TWM599062U - Privileged account management system - Google Patents

Abstract

A privileged account management system includes at least one target server, a storing module, a data management module and a monitoring analysis module. The target server includes a server data and at least one privileged account corresponding to the server data. The storing module is configured for storing a server list, and the server list includes each server data of the target servers and the at least one privileged account corresponding to the server data. The data management module establishes a privileged account list by monitoring the target servers and sends the privileged account list at a specific time. The privileged account list includes all the privileged accounts of the target servers. The monitoring analysis module matches up between the server list and the privileged account list and selectively generates and sends a warning signal.

Description

Privileged account management system

This creation is about an account management system, and in particular, about a privileged account management system that can improve data security.

In this era of fast network communication and convenient data transmission, people are gradually unable to leave the network. No matter in business transactions, interpersonal interaction, or lifestyle, they are all closely related to the network, and the data communication of the internal computer of the enterprise can also be achieved through the internal communication of the enterprise. Network for transmission. Due to the convenience of the Internet, many data are readily available. Therefore, companies must establish permissions to obtain data or operating systems to limit and control the number of people who obtain data, thereby preventing data leakage. Take the banking industry as an example. Since many data contain customers' personal data, how to protect customers' personal data from leakage is an important issue. In addition, if the system is not protected by permissions, the system is vulnerable to escalation and attack. Therefore, companies usually create privileged accounts to control data and improve data security.

However, in recent years, the threat of malicious programs has become more and more serious. Many hackers have invaded the defense system of enterprises to obtain privileged accounts to escalate privileges and launch attacks (such as the SWIFT hacking incident, the bank ATM being attacked by hackers to spit money, etc.). Therefore, how to effectively manage privileged accounts will be one of the main problems. The current method for general enterprises to enhance the management privileged account is to install applications or integrate software on the enterprise’s server to collect the relevant information of each server, and then return it to the information security defense system for comparison and analysis to find An abnormal event occurred. However, because the corporate server All need to install other programs or software not only increase costs but also reduce server performance.

Therefore, it is necessary to develop a privileged account management system to solve the problems of the prior art.

In view of this, one of the scopes of this creation is to provide a privileged account management system, which can reduce costs and effectively improve data security.

According to a specific embodiment of this creation, the privileged account management system includes at least one target server, a storage module, a data management module, and a monitoring analysis module. At least one target server stores at least one privileged account, and each target server includes server data and at least one privileged account corresponding to the server data. The storage module is used to store a server list, where the server list includes each target server data of all target servers and each privileged account corresponding to each target server data. The data management module is coupled to at least one target server. The data management module is used for monitoring the target server and creating a list of privileged accounts, and sending the list of privileged accounts at least at a specific time. The list of privileged accounts contains all privileged accounts of the target server. The monitoring analysis module is coupled to the storage module and the data management module. The monitoring and analysis module is used to receive the list of privileged accounts and compare the list of servers and the list of privileged accounts. When the server list does not match the privileged account list, the monitoring and analysis module generates and sends a warning signal.

Among them, at least one privileged account includes the first privileged account. When the privileged account list contains the first privileged account corresponding to the target server and the server list does not contain the first privileged account corresponding to the target server, the monitoring and analysis module generates and sends a warning signal.

Among them, at least one privileged account includes the first privileged account. When the server list contains the first privileged account corresponding to the target server and the privileged account list does not include the corresponding target server The first privileged account of the device, the monitoring analysis module generates and sends a warning signal.

Wherein, the privileged account management system further includes a transceiver module, coupled to at least one target server and a monitoring analysis module. The transceiver module is used to recover the privileged account password of the corresponding privileged account. When the privilege account corresponding to the privilege account password recovered by the transceiver module at the specific time does not match the server list, the monitoring analysis module generates and sends a warning signal.

Further, at least one specific time includes a first specific time, at least one privileged account includes a first privileged account, and the first privileged account includes a first specific time. When the transceiver module does not retrieve the privileged account password corresponding to the first privileged account at the first specific time and the server list contains the first privileged account, the monitoring and analysis module generates and sends a warning signal.

Among them, the privileged account management system further includes an application module, a receiving and sending module, and a monitoring analysis module. The application module is used to send application messages to the transceiver module. The application message includes at least one target server data and at least one privileged account corresponding to the at least one target server data. When the application message does not match the server list, the monitoring analysis module generates and sends a warning signal.

Further, the application message includes the second target server data and the second privilege account data. When the server list does not include the second target server data, the transceiver module creates the second target server data and the second privilege account data corresponding to the second target server data in the server list.

Among them, the privileged account management system further includes a display module coupled to a monitoring analysis module. The display module is used to receive and display the warning signal sent by the monitoring analysis module.

Among them, the data management module is the System Center Configuration Manager (SCCM).

Among them, the transceiver module, the monitoring analysis module, and the storage module are integrated in the server.

To sum up, the privileged account management system of this creation can accurately determine unauthorized privileged accounts based on cross-comparison of multiple data sources, thereby enhancing data security. Moreover, the privileged account data of each server can be obtained through the integrated manager, without installing other related integration and data security defense software on each server, thereby reducing costs and improving server performance.

1: Privileged account management system

11A, 11B: target server

12, 161, 261: transceiver module

13: Data management module

14, 162, 262: monitoring analysis module

15, 264: display module

16, 26: server

17, 163, 263: storage module

18: Application module

Fig. 1 is a functional block diagram of a privileged account management system according to a specific embodiment of the invention.

Fig. 2 is a functional block diagram of a privileged account management system according to another specific embodiment of the present creation.

Fig. 3 is a functional block diagram of a privileged account management system according to another specific embodiment of the present creation.

Fig. 4 is a functional block diagram of a privileged account management system according to another specific embodiment of the present creation.

In order to make the advantages, spirit and features of this creation easier and clearer to understand, the following will be detailed and discussed with specific embodiments and with reference to the accompanying drawings. It should be noted that these specific embodiments are only representative specific embodiments of the creation, and the specific methods, devices, conditions, materials, etc. exemplified therein are not intended to limit the creation or the corresponding specific embodiments. In addition, each device in the figure is only used to express its relative position and is not drawn according to its actual scale, which is described first.

In various embodiments of the present disclosure, the expression "or" includes any or all combinations of words listed at the same time. For example, the expression "A or B" can include A, can include B, or can include both A and B. In addition, the indefinite articles "a", "one" and "one" before the authoring device or element have no limitation on the number of devices or elements (ie, the number of appearances). Therefore, "a" should be interpreted as including one or at least one, and a device or element in the singular form also includes the plural form, unless the number clearly refers to the singular form.

In the description of this specification, the description with reference to the terms "a specific embodiment", "another specific embodiment" or "parts of specific embodiments" etc. means that the specific features, structures, materials or features described in conjunction with the embodiment include In at least one embodiment of this creation. In this specification, the schematic representations of the aforementioned terms do not necessarily refer to the same embodiment. Moreover, the described specific features, structures, materials or characteristics can be combined in any one or more embodiments in a suitable manner.

Please refer to FIG. 1, which is a functional block diagram of a privileged account management system 1 according to a specific embodiment of the present creation. In this specific embodiment, the privileged account management system 1 includes target servers 11A and 11B, a storage module 17, a data management module 13, and a monitoring analysis module 14. The target servers 11A and 11B are coupled to the data management module 13, and the monitoring analysis module 14 is coupled to the data management module 13 and the storage module 17. In practice, the privileged account management system 1 can be applied to enterprise data security management. The monitoring analysis module 14 and the storage module 17 can operate in a computer host (such as a server), and the target servers 11A and 11B can be wired or wirelessly connected to the data management module 13 in the computer host. Please note that the number of target servers in FIG. 1 is not limited to two, and can also be one or more than three.

In this specific embodiment, the target server 11A includes server data and At least one privileged account for server data. In practice, the target server 11A may be an industrial computer, and may be a server of a database, system, online platform, etc. to be managed by the enterprise. The server data is data that can be used to identify the target server 11A (eg, computer IP location, computer number, etc.). The privileged account can be the highest authority account of the system or database, and the privileged account can be in the form of a file. For example, when the privileged account management system 1 is applied to the banking industry, the target server 11A may be a financial database, and the privileged account is the highest authority account of the database server. Please note that the functions of the target server 11B are substantially the same as those of the target server 11A, and will not be repeated here. Furthermore, when the number of target servers is more than three, the functions of each target server are substantially the same as those of the target server 11A.

In this embodiment, the storage module 17 is used to store a server list, where the server list includes each target server data of all target servers and at least one privileged account corresponding to each target server data. In practice, the storage module 17 can be a hard disk, an external hard disk, etc. The server list may include server data in the target server 11A and the corresponding privileged account, and server data in the target server 11B and the corresponding privileged account. The server list can be stored in the storage module 17 in a pre-stored or imported manner. For example, when a company’s server is launched or an existing server is operating, the administrator of a privileged account can first store the server data of all the listed and existing servers and the privileged account of the corresponding server in the storage module 17 in.

In this specific embodiment, the data management module 13 monitors the target servers 11A and 11B and creates a list of privileged accounts, and the list of privileged accounts includes all privileged accounts of the target servers 11A and 11B. In practice, the data management module 13 can be built in a computing chip or can be an application program and can identify a privileged account. The data management module 13 can determine and know that it is located in the target server All privileged accounts of the server 11A and all privileged accounts of the target server 11B. In a specific embodiment, the data management module 13 is a System Center Configuration Manager (SCCM). As the server data can include not only the aforementioned computer IP location and computer number, but also operating system data (such as Windows operating system). In practice, when the target server 11A and the target server 11B are both Windows operating systems, the SCCM in the Windows system can directly monitor and learn the privileged accounts of the target server 11A and the target server 11B to create a list of privileged accounts. Please note that the data management module 13 is not limited to SCCM, and can also be any other manager capable of creating a list of privileged accounts. Therefore, the created privileged account management system 1 can directly know the privileged account of the server without installing additional data security software on each server, so as to improve the operation capability of the server and reduce the burden on the server, thereby reducing Cost and improve server performance.

Further, the data management module 13 can send the list of privileged accounts to the monitoring analysis module 14 at least at a specific time. In practice, the data management module 13 can periodically report the privileged accounts in the target servers 11A and 11B to monitor the use of the privileged accounts of each target server. The specific time can be pre-stored in the data management module 13 and can be set according to requirements. For example, the specific time can be set to 6 o'clock in the afternoon every day. Therefore, the data management module 13 can send the list of privileged accounts to the monitoring analysis module 14 at 6 o'clock in the afternoon every day.

In this specific embodiment, after the monitoring and analysis module 14 receives the list of privileged accounts sent by the data management module 13, the monitoring and analysis module 14 compares the list of privileged accounts created by the data management module 13 and stores it in the storage List of servers in module 17. In practice, the monitoring analysis module 14 can be built in a computing chip. The monitoring analysis module 14 can determine whether each target server 11A and 11B has abnormal and unauthorized special features by comparing the list of privileged accounts and the list of servers. Account, and generate and send warning signals based on the judgment results. Further, the privileged account management personnel can take corresponding information security protection processing according to the warning signal, thereby improving data security.

In a specific embodiment, when the list of privileged accounts includes the first privileged account corresponding to the target server 11A, and the server list does not include the first privileged account corresponding to the target server 11A, the monitoring analysis module 14 generates and sends an alert Signal. In practice, when the data management module 13 finds the first privileged account that is not recorded in the server list, that is, the first privileged account is not the original privileged account of the target server, nor is it the privileged account of the enterprise The account created by the administrator when the target server was launched. In other words, the first privileged account may be an unauthorized privileged account created by the hacker invading the target server 11A. Further, the privileged account manager of the enterprise can delete the account from the target server according to the warning message sent by the monitoring analysis module 14 to improve the security of the enterprise.

In a specific embodiment, when the server list includes the first privileged account corresponding to the target server 11A, and the privileged account list does not include the first privileged account corresponding to the target server 11A, the monitoring analysis module 14 generates and sends an alert Signal. In practice, when the list of privileged accounts sent by the data management module 13 does not include the first privileged account, that is, the first privileged account no longer exists. In other words, the target server 11A may have been taken down, so the data management module 13 cannot obtain the first privilege account. However, since the server list in the storage module 17 still contains the data corresponding to the first privileged account of the target server 11A, the privileged account manager of the enterprise can update the storage module 17 according to the warning message sent by the monitoring analysis module 14 The list of servers in to control the flow of all privileged accounts of the enterprise. Therefore, the privileged account management system 1 can automatically determine the abnormal privileged account according to the list of privileged accounts and the list of servers, thereby improving the efficiency of security management of the enterprise.

Please refer to Figure 2. FIG. 2 is a functional block diagram of the privileged account management system 1 according to another specific embodiment of the present creation. The difference between this specific embodiment and the foregoing specific embodiments is that the privileged account management system 1 of this specific embodiment further includes a transceiver module 12. The transceiver module 12 is coupled to the target servers 11A and 11B, and is coupled to the monitoring analysis module 14. The transceiver module 12 is used to retrieve the privilege account password corresponding to the privilege account. When the privileged account corresponding to the privileged account password recovered by the transceiver module 12 at a specific time does not match the server list, the monitoring and analysis module 14 generates and sends a warning signal. In practice, the transceiver module 12 may be a data transmission chip. The transceiver module 12 can retrieve the privilege account password of the privilege account applied by all enterprise personnel at a specific time (for example, 6 pm). The way to recover the password of the privileged account can be in the form of changing the password, but is not limited to this. When the transceiver module 12 does not recover the privileged account password of the corresponding privileged account, it means that the privileged account password of the corresponding privileged account has not been changed. At this time, the privileged account manager of the enterprise can send a warning message according to the monitoring analysis module 14 Change the password of the privileged account corresponding to the privileged account to control and avoid abuse of the privileged account. Therefore, the privileged account management system 1 can also effectively manage the privileged account through the transceiver module 12 to enhance the data security of the enterprise.

The privileged account password corresponding to the privileged account recovered by the transceiver module 12 can be analyzed and compared with the server list in the storage module 17 as well as the privileged account list sent by the data management module 13 Compare with. In a specific embodiment, when the transceiver module 12 recovers the privileged account password corresponding to the privileged account, it also generates an application record according to the privileged account corresponding to the privileged account password. When the list of privileged accounts sent by the data management module 13 does not match the application record of the transceiver module 12, the monitoring analysis module 14 generates and sends a warning signal. For example, when the list of privileged accounts sent by the data management module 13, the use record of the target server 11A includes the first privileged account and the application record generated by the transceiver module 12 does not include the corresponding target When the first privileged account of the server 11A is used, that is, the first privileged account is not authorized to apply normally. The privileged account manager of the enterprise can search for the historical record of the first privileged account according to the warning signal generated and sent by the monitoring analysis module 14. Therefore, the privileged account management system 1 can automatically determine abnormal privileged accounts based on the list of privileged accounts and the recovered privileged account passwords, so as to effectively manage the privileged accounts of the enterprise, thereby improving the efficiency of security management of the enterprise.

The aforementioned specific time may be the time when the transceiver module 12 reclaims the privileged account, or may be a basis for reclaiming each privileged account. In a specific embodiment, the first privileged account of the target server 11A includes the first specific time. When the transceiver module 12 does not retrieve the privileged account password corresponding to the first privileged account at the first specific time and the server list includes the first specific time When a privileged account is used, the monitoring analysis module 14 generates the warning signal. The difference between the first specific time in this embodiment and the foregoing specific time is that the foregoing specific time is a fixed time point, and the transceiver module 12 recovers all privileged accounts at a fixed time point; The first specific time in the specific embodiment is the use time of the first privileged account. Further, multiple privileged accounts may respectively contain different use times. Therefore, the transceiver module 12 can reclaim the privileged account according to the use time of each privileged account. . In practice, the first specific time may be the use period of the first privileged account (for example, 3 hours), and the first specific time may be preset in the transceiver module 12. Therefore, when the transceiver module 12 does not retrieve the first privileged account after 3 hours, the monitoring analysis module 14 generates a warning signal. Therefore, the privileged account management system 1 can also compare the recovered privileged accounts and the list of privileged accounts by the timeliness of the privileged accounts to determine abnormal privileged accounts, thereby enhancing data security.

The privileged account management system 1 created by this invention may further include an application module 18. The application module 18 is coupled to the receiving and sending module 12 and the monitoring and analyzing module 14, and is used to send application messages to the receiving and sending module 12. The application message contains at least one target server data and the corresponding target server The privileged account of the server. In practice, the application module 18 can be an application, system, or interface for applying for a privileged account, and the application module 18 can be integrated in a computer or server. When enterprise personnel need to apply or apply for adding a privileged account of the target server 11A, the application module 18 can send an application message containing the server data of the target server 11A and the privileged account corresponding to the server data to the transceiver module 12 . When the application message does not match the server list, the monitoring analysis module 14 generates and sends a warning signal.

In a specific embodiment, when the application message includes the second server data and the second privilege account, and the server list does not include the second server data and the second privilege account, the transceiver module 12 creates the second server data And the second privileged account corresponding to the data of the second server is in the server list. In practice, when the server list does not contain the second server data, that is, the second server that contains the second server data is not an existing server. Therefore, the second server may be available soon , And the application message is the privilege account newly applied for by the administrator of the server. Therefore, the privileged account management personnel of the enterprise can confirm the information of the server that is about to be launched according to the warning message sent by the monitoring analysis module 14 to control all the privileged accounts of the enterprise.

Furthermore, the monitoring and analysis module 14 can also compare the application message sent by the application module 18, the server list stored in the storage module 17 and the privileged account list sent by the data management module 13. In a specific embodiment, the application message and the server list include the first privileged account of the target server 11A. When the privileged account list includes the first privileged account and the second privileged account of the target server 11A, and the server list does not include When the second privileged account of the target server 11A is used, the monitoring analysis module 14 generates and sends a warning signal. In practice, when the list of privileged accounts contains the second privileged account, but the server list does not contain the second privileged account, that is, the target The second privileged account in the target server 11A is not the original one but is newly added. However, the application message contains the privilege account application record of the target server 11A. Therefore, the privileged account manager can search for the enterprise personnel applying for the privileged account of the target server 11A according to the warning message generated and sent by the monitoring analysis module 14 to determine the legality of the establishment of the second privileged account. Therefore, the privileged account management system 1 can perform cross-comparison through multiple data sources, thereby enhancing the security of enterprise data.

Please continue to refer to Figure 2. The privileged account management system 1 of this embodiment further includes a display module 15 coupled to the monitoring analysis module 14. The display module 15 is used for receiving and displaying the warning signal sent by the monitoring analysis module 14. In practice, the warning signal can be text, image, sound, etc., and the display module 15 can be a computer screen, a mobile phone screen, and a display device. The monitoring and analysis module 14 can also display the number of unauthorized accounts and abnormal accounts on the display module 15. Therefore, the privileged account managers can use the warning signal displayed by the display module 15 to perform subsequent information security protection operations to improve Data security.

Please refer to FIG. 3, which is a functional block diagram of the privileged account management system 1 according to another specific embodiment of the present creation. The difference between this embodiment and the previous embodiment is that the transceiver module 161, the monitoring analysis module 162, and the storage module 163 in the privileged account management system 1 of this embodiment are integrated in the server 16. In practice, the server 16 may be a computer host managed by a privileged account manager. Therefore, the creation, storage, and sending and receiving of privileged accounts can be managed centrally to enhance data security. Please note that the functions of the transceiver module 161, the monitoring analysis module 162, and the storage module 163 of this specific embodiment are substantially the same as those of the foregoing specific embodiment. This will not be repeated here. Please refer to FIG. 4, which is a functional block diagram of the privileged account management system 1 according to another specific embodiment of the present creation. In this specific embodiment, the transceiver module 261 and the monitoring component in the privileged account management system The analysis module 262, the storage module 263, and the display module 264 are integrated in the server 26. Please note that the functions of the transceiver module 261, monitoring analysis module 262, storage module 263, and display module 264 of this specific embodiment are the same as those of the transceiver module, monitoring analysis module, storage module, and The functions of the display modules are roughly the same, so I won't repeat them here.

To sum up, the privileged account management system of this creation can accurately determine unauthorized privileged accounts based on cross-comparison of multiple data sources, thereby enhancing data security. And the privileged account data of each server can be obtained through the integrated manager, without installing other related integrated software on each server, thereby reducing costs and improving server performance.

Based on the above detailed description of the preferred embodiments, it is hoped that the characteristics and spirit of the creation can be described more clearly, and the scope of the creation is not limited by the preferred embodiments disclosed above. On the contrary, its purpose is to cover various changes and equivalent arrangements within the scope of the patent application for this creation. Therefore, the scope of the patent application for this creation should be interpreted in the broadest sense based on the above description, so that it covers all possible changes and equivalent arrangements.

1: Privileged account management system

11A, 11B: target server

13: Data management module

14: Monitoring analysis module

17: Storage module

Claims (10)

A privileged account management system, which includes: At least one target server stores at least one privileged account, wherein each target server includes a server data and the at least one privileged account corresponding to the server data; A storage module for storing a server list, wherein the server list includes each target server data of all the target servers and the at least one privileged account corresponding to each target server data; A data management module coupled to the at least one target server, the data management module is used to monitor the at least one target server and create a list of privileged accounts, and send the list of privileged accounts at least at a specific time, the privileges The account list contains all privileged accounts of the at least one target server; and A monitoring analysis module, coupled to the storage module and the data management module, the monitoring analysis module to receive the list of privileged accounts and compare the list of servers and the list of privileged accounts, when the list of servers and When the list of privileged accounts does not match, the monitoring and analysis module generates and sends a warning signal. For example, the privileged account management system described in item 1 of the scope of patent application, wherein the at least one privileged account includes a first privileged account, when the list of privileged accounts includes the first privileged account corresponding to the target server and the server list When the first privilege account corresponding to the target server is not included, the monitoring analysis module generates and sends the warning signal. For example, the privileged account management system described in item 1 of the scope of patent application, wherein the at least one privileged account includes a first privileged account, when the server list includes the first privileged account corresponding to the target server and the privileged account list Does not contain the first privilege account corresponding to the target server At the time of the signal, the monitoring analysis module generates and sends the warning signal. For example, the privileged account management system described in item 1 of the scope of patent application further includes a transceiver module, coupled to the at least one target server and the monitoring analysis module, and the transceiver module is used to retrieve at least one privileged account When the at least one privileged account password recovered by the transceiver module at the specific time does not match the server list, the monitoring and analysis module generates and sends the warning signal. For example, the privileged account management system described in item 4 of the scope of patent application, wherein the at least one specific time includes a first specific time, the at least one privileged account includes a first privileged account, and the first privileged account includes the first At a specific time, when the transceiver module does not retrieve the at least one privileged account password corresponding to the first privileged account at the first specific time and the server list contains the first privileged account, the monitoring analysis module generates the alert Signal. For example, the privileged account management system described in item 4 of the scope of patent application further includes an application module coupled to the transceiver module and the monitoring analysis module, and the application module is used to send an application message to the transceiver module , The application message includes the at least one target server data and the at least one privileged account corresponding to the at least one target server data. When the application message does not match the server list, the monitoring analysis module generates and sends the alert Signal. For example, the privileged account management system described in item 6 of the scope of patent application, wherein the application message includes a second server data and a second privileged account, when the server list does not include the second server data, the receiving and sending The module creates the second server data and the second privileged account corresponding to the second server data in the server list. For example, the privileged account management system described in item 1 of the scope of patent application further includes a display module coupled to the monitoring analysis module, and the display module uses To receive and display the warning signal sent by the monitoring analysis module. For example, in the privileged account management system described in item 1 of the scope of patent application, the data management module is the System Center Configuration Manager (SCCM). For example, in the privileged account management system described in item 4 of the scope of patent application, the transceiver module, the monitoring analysis module, and the storage module are integrated in a server.

Images