the gist of the present invention, the detailed description will be omitted. Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings. FIG. 1 is a system configuration diagram of a password management device proposed by the present invention.

As shown in FIG. 1 , it includes a user access request unit 110 and a password management device 100 that manages password information according to a user's request.

The user access request unit 110 may be a user terminal device of the user access password management device 100, and may be a PC, a portable device, a smart device, or the like. A parameter generation unit 115 is formed in the user access request unit 110 as described above.

The parameter generator 115 is a part that provides a function for accessing parameters of the password management device 100, and determines a management module to be accessed based on the parameters.

The management module is described below. In addition, the parameters include identification information such as the IP address of each management module, system type information of each management module, password management function type information, user account and password information, and the like. The password management device 100 may be, for example, a server that manages passwords. The configuration of such a password management device 100 will be described in detail below.

The password management device 100 includes a password management execution unit 130 . The password management execution unit 130 includes: an operating system password management module 132 , a database management system (DBMS) password management module 134 and a network device password management module 136 .

The various management modules provide different services and run on different platforms. For example, the operating system password management module 132 is based on Windows Server 2000, Windows Server 2003, WindowsServer 2008 and Linux platforms, the password management module 134 of the database management system is based on platforms such as Microsoft SQL server, MySQL and Oracle database, and the network device password management module 136 is based on Cisco network equipment (CISCO networkdevice) and Netgear (Netgear) network equipment and other platforms.

Furthermore, the password management device 100 includes a configuration for managing password backup and statistical information. That is, a password backup and statistical information management section 140 is constituted, and the password backup and statistical information management section 140 is composed of a password information management module 142 responsible for password storage and backup and a statistical information management module 144 that manages statistical information such as access time. constitute.

Furthermore, the password management device 110 includes a management control unit 150 and a system manager 160 . The management control unit 150 performs a function of storing event information of an administrator's activity on a user account, and the like, and a system manager (system manager) 160 performs a function of managing password information. For example, the following functions can be realized: provide the password of the user account if the user cannot remember the password; grasp the status of password changes based on the user account information and update the password through manual operation.

detailed description

The operation of the password management device 100 configured as described above will be described with reference to FIG. 2 . FIG. 2 is a flowchart illustrating a method of managing passwords according to the password management device of FIG. 1 .

First, the user can use the user access request unit 110 to determine a management module to be remotely accessed. For this purpose, the user can operate the parameter generation unit 115 to generate parameters capable of determining the management module to be accessed (S200).

As described above, the parameters include: a network identifier containing information such as the IP address of the management module to be accessed; system type information of management modules with platforms different from each other; password management function type information to be executed; and user account (ID) and user password and other information, so the parameters can be used to determine the management module to be accessed remotely.

Therefore, when parameters are generated by means of the parameter generation section 115 provided to the user access request section 110 , the parameters are passed to the user access processing section 120 . Thereafter, the remote connection generation unit 125 of the user access processing unit allows the user terminal to access a certain management module based on the information included in the parameters.

In addition, when the user access request unit 110 and the password management device 100 are connected remotely, they should be connected based on a safe security policy first. For this reason, in the present embodiment, carry out a series of operations as follows simultaneously: Select the security policy including the connection method based on the encryption technology supported by each management module; And select the port (port) number for information exchange, etc. .

This is because each management module applies each other's heterogeneous security policies and access generation techniques for setting up secure remote connections. Especially for operating systems such as Linux, encrypted network protocols such as SSH (Secure Shell: Secure Shell) are used.

For example, in order to access a Linux-based information system, it is necessary to generate a remote connection using SSH. In addition, the Windows operating system of Microsoft Corporation provides technologies such as WMI (Windows Management Instrumentation: Windows Management Instrumentation) that are easy to create a remote connection.

Also, when the user access request unit 115 and the password management device 100 are remotely connected to each other, the schema information is transmitted after being encapsulated. In this way, when the management module to be accessed is determined using parameters, and the information for remote access is packaged and transmitted, the user can easily and securely access the password management device 100 regardless of the various platforms designed to support specific services. .

In addition, the password management functions requested by the user may include password change operations, query of the last password change time, user account query, and the like. The above-mentioned password management function will be specifically described below. First, a job request for a password change job can be generated by a user or the system manager 160 . In this case, the changed password information is newly stored/registered.

Moreover, the final password change time query function and the user account query function can enable the user to query the time point when he changed his password, and can query a series of records of his ID and password query and change. At this time, whenever the password is changed, the password change time is inquired, and the user account is inquired as described above, the relevant information is always stored.

For information storage, when the user conducts it through the operating system password management module 132 and the database management system (DBMS) password management module 134, it is automatically stored in the management module respectively (S240). Therefore, the password change record of the relevant user can be retrieved using the user identification information such as the user ID and password described in the parameter. However, when the system manager 160 generates an event related to the user account activity, the related event is stored in the management control unit 150 in the form of a log repository.

In this case, system manager 160 will generate and manage a repository to store events for user account activity. FIG. 3 shows the definition of the user account activity record repository, the database for querying the final password change time, and the definition algorithm of the table (table).

Moreover, the item that induces storage of the final password change time in the user account activity record is defined in FIG. 4 , but it can be easily extended to other items related to user system activities. In addition, the password management function of the present invention also provides various services.

That is, the password backup and statistical information management unit 140 encrypts the user's password and periodically backs it up using the password information management module 142, records the user's access request processing details, etc., in the statistical information management module 144 to generate statistical information, and It notifies the system manager 160 . In this case, a password with high complexity can be used, so that the password can be prevented from being easily leaked. In order to cope with the situation that the user cannot remember the password, the password management device 100 transmits password information to the user when a request from the user or the system manager 160 occurs.

In addition, in order to prevent the increase in security risks due to obsolete passwords, users are also provided with services of notifying users of password change times and forcing updates (automatic updates). That is, the system manager 160 continuously checks the stored password setting time information to check the password change time point.

Therefore, if there is no password change detail for the user ID within a preset period of time or after a certain period of time, a message suggesting a password change is delivered to the user. Moreover, if the user does not perform a password change operation after the message suggesting changing the password is delivered, the password of the user ID is automatically changed and a message including the changed password information is delivered to the user. The transmission of information can be carried out through the user's E-mail, text message, etc.

As described above, the password management device 100 of the present invention records the details of the user's password management activities and generates statistical information thereon. The statistical information generated based on this is used as the basis for judging how frequently users perform password change and query functions. In addition, in order to prevent the user from continuing to use the password for a long time and showing a security risk, a message recommending changing the password is sent, or a forced update (automatic change) is performed. In addition, as described above, the method of the present invention can be produced by a computer program.

And, codes and code segments constituting the programs can be easily deduced by programmers skilled in the art. Furthermore, the created program is stored in a computer-readable recording medium (information storage medium), read and executed by a computer, and realizes the present invention. In addition, the recording medium includes all computer-readable recording media (tangible media such as CDs and DVDs, and intangible media such as carrier waves).

Without departing from the technical idea of the present invention, the above-mentioned present invention can be variously replaced, modified and changed by those with basic knowledge in the technical field, so the present invention is not limited to the above-mentioned embodiments and accompanying drawings.

Claims (7)

1. a kind of Password Management device, including：

User's access process portion, is connected remotely to provide different from each other according to the parameter comprising in the access request of user terminal The management module of service in some management module；

Password Management enforcement division, executes the Password Management request of the user transmitting by described user's access process portion.

2. Password Management device as claimed in claim 1, wherein,

Described management module includes：Operating system Password Management module, data base management system's Password Management module and network set Standby Password Management module.

3. Password Management device as claimed in claim 1, wherein, also includes：

Management control unit, provides encrypted message, the present situation grasping the encrypted message after change or management to described user terminal The password update information of Help of System manager.

4. Password Management device as claimed in claim 3, wherein, also includes：

Information encapsulation that described Password Management device is received and dispatched when remotely accessing described user terminal requests and process.

5. Password Management device as claimed in claim 3, wherein,

Described user terminal is used for inquiring about the catalogue of the registered user in described management control unit and the last change of user is close The information of code.

6. a kind of Password Management device, including：

Statistical information management module, for storing user's access time, user access request processes managing detailed catalogue；

Encrypted message management module, for administrator password modification information and backup information.

7. Password Management device as claimed in claim 6, wherein,

Described termination is by described encrypted message management module to the up-to-date encrypted message giving according to each user Confirmed.