WO2015176465A1

WO2015176465A1 - Account management method and apparatus

Info

Publication number: WO2015176465A1
Application number: PCT/CN2014/088244
Authority: WO
Inventors: 赵静; 李炀; 周祥生
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-05-22
Filing date: 2014-10-09
Publication date: 2015-11-26
Also published as: CN105100028A

Abstract

Disclosed in the present invention are an account management method and apparatus, wherein the account management method comprises: a first device generates an account and/or a password for at least one second device; the first device transmits the generated account and/or password to the at least one second device, and the corresponding administrator account or management terminal, wherein the at least one second device is set for configuring the corresponding respective account and password thereof as the respective account and password. By the technical solution provided in the embodiments of the present invention, the convenience and the security of account management are improved.

Description

Account management method and device

Technical field

The present invention relates to the field of communications, and in particular to an account management method and apparatus.

Background technique

With the further opening up of the telecommunications industry and the gradual intensification of competition, the services of telecom operators have evolved from traditional communication services to Internet-based, full-service businesses such as the Internet, media, entertainment, etc. The improvement of the industry chain has made the competition increasingly fierce, while hacking The losses caused by the Internet have grown dramatically. Therefore, information security issues are becoming more and more important, and the security issues of the host system and account passwords are becoming more and more concerned.

In the related art, most of the management of the host server account password is stored in the document, and the query is manually modified periodically, thereby causing any operator to access, performing some operations such as changing the password, which is inconvenient to maintain and is not safe. . At the same time, it is not convenient to manage a large number of host server accounts.

Summary of the invention

The embodiment of the invention provides an account management method and device, so as to at least solve the problem that the security of the device account password in the related art is not high.

According to an aspect of the present invention, an account management method is provided, including: a first device generating an account and/or a password for at least one second device; the first device to the at least one second device, and a corresponding The administrator account or the management terminal sends the generated account and/or password, wherein the at least one second device is configured to configure the corresponding account and password as respective account and password.

Preferably, the method further includes: the first device setting an expiration date of the generated account and/or password, wherein, when the expiration date arrives, the at least one second device can no longer use the respective account and/or password. And when the expiration date arrives, the first device generates and sends a new account and/or password for the at least one second device.

Preferably, the method further includes: the first device sending, to the at least one second device, a message for reclaiming the generated account and/or password when the validity period arrives, wherein the at least one second device Set to respond to the message to set a respective account and/or password to be invalid; and/or, the first device to the at least one second device, or the at least one second device, the administrator account Or the management terminal, sending The expiration date, wherein the at least one second device is configured to set the respective account number and/or password to be invalid after the respective corresponding validity period expires according to the respective corresponding validity period.

Preferably, the administrator account includes a mobile phone number, and the first device sends the generated account and/or password to the administrator account of the at least one second device, including: the first device The administrator account short message, wherein the short message carries the account number and/or the password.

Preferably, the method further includes: the first device storing the generated account and password; the first device responding to the administrator account and/or the request of the management device, in the administrator account and/or When the management device passes the verification, the corresponding account and/or password is sent to the administrator account and/or the management device.

According to another aspect of the present invention, an account management apparatus is provided, which is located at a first device, and includes: a generating module configured to generate an account and/or a password for at least one second device; and a sending module configured to Transmitting the generated account and/or password by the at least one second device, and the corresponding administrator account or the management terminal, wherein the at least one second device is configured to configure the corresponding account and password as respective accounts and password.

Preferably, the apparatus further includes: a setting module configured to set an expiration date of the generated account and/or password, wherein, when the expiration date arrives, the at least one second device can no longer use the respective account and/or password The generating module is further configured to: when the expiration date arrives, the first device generates and sends a new account and/or password for the at least one second device.

Preferably, the device further comprises: a recycling module, configured to send a message for recycling the generated account and/or password to the at least one second device when the validity period arrives, wherein the at least one second The device is configured to set the respective account and/or password to be invalid in response to the message; and/or the sending module is further configured to the at least one second device, or the at least one second device, Transmitting the expiration date by the administrator account or the management terminal, wherein the at least one second device is configured to set the respective account and/or password to be in accordance with the respective corresponding validity period, after each corresponding expiration period expires invalid.

Preferably, the administrator account includes a mobile phone number, and the sending module is configured to send a short message to the administrator account through the short message center, where the short message carries the account number and/or the password.

Preferably, the apparatus further includes: a storage module configured to store the generated account and password; and a query module configured to respond to the administrator account and/or the request of the management device, in the administrator account and/or When the management device passes the verification, the corresponding account and/or password is sent to the administrator account and/or the management device.

According to the embodiment of the present invention, the account and the password of the second device are generated by the first device, and the password generated by the second device and the administrator account/management device is implemented, thereby implementing unified management of the password of the second device. Avoid the cumbersome and insecure factors of human modification.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flowchart of an account management method according to an embodiment of the present invention;

2 is a structural block diagram of an account management apparatus according to an embodiment of the present invention;

3 is a schematic diagram of a preferred account management system in accordance with an embodiment of the present invention;

4 is a flow chart of issuing an account password by a password center according to an embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

In the following embodiments, the first device may be various types of devices such as a server, and the first device is not limited to one device, and may also be a device set composed of multiple devices. The second device is a managed device, for example, a host server in the equipment room, etc., but is not limited thereto.

In the following embodiments, the account number and password may be an operating system account, a service account, a database account, and the like of the second device, but are not limited thereto. A second device can include multiple account numbers and passwords, such as system account passwords and business account passwords.

For each second device, the type of the account and password set may be different, for example, one second device operating system account password and another second device setting service account password. The level of each second device account password may be different. For a second device or account password type with higher security, a higher level password and an account number may be generated, and for a general second device or account password type, an ordinary password may be generated. password.

It is to be expected that the methods and apparatus of the following embodiments can be implemented by a computer program.

FIG. 1 is a flowchart of an account management method according to an embodiment of the present invention. As shown in FIG. 1, the method includes steps S102 to S104.

Step S102: The first device generates an account and/or password for the at least one second device. The manner of generating an account and a password may be a random manner or a method generated according to a predetermined algorithm.

Step S104: The first device sends the generated account and/or password to the at least one second device, and the corresponding administrator account or the management terminal, where the at least one second device is configured to configure the corresponding account and password as Their respective account number and password.

According to the embodiment of the present invention, the account and the password of the second device are generated by the first device, and the password generated by the second device and the administrator account/management device is implemented, thereby realizing the unification of the second device account/password. Management avoids the cumbersome and insecure factors of human modification.

In the embodiment of the present invention, preferably, the corresponding account and password are sent to the corresponding second device. Of course, all the passwords and accounts of the second device can be sent to each second device, and the corresponding account and password have a corresponding relationship with the second device, and each second device can find its own corresponding password and account number. Preferably, the correspondence between the second device and the administrator account or the management device may be set, and the account and/or password of the corresponding second device is sent to the corresponding administrator account or the management device.

In the embodiment of the present invention, the account of the second device may be set, or the password of the second device may be set, or the account and password of the second device of the device may be simultaneously. When setting an account, you can only send the set account to the second device and the administrator account or device; when setting the password, you can only send the set password to the second device and the administrator account or device; when setting the account and password , send the account number and password.

In the embodiment of the present invention, the address of the second device, such as an IP (Internet Protocol) address, etc., may be set on the first device before the account and/or password is generated and transmitted. Of course, it can also be the MAC (Media Intervention Control) address of the second device. The administrator account can be a mobile phone number, an email account, an instant messaging account, and the like. The management device can be various types of devices, and the address of the device, for example, an IP address/MAC address, can be pre-managed on the first device.

Each administrator account or management device may correspond to the management rights of the one or more second devices. Preferably, the account and/or password corresponding to the second device managed by the administrator device or the management device may be delivered to the administrator account or the management device.

In a preferred embodiment of the present invention, the administrator account is a mobile phone number, and the first device can send a short message to the administrator account through the short message center, where the short message carries the account and/or password. The correspondence between the second device and the administrator account can be saved on the first device.

In an embodiment of the embodiment of the present invention, the first device may further set an expiration date of the generated account and/or password, wherein, when the expiration date arrives, the at least one second device can no longer use the respective account and/or password. Further, when the expiration date arrives, the first device may generate and send a new account and/or password for the at least one second device.

Each account and password can be set to a corresponding validity period. Of course, a uniform validity period can also be set for all second device accounts and passwords. In the embodiment of the present invention, the validity period of the account password may be set for the second device according to the security requirement of the second device. For example, the second device with high security requirement may set a shorter validity period and the security requirement is low. The second device can set a longer expiration date. You can also set the validity period of the account password for the second device according to the importance of the account. For example, for the system account and password, you can set a longer validity period. For the service account and password, you can set a shorter validity period to ensure business security. .

In an embodiment of the embodiment of the present invention, the first device may send, to the at least one second device, a message for reclaiming the generated account and/or password when the expiration date arrives, wherein the at least one second device is configured to respond to the message. Set their respective account and/or password to invalid.

In another embodiment of the present invention, the first device may send an expiration date to the at least one second device, or the at least one second device, an administrator account, or the management terminal, where the at least one second device is configured to According to the corresponding validity period, the respective account number and/or password are set to be invalid after the respective corresponding validity period expires.

Of course, the above two embodiments can be used simultaneously.

In the embodiment of the present invention, the foregoing setting the respective account and/or password to be invalid may be deleting the account and/or the password, or setting the effective indication of the account and/or the password to “false”, but Not limited to this.

In the embodiment of the present invention, the first device may further store the generated account and password. Preferably, the account number and password can be stored in a database in an encrypted manner.

When the network fails, the operator can manually view or modify the account and/or password of the second device on the first device.

In an embodiment of the present invention, the first device may respond to the administrator account and/or the request of the management device to the administrator account and/or management if the administrator account and/or the management device pass the verification. The device sends the corresponding account and/or password.

Of course, the account and/or password may also be sent to the second device in response to the request of the second device. For example, when the second management device is abnormal, and the account and/or the password are lost, the second device may request the first device to send the account and/or password of the second device, and the first device responds to the request to the second device. Send an account number and / or password.

The above request may carry the identifier of the second device to be acquired, for example, a preset number, or an IP address of the second device, a MAC address of the second device, and the like. Of course, the first device may determine the second device to be acquired according to the administrator account or the identifier of the management device according to the administrator account or the correspondence between the identifier of the management device and the second device. The foregoing correspondence may be stored on the first device, or may be stored in other devices, and acquired by the first device when needed.

The above verification may be an authentication of an administrator account and a management device, and the verification may be performed in various ways. For example, by means of a verification code, for example, after an administrator account is logged in, request to obtain an account of the corresponding second device. And the password, the second device may require the administrator to provide the pre-provided mobile phone number, send a verification code to the mobile phone number, and the user sends the received verification code to the first device, and the first device performs verification. Of course, other verification methods can also be used, which are not described here one by one.

In the embodiment of the present invention, the second device may include at least one proxy, and the first device may send the account and/or password to the at least one proxy, and the proxy sends the account and/or password to the second device.

The password and account number on the second device may be stored in the second device in an encrypted manner.

In the embodiment of the present invention, for the second device that does not support the manner in which the password is set, the password may be set by the first device or other second device in a remote manner.

In the embodiment of the present invention, it is also possible to verify whether the transmission is successful.

FIG. 2 is a structural block diagram of an account management apparatus according to an embodiment of the present invention. The device is located in a first device. As shown in FIG. 2, the device includes: a generating module 10 and a sending module 20. The generating module 10 is configured to generate an account and/or a password for the at least one second device, and the sending module 20 is connected to the generating module 10, and configured to be to the at least one second device, and the corresponding administrator account or management. The terminal sends the generated account and/or password, wherein the at least one second device is configured to configure the corresponding account and password as respective account and password.

In an embodiment of the present invention, the apparatus may further include: a setting module configured to set an expiration date of the generated account and/or password, wherein the at least one second device is no longer available when the expiration date arrives Their respective account number and / or password. The generating module 10 is further configured to generate and send a new account and/or password for the at least one second device when the validity period arrives.

In an embodiment of the present invention, the apparatus may further include: a recycling module, configured to send, to the at least one second device, a message for reclaiming the generated account and/or password when the expiration date is reached, where The at least one second device is configured to set the respective account number and/or password to be invalid in response to the message.

In an embodiment of the present invention, the sending module 20 is further configured to send the validity period to the at least one second device, or the at least one second device, an administrator account, or a management terminal, where the at least one The second device is configured to set the respective account number and/or password to be invalid after the respective corresponding validity period expires according to the respective corresponding validity period.

In a preferred embodiment of the present invention, the administrator account includes a mobile phone number, and the sending module 20 is configured to send a short message to the administrator account through the short message center, where the short message carries the account and/or password.

In an embodiment of the embodiment of the present invention, the apparatus may further include: a storage module configured to store the generated account and password.

Preferably, the method further includes a query module configured to respond to the administrator account and/or the request for managing the device, and send the corresponding account to the administrator account and/or the management device if the administrator account and/or the management device pass the verification. Account number and / or password.

Preferably, the user graphical interface is also provided on the second device, and the account and password stored on the first device are manually queried or modified when the network fails.

A preferred embodiment of an embodiment of the invention is described below.

In the preferred embodiment, the host account includes a password-secured system such as an operating system account, a business account, and a database account. The password of the account (including the root user) is randomly generated and sent to the designated maintenance personnel through the short message. The password is stored in the database in an encrypted manner. The validity time of the password can be set. After the expiration date is set, the system can automatically reclaim the previously issued password, and the password will expire and cannot be used. Re-use it and need to re-issue. Of course, it is also possible to manually recover the password without setting the password validity period. If you are unable to send a text message when the SMS system is abnormal, you can use the emergency mechanism to manually enter the password. At the same time, the password is sent to the host. Compared with the traditional password maintenance mechanism, the system has the other advantage of being able to modify the host account password in batches, thus achieving unified maintenance and management of the password.

Through the preferred embodiment, the unified security maintenance of the host account password, from the original document maintenance password to the current unified maintenance of the system, avoids the problem that the file is not updated completely, or the operator privately updates the password. The SMS is sent to the customized operator to ensure the security of the host login, and the access personnel of the host are restricted from the perspective of passwords and permissions. The recovery of the host account password ensures the security of the account, and the same operation user cannot operate the host without restriction. It is possible to modify the host account password in batches. Now there are tens of thousands of machines in the computer room and even more. If one is to operate, it will take a lot of manpower and time.

3 is a schematic diagram of a preferred account management system according to an embodiment of the present invention. As shown in FIG. 3, the method mainly includes: a password center (corresponding to the first device), an agent (Agent), and a host (equivalent to the second device). And a text center.

Create a host device to be managed in the password center, fill in the device IP address, and create management operator information to fill in the operator phone information. The password is created in the password center. The password is automatically generated and sent to the host through the agent. The password center also sends the password to the corresponding operations administrator.

The preferred embodiment will now be described with reference to FIG.

FIG. 4 is a flowchart of sending an account password by a password center according to an embodiment of the present invention. As shown in FIG. 4, the method includes steps S402 to S412.

In step S402, the password center sends an account password (a randomly generated encryption form) to the agent on the device.

In step S404, the agent sends the account password to the device, and the account password on the device is modified. After being successfully delivered, the agent returns to the password center.

Step S406, the password center updates the password of the device saved in the database.

Step S408, the password center sends the password to the user by using a short message.

In step S410, the password center sends a recycle message to the agent to recover the account password issued (can be periodically recycled, or manually recycled).

Step S412, after the password is successfully recovered, the Agent returns a success message to the password center.

From the above description, it can be seen that the present invention achieves the following technical effects: unified security maintenance of the host account password, from the original document maintenance password, to the current unified maintenance of the system, thus avoiding the incomplete updating of the document, or operation The problem of privately updating the password. The SMS is sent to the customized operator to ensure the security of the host login, and the access personnel of the host are restricted from the perspective of passwords and permissions. The recovery of the host account password ensures the security of the account, and the same operation user cannot operate the host without restriction. It is possible to modify the host account password in batches. Now there are tens of thousands of machines in the computer room and even more. If one is to operate, it will take a lot of manpower and time.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

As described above, the method and apparatus for managing an account provided by the embodiment of the present invention have the following beneficial effects: the account and/or password of the second device are generated by the first device, and the second device and the administrator account/management device are The password generated underneath realizes the unified management of the password of the second device, avoiding the cumbersome and unsafe factors of human modification.

Claims

An account management method, including:

The first device generates an account and/or password for the at least one second device;

Sending, by the first device, the generated account and/or password to the at least one second device, and the corresponding administrator account or the management terminal, where the at least one second device is configured to use the corresponding account and The passwords are configured with their respective accounts and passwords.
The method of claim 1 further comprising:

The first device sets an expiration date of the generated account and/or password, wherein, when the expiration date arrives, the at least one second device can no longer use the respective account and/or password;

When the expiration date arrives, the first device generates and sends a new account and/or password for the at least one second device.
The method of claim 2, further comprising:

Sending, by the first device, a message for reclaiming the generated account and/or password to the at least one second device when the expiration date arrives, wherein the at least one second device is set to respond to the message Account and / or password is set to invalid; and / or

Sending, by the first device, the validity period to the at least one second device, or the at least one second device, the administrator account, or the management terminal, where the at least one second device is configured to According to the corresponding validity period, the respective account number and/or password are set to be invalid after the respective corresponding validity period expires.
The method of claim 1, wherein the administrator account comprises a mobile phone number, and the first device sends the generated account and/or password to the administrator account of the at least one second device, including:

The first device sends a short message to the administrator account through the short message center, where the short message carries the account number and/or the password.
The method according to any one of claims 1 to 4, further comprising:

The first device stores the generated account and password;

Responding to the administrator account and/or the request of the management device, the first device, in the case that the administrator account and/or the management device pass the verification, to the administrator account and/or the The management device sends a corresponding account and/or password.
An account management device, located in the first device, includes:

Generating a module, configured to generate an account and/or password for the at least one second device;

a sending module, configured to send the generated account and/or password to the at least one second device, and the corresponding administrator account or management terminal, wherein the at least one second device is configured to use the corresponding account and The passwords are configured with their respective accounts and passwords.
The apparatus of claim 6 further comprising:

a setting module, configured to set a validity period of the generated account and/or password, wherein, when the expiration date arrives, the at least one second device can no longer use the respective account and/or password;

The generating module is further configured to: when the expiration date arrives, the first device generates and sends a new account and/or password for the at least one second device.
The apparatus according to claim 7, wherein

The apparatus further includes: a recycling module configured to send a message for recycling the generated account and/or password to the at least one second device when the validity period arrives, wherein the at least one second device is configured to Responding to the message to set their respective account and/or password to be invalid; and/or

The sending module is further configured to send the validity period to the at least one second device, or the at least one second device, the administrator account, or the management terminal, where the at least one second The device is used to set the respective account number and/or password to be invalid after the respective corresponding validity period expires according to the respective corresponding validity period.
The device according to claim 6, wherein the administrator account includes a mobile phone number, and the sending module is configured to send a short message to the administrator account through the short message center, wherein the short message carries the Account number and / or the password.
The apparatus according to any one of claims 6 to 9, further comprising:

a storage module, configured to store the generated account and password;

a query module, configured to respond to the administrator account and/or the request of the management device, to the administrator account and/or in the case that the administrator account and/or the management device pass verification The management device sends a corresponding account and/or password.