WO2016184221A1 - 密码管理方法及装置、系统 - Google Patents

密码管理方法及装置、系统 Download PDF

Info

Publication number
WO2016184221A1
WO2016184221A1 PCT/CN2016/075543 CN2016075543W WO2016184221A1 WO 2016184221 A1 WO2016184221 A1 WO 2016184221A1 CN 2016075543 W CN2016075543 W CN 2016075543W WO 2016184221 A1 WO2016184221 A1 WO 2016184221A1
Authority
WO
WIPO (PCT)
Prior art keywords
password
management platform
management
terminal
password information
Prior art date
Application number
PCT/CN2016/075543
Other languages
English (en)
French (fr)
Inventor
查桂峰
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016184221A1 publication Critical patent/WO2016184221A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols

Definitions

  • the present invention relates to the field of communications, and in particular to a password management method, apparatus, and system.
  • the main problems are: more applications, more users, password management and maintenance is difficult to record and maintain, easy to leak; when changing passwords regularly, it is prone to record deviation or error; application architecture is complex, corresponding password changes have a greater impact, and may even lead to The application cannot be operated normally quickly; when the operation and maintenance personnel are replaced, the password management is time-consuming and labor-intensive; it is time-consuming and labor-intensive to find the password when the system is temporarily maintained, which affects the efficiency; password management security is difficult to guarantee.
  • the password management method requires the participation of maintenance personnel, which requires a large workload, affects the efficiency of password management, and the security of password management cannot be guaranteed. No effective solution has been proposed.
  • an embodiment of the present invention provides a password management method, apparatus, and system.
  • a password management method including: a management platform receives password information sent by a terminal that is managed by the management platform; and the management platform performs a password on the password of the terminal according to the password information. management.
  • the management platform receives the password information sent by the terminal that is managed by the management platform, and the management platform receives the terminal to encrypt the password information to obtain encrypted password information, where The public key carried in the digital certificate acquired by the terminal is used to encrypt the password information.
  • the method before the management platform receives the password information sent by the terminal that is managed by the management platform, the method further includes: the management platform and the terminal mutually verifying according to the digital certificate, wherein, after the verification is passed, the Management The platform receives the encrypted password information.
  • the management platform performs password management on the password of the terminal according to the password information, including: the management platform saves a password corresponding to the password information, and/or the management platform The password saved by the management platform is modified to the password corresponding to the received password information, and/or the management platform sends the password saved locally to the designated terminal.
  • the management platform modifies the password saved by the management platform to the password corresponding to the received password information, and the management platform sends the password saved by the management platform to the terminal, where Decrypting the password according to the private key carried in the digital certificate acquired by the terminal in advance; after the decryption succeeds, the management platform receives the password information sent by the terminal, and the password saved by the management platform Change to the password corresponding to the received password information.
  • a password management apparatus which is applied to a management platform, and includes: a receiving module, configured to receive password information sent by a terminal managed by the management platform; and a management module configured to The password information is used to perform password management on the password of the terminal.
  • the receiving module is configured to receive, by the terminal, the password information to be encrypted, to obtain encrypted password information, where the public key pair carried in the digital certificate acquired in advance by the terminal is The password information is encrypted.
  • the device further includes: a verification module, configured to perform mutual authentication with the terminal according to the digital certificate, where the encrypted password information is received after the verification is passed.
  • a verification module configured to perform mutual authentication with the terminal according to the digital certificate, where the encrypted password information is received after the verification is passed.
  • the management module includes: a saving unit, configured to save a password corresponding to the password information, and/or a modifying unit, configured to modify the password saved by the management platform to the received password information.
  • the corresponding password, and/or sending unit is set to send the locally saved password to the designated terminal.
  • a password management system including: a management platform and a terminal, the management platform is configured to receive password information sent by a terminal managed by the management platform, and according to the password The information is password-managed for the password of the terminal.
  • the management platform is capable of managing the password corresponding to the password information according to the password information reported by the terminal, and solves the problem that the password management method requires the maintenance personnel to participate in the related technology, which requires a large workload and affects Password management efficiency and password management security cannot be guaranteed, and thus provide a secure password management method, which greatly improves user experience.
  • FIG. 1 is a flow chart of a password management method according to an embodiment of the present invention.
  • FIG. 2 is a block diagram showing the structure of a system according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of password change according to an embodiment of the present invention.
  • FIG. 6 is a flow chart of password delivery according to an embodiment of the present invention.
  • FIG. 7 is a structural block diagram of a password management apparatus according to an embodiment of the present invention.
  • FIG. 8 is a block diagram showing another structure of a password management apparatus according to an embodiment of the present invention.
  • FIG. 9 is a structural block diagram of a management module 72 of a password management apparatus according to an embodiment of the present invention.
  • FIG. 10 is a structural block diagram of a password management system according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a password management method according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps:
  • Step S102 The management platform receives the password information sent by the terminal under the management platform;
  • Step S104 The management platform performs password management on the password of the terminal according to the password information.
  • the management platform can manage the password corresponding to the password information according to the password information reported by the terminal under the management platform, and solve the need in the related art that the password management method requires maintenance personnel to participate.
  • the large workload affecting the efficiency of password management and the security of password management cannot be guaranteed, and thus provides a secure password management method, which greatly improves the user experience.
  • password information can be understood as the password information of the operation and maintenance host.
  • the password information to be sent by the terminal is first encrypted according to the public key in the digital certificate, and the encrypted password information is obtained, and then the encrypted password information is sent to the management platform, that is, the password received by the management platform. In fact, it is encrypted. Even if the management platform is compromised, the password information is obtained. Because there is no public key of the digital certificate mentioned above, the real password cannot be obtained by the outside world. Of course, it is sent by the receiving terminal of the management platform. Before the password information, the management platform and the terminal need to verify the other party according to the digital certificates saved by the terminal, that is, the terminal verifies the management platform, and the management platform also needs to verify the terminal.
  • management platform includes devices and devices capable of implementing the above functions, and all functional entities capable of performing the functions completed by the above steps S102 to S104.
  • the implementation manner of the foregoing step S104 includes, but is not limited to, the following situations: 1) the management platform saves the password corresponding to the password information; 2) the management platform modifies the password saved by the management platform to the received password information.
  • the above modification process can be understood as: the management platform sends the password saved by the management platform to the terminal, wherein the terminal decrypts the password according to the private key carried in the digital certificate acquired by the terminal in advance; after the decryption succeeds, the management The platform receives the password information sent by the terminal, and modifies the password saved by the management platform to the password corresponding to the received password information; 3) the management platform sends the password saved locally to the designated terminal.
  • FIG. 2 is a block diagram of a system structure according to an embodiment of the present invention, including: a certificate authority (CA) server, a certificate device, a management service platform (which can be understood as the management platform of the above embodiment), and an encryption and decryption component ( It can be understood as one of the above terminals, or one device independent of the above terminals, and an operation and maintenance host (corresponding to the above terminal).
  • the CA server is set to apply for and issue the certificate;
  • the certificate device is used to store the certificate, which is the carrier of the certificate, and can be the encryption device;
  • the encryption and decryption component and the management service platform are the core parts, and the unified password management service is realized through the interaction and management of the two.
  • the operation and maintenance host is the object of the implementation of the password management service.
  • the certificate is applied to the management platform on the CA server and installed.
  • the subsequent management platform establishes a secure encrypted channel through the digital certificate before interacting with the CA server, the encryption and decryption component, and
  • the management service platform here is responsible for unified resource management and operation and maintenance login management for virtual machines and physical machines in public cloud and private cloud environments; unified password service serves the management service platform, and relies on encryption and decryption components to provide passwords for hosts. Input, remote operation and maintenance, password change and password transfer operation; the CA server is configured to generate a digital certificate for the operation and maintenance personnel, the application is from the relevant operation and maintenance group account in the virtualization service platform, and the digital certificate serves the decryption component to ensure password management security; The encryption and decryption component encrypts and decrypts the password input by the user, and depends on the public key and the private key in the digital certificate.
  • the digital certificate can be stored in the security device, and the encryption and decryption component reads the relevant certificate information through the device security driver.
  • the account and password of the host are encrypted and stored in the management platform.
  • the public key and the encryption algorithm of the operation and maintenance digital certificate are encrypted by the encryption and decryption component, and the private key and the decryption algorithm are used by the encryption and decryption component for decryption.
  • Digital certificate identification and verification must be performed when communicating between the cryptographic service and the encryption and decryption component to ensure security.
  • FIG. 3 is a flowchart of initializing operation and maintenance according to an embodiment of the present invention, as shown in FIG. 3:
  • step S301 the upper-layer administrator first creates the operation and maintenance authority of the relevant operation and maintenance personnel group account and the related host on the management service platform, and one group may be one or more persons.
  • Step S303 after the creation is successful, the management service platform automatically submits a certificate application (in groups) to the CA server.
  • step S305 after the certificate application is successful, the certificate administrator writes the certificate to the certificate device securely and encryptedly by the corresponding tool for the operation and maintenance personnel.
  • step S307 the operation and maintenance personnel need to obtain a certificate device, such as a USB device, when the operation and maintenance is required.
  • a certificate device such as a USB device
  • Step S309 the operation and maintenance personnel access the management service platform, insert the device certificate, and establish a secure encryption channel with each other by using the certificate, and the host of the jurisdiction may apply for password management, such as input, change, and delivery.
  • FIG. 4 is a flow chart of a password entry process according to an embodiment of the present invention.
  • the password entry process is generally performed during initialization or when the password is abnormally invalid, as shown in FIG. 4:
  • step S402 the application is entered.
  • Step S404 applying for entry
  • the management service platform invokes an encryption and decryption component installed on the client.
  • Step S406 the encryption and decryption component and the cryptographic service of the management service platform perform mutual verification by mutual digital certificates to ensure that both parties are trusted, and it is indeed the group certificate of the applicant, and after the verification is successful, the encryption and decryption symmetric algorithm is negotiated. Enter the user name and password in the encryption and decryption component and submit it. The encryption and decryption component encrypts the password through the public key in the certificate device and securely passes it to the password service for feedback to the management service platform. The management service platform records the operation and maintenance personnel operation log and stores it. The encrypted password corresponding to this host.
  • step S408 an angle is needed between the encryption and decryption component and the certificate device, for example, reading information.
  • FIG. 5 is a flow chart of password change according to an embodiment of the present invention.
  • the password change process is mainly used to periodically change password requirements or other requirements, and is also an important specification requirement for security management and operation. The specific process is shown in Figure 5:
  • Step S502 selecting a changed user name:
  • the following process may also be performed: confirming or setting the driving process and determining that the name of the running script that is set after the password is changed is generally configured to enable the application to operate normally; Not set.
  • Step S504 The management service station calls the client encryption and decryption component, and after performing the same security check by using the password service in the service platform, the previous encrypted user name and password are transmitted, and the password is required to be changed.
  • Step S506 the encryption and decryption component decrypts the user name and password by using the private key, confirms that the user name and password can be decrypted, and then inputs a different new password.
  • Step S508 the operation and maintenance personnel submits a new password, and the encryption and decryption component encrypts the user name and password through the public key in the certificate device, and securely transmits the decrypted user name and the previous password, and the modified password to the password service in the security management platform.
  • Step S510 the cryptographic service modifies the host password and triggers a corresponding driver configuration process, wherein after the execution of the above steps is completed, the management service platform saves the new encrypted password and records the log.
  • the cryptographic service will query the encryption and decryption component for the real password, and call the connection tool to directly perform an effective integration connection without inputting a password, which will not be described here.
  • FIG. 6 is a flow chart of password transmission according to an embodiment of the present invention, and the specific process may be as shown in FIG. 6:
  • Step S602 the operation and maintenance personnel selects to transmit the password operation, including: transmitting the application and receiving the delivery.
  • Step S604 transmitting an application or receiving a delivery
  • the management service platform invokes the encryption and decryption component installed on the client, and the cryptographic service queries the encryption and decryption component for the decrypted password, and uses its own public key to perform encryption and feedback to the management platform for temporary storage, inserting the certificate, and securely logging into the management service platform. Select the appropriate host and choose to accept the corresponding delivery operation.
  • Step S606 the cryptographic service decrypts the temporarily stored encrypted username and password with the private key and applies an encryption request to the encryption and decryption component, and obtains a new encrypted username and password.
  • Step S608 decrypting back or encrypting back
  • the cryptographic service feeds back the new encrypted information to the management platform, and the management platform saves the new encrypted password and updates the delivery status.
  • FIG. 7 is a structural block diagram of a password management apparatus according to an embodiment of the present invention. As shown in Figure 7, the device includes:
  • the receiving module 70 is configured to receive password information sent by the terminal managed by the management platform;
  • the management module 72 is connected to the receiving module 70 and configured to perform password management on the password of the terminal according to the password information.
  • the management platform can solve the password information corresponding to the password information and the password management method corresponding to the password information, and solve the related technology, the password management method requires maintenance personnel to participate. The result is a large workload, affecting the efficiency of password management and the security of password management cannot be guaranteed, and thus provides a secure password management method, which greatly improves the user experience.
  • the receiving module 70 is configured to: the receiving terminal encrypts the password information to obtain encrypted password information, where The password information is encrypted according to the public key carried in the digital certificate acquired by the terminal in advance.
  • FIG. 8 is another structural block diagram of a password management apparatus according to an embodiment of the present invention.
  • the apparatus further includes: a verification module 74 configured to perform mutual authentication with the terminal according to the digital certificate, wherein after the verification is passed, the encrypted password information is received. .
  • FIG. 9 is a structural block diagram of a management module 72 of the password management apparatus according to an embodiment of the present invention.
  • the management module 72 includes: a saving unit 720 configured to save a password corresponding to the password information, and/or a modifying unit. 722, configured to modify the password saved by the management platform to a password corresponding to the received password information, and/or the sending unit 724 is configured to send the password saved locally to the designated terminal.
  • FIG. 10 is a structural block diagram of a password management system according to an embodiment of the present invention.
  • the system includes: a management platform 100, a terminal 102, and a management platform 100. And configured to receive the password information sent by the terminal 102 under the jurisdiction of the management platform, and perform password management on the password of the terminal according to the password information.
  • the management platform can solve the requirement that the password management mode requires the participation of the maintenance personnel in the related art according to the technical means for managing the password corresponding to the password information according to the password information reported by the terminal.
  • Large workload, affecting password management efficiency and password management security cannot be guaranteed, and thus provides a secure password management method, which greatly improves user experience, facilitates enterprise operation and maintenance management, and reduces maintenance costs. Improve password security while maintaining efficiency.
  • the embodiment of the present invention may also be modified according to actual conditions and security requirements.
  • encryption and decryption may be implemented by means of a non-digital certificate, and the digital certificate may also be a soft certificate.
  • the unified password management service implemented by the embodiment of the present invention is a novel way, and can effectively combine password management and operation and maintenance in various management and maintenance platforms, thereby greatly reducing the complexity and security risks of password management, and improving Operation and maintenance efficiency is of great significance to the construction of data center platform and enterprise IT operation and maintenance.
  • the embodiments of the present invention achieve the following technical effects: greatly reducing the operation and maintenance complexity, improving the access efficiency, and ensuring the security of password management.
  • O&M personnel do not need to remember complex passwords, provide human-computer interaction interfaces directly in the form of services and components, meet complex application architecture setting requirements, and provide multi-level protection and exception handling mechanisms, thus saving enterprises a lot of operation and maintenance costs and improving Enterprise application access efficiency and experience, and in the password operation and maintenance process, the password management service implements password recording and operation and maintenance. It is not necessary to record passwords and passwords to be encrypted in the background, which ensures the complexity of password leakage and maintenance.
  • a storage medium is further provided, wherein the software includes the above-mentioned software, including but not limited to: an optical disk, a floppy disk, a hard disk, an erasable memory, and the like.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the foregoing technical solution of the embodiment of the present invention can be applied to a password management process, and the management platform can manage the password corresponding to the password information according to the password information reported by the terminal, and solve the related art in the password management mode. Participation leads to a large workload, affects password management efficiency and password management security can not be guaranteed, and thus provides a secure password management method, greatly improving user experience.

Abstract

本发明提供了一种密码管理方法及装置、系统，其中，该方法包括：管理平台接收该管理平台所管辖的终端发送的密码信息；所述管理平台根据所述密码信息对所述终端的密码进行密码管理，采用本发明提供的上述技术方案，解决了相关技术中，密码管理方式需要维护人员参与而导致的需要较大工作量，影响密码管理效率以及密码管理安全性无法正常保证等问题，进而提供了一种安全的密码管理方式，大大提高了用户体验度。

Description

密码管理方法及装置、系统 技术领域
本发明涉及通信领域，具体而言，涉及一种密码管理方法及装置、系统。
背景技术
在当今信息化时代下，一方面人们IT技能日益普及和提高，对IT应用要求也越来越多，同时用户规模也越来越大；另一方面，随通信技术、终端技术和相关信息科学的发展，IT应用越来越多，架构也越来越复杂；另外，随着近些年的安全事件频发，信息化安全要求也越来越高。这些都使得目前IT维护任务变得复杂多样，费神费力。目前，随着虚拟化技术和数据6+中心建设的发展，很多大的企业建立起统一的数据中心进行统一管理、维护，云化和非云化相互并存，小企业也不断完善自己IT平台，力求统一管理维护，节省成本，同时保障安全。
根据安全运维的要求，政企中的各类应用和数据库主机用户需要定期更改密码，如果应用较少或者架构规模不大，运维人员可能还易维护，但随着各类应用增多以及各类架构的复杂性的增加，维护人员已经很难定期更改记录各用户密码，并能方便安全地记录维护。主要问题在于：应用较多、用户较多，密码管理维护很难记录维护，容易泄露；定期更换密码时，容易出现记录偏差或者错误；应用架构复杂,相应的密码更改影响较大，甚至可能导致应用无法快速正常运行；运维人员更替时，密码管理传递耗时耗力；日常维护登录系统时查找密码费时费力，影响效率；密码管理安全难以保证。
针对相关技术中，密码管理方式需要维护人员参与而导致的需要较大工作量，影响密码管理效率以及密码管理安全性无法正常保证等问题，尚未提出有效的解决方案。
发明内容
为了解决上述技术问题，本发明实施例提供了一种密码管理方法及装置、系统。
根据本发明的一个实施例，提供了一种密码管理方法，包括：管理平台接收该管理平台所管辖的终端发送的密码信息；所述管理平台根据所述密码信息对所述终端的密码进行密码管理。
在本发明实施例中，管理平台接收该管理平台所管辖的终端发送的密码信息，包括：所述管理平台接收所述终端对所述密码信息进行加密，得到加密的密码信息，其中，根据所述终端预先获取的数字证书中携带的公钥对所述密码信息进行加密。
在本发明实施例中，管理平台接收该管理平台所管辖的终端发送的密码信息之前，还包括：所述管理平台与所述终端根据数字证书进行相互验证，其中，在验证通过后，所述管理 平台接收所述加密的密码信息。
在本发明实施例中，所述管理平台根据所述密码信息对所述终端的密码进行密码管理，包括：所述管理平台保存所述密码信息对应的密码，和/或所述管理平台将该管理平台保存的密码修改为接收到的密码信息对应的密码，和/或所述管理平台将保存在本地的密码发送至指定终端。
在本发明实施例中，所述管理平台将该管理平台保存的密码修改为接收到的密码信息对应的密码，包括：所述管理平台将该管理平台保存的密码发送至所述终端，其中，所述终端根据所述终端预先获取的数字证书中携带的私钥对所述密码进行解密；在解密成功后，所述管理平台接收所述终端发送的密码信息，并将该管理平台保存的密码修改为接收到的密码信息对应的密码。
根据本发明的另一个实施例，还提供了一种密码管理装置，应用于管理平台，包括：接收模块，设置为接收该管理平台所管辖的终端发送的密码信息；管理模块，设置为根据所述密码信息对所述终端的密码进行密码管理。
在本发明实施例中，所述接收模块，设置为接收所述终端对所述密码信息进行加密，得到加密的密码信息，其中，根据所述终端预先获取的数字证书中携带的公钥对所述密码信息进行加密。
在本发明实施例中，所述装置，还包括：验证模块，设置为与所述终端根据数字证书进行相互验证，其中，在验证通过后，接收所述加密的密码信息。
在本发明实施例中，所述管理模块，包括：保存单元，设置为保存所述密码信息对应的密码，和/或修改单元，设置为将该管理平台保存的密码修改为接收到的密码信息对应的密码，和/或发送单元，设置为将保存在本地的密码发送至指定终端。
根据本发明的另一个实施例，还提供了一种密码管理系统，包括：管理平台、终端，所述管理平台，设置为接收该管理平台所管辖的终端发送的密码信息，并根据所述密码信息对所述终端的密码进行密码管理。
通过本发明实施例，管理平台能够根据终端上报的密码信息对密码信息对应的密码进行管理的技术手段，解决了相关技术中，密码管理方式需要维护人员参与而导致的需要较大工作量，影响密码管理效率以及密码管理安全性无法正常保证等问题，进而提供了一种安全的密码管理方式，大大提高了用户体验度。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为根据本发明实施例的密码管理方法的流程图；
图2为根据本发明实施例的系统结构框图；
图3为根据本发明实施例的初始化运维流程图；
图4为根据本发明实施例的密码录入流程图；
图5为根据本发明实施例的密码变更流程图；
图6为根据本发明实施例的密码传递流程图；
图7为根据本发明实施例的密码管理装置的结构框图；
图8为根据本发明实施例的密码管理装置的另一结构框图；
图9为根据本发明实施例的密码管理装置的管理模块72的结构框图；
图10为根据本发明实施例的密码管理系统的结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
本发明的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本发明而了解。本发明的目的和其他优点可通过在所写的说明书、权利要求书、以及附图中所特别指出的结构来实现和获得。
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
在本发明实施例中，还提供了一种密码管理方法，图1为根据本发明实施例的密码管理方法的流程图，如图1所示，包括以下步骤：
步骤S102，管理平台接收该管理平台所管辖的终端发送的密码信息；
步骤S104，管理平台根据密码信息对终端的密码进行密码管理。
通过上述各个步骤，管理平台能够根据管理平台所管辖的终端上报的密码信息，进而对密码信息对应的密码进行管理的技术手段，解决了相关技术中，密码管理方式需要维护人员参与而导致的需要较大工作量，影响密码管理效率以及密码管理安全性无法正常保证等问题，进而提供了一种安全的密码管理方式，大大提高了用户体验度。
需要说明的是，上述密码信息可以理解为是运维主机的密码信息。
对于上述步骤S102的实现方式，为了达到密码管理更加安全，在本发明实施例中，还提 供了以下实现方案：终端先对待发送的密码信息根据数字证书中的公钥进行加密，得到加密的密码信息，进而将加密的密码信息发送至管理平台，也就是说，管理平台接收到的密码实际上是经过加密的，即使管理平台被攻破，密码信息被获取到，其由于没有上述提及的数字证书的公钥，真正的密码也无法被外界获取，当然，在管理平台接收终端发送的密码信息之前，需要管理平台和终端根据各自保存的数字证书对对方进行验证，也即终端对管理平台进行验证，管理平台也需要对终端进行验证。
需要说明的是，上述管理平台包括能够实现上述功能的设备、装置，以及能过完成上述步骤S102至S104所完成功能的一切功能实体。
在实际应用过程中，上述步骤S104的实现方式包括但不限于以下几种情况：1)管理平台保存密码信息对应的密码；2)管理平台将该管理平台保存的密码修改为接收到的密码信息对应的密码，上述修改过程可以理解为：管理平台将该管理平台保存的密码发送至终端，其中，终端根据终端预先获取的数字证书中携带的私钥对密码进行解密；在解密成功后，管理平台接收终端发送的密码信息，并将该管理平台保存的密码修改为接收到的密码信息对应的密码；3)管理平台将保存在本地的密码发送至指定终端。
为了更好的理解上述密码管理过程，以下结合一优选示例进行说明上述技术方案：
图2为根据本发明实施例的系统结构框图，包括：证书授权中心(Certificate Authority，简称为CA)服务器、证书设备、管理服务平台(可以理解为上述实施例的管理平台)、加解密组件(可以理解为上述终端中的一个部件，或者与上述终端相互独立的一个设备)、运维主机(相当于上述终端)。CA服务器设置为证书的申请和发放；证书设备用于存放证书，是证书的载体，可以是加密设备；加解密组件和管理服务平台是核心部分，通过两者的交互和管理实现统一密码管理服务；运维主机是密码管理服务实施的对象，需要说明的是，在CA服务器上为管理平台申请证书，并安装。后续管理平台在与CA服务器、加解密组件以及运维人员交互前都通过数字证书建立安全加密通道。
这里的管理服务平台负责对公有云、私有云环境下的虚拟机、物理机进行统一资源管理和运维登录管理；统一密码服务服务于管理服务平台，依赖于加解密组件，提供对主机的密码录入、远程运维、密码变更和密码传递操作；CA服务器设置为为运维人员生成数字证书，其申请来自虚拟化服务平台中相关运维组账号，数字证书服务于解密组件保障密码管理安全；加解密组件对用户输入的密码进行加解密操作，依赖于数字证书中的公钥和私钥，数字证书可以存储在安全设备中，加解密组件通过设备安全驱动读取相关证书信息。主机的账号和密码加密存储在管理平台中，加密由加解密组件使用运维数字证书的公钥和加密算法，解密则由加解密组件使用私钥和解密算法。密码服务和加解密组件之间进行通讯时必须进行数字证书身份识别与校验，以确保安全。
图3为根据本发明实施例的初始化运维流程图，如图3所示：
步骤S301，首先上层管理员在管理服务平台上创建相关运维人员组账户和相关主机的运维权限，一个组中可以是1人或者多人。
步骤S303，创建成功后，管理服务平台自动向CA服务器提交证书申请(以组为单位)。
步骤S305，证书申请成功后，证书管理员为运维人员将证书通过相应的工具安全加密地写入证书设备中。
以下步骤S307至S309在图3中未示出，但在本发明实施例涉及的保护范围内。
步骤S307，运维人员需要运维时，拿到证书设备，如USB设备。
步骤S309，运维人员访问管理服务平台，插入设备证书，利用证书相互建立安全加密通道后，对管辖的主机可申请密码管理，如录入、变更和传递。
图4为根据本发明实施例的密码录入流程图，密码录入一般在初始化时，或者密码异常失效时执行的流程，如图4所示：
步骤S402，申请录入。
步骤S404，申请录入；
其中，用于管理服务平台调用安装在客户机上的加解密组件。
步骤S406，加解密组件与管理服务平台的密码服务通过彼此的数字证书进行相互检验，确保双方可信，并且的确是申请者所在组证书，并在验证成功后，协商好加解密对称算法，在加解密组件中输入用户名和密码并提交，加解密组件通过证书设备中的公钥加密密码，并安全传递给密码服务以反馈给管理服务平台，其中，管理服务平台记录运维人员操作日志并存储该主机对应的加密密码。
步骤S408，加解密组件和证书设备之间需要角度，例如读取信息。
图5为根据本发明实施例的密码变更流程图，密码变更流程主要用于定期更改密码要求或其它一些要求，也是安全管理运维的重要规范要求。具体流程如图5所示：
步骤S502，选择变更的用户名:；
可选地，在步骤S502与S504之间，还可以执行以下过程：确认或设置驱动处理并确定，此时一般是设置变更密码后出发的运行脚本名称，以便配置使得应用能正常运转；也可以不设置。
步骤S504：管理服务台调用客户机加解密组件，利用服务平台中的密码服务进行同样的安全校验后，传递先前的加密用户名和密码，要求变更密码。
步骤S506，加解密组件，利用私钥解密用户名和密码，确认可以解密，然后才显示原先用户名和密码，并要求输入不同的新密码。
步骤S508，运维人员提交新密码，加解密组件通过证书设备中的公钥加密用户名和密码，并将解密后的用户名和先前密码，修改后的密码明文安全传递给安全管理平台中的密码服务。
步骤S510，密码服务修改该主机密码并触发相应的驱动配置处理，其中，在上述步骤执行完成后，管理服务平台保存新的加密密码并记录日志。
需要说明的是，对于正常运维操作，密码服务会向加解密组件查询出真实密码，调用连接工具直接进行有效集成连接，无需输入密码，这里不再阐述。
当碰到旧证书需要更新，或者某些主机需要指派给其它分组运维时，必须进行密码传递，图6为根据本发明实施例的密码传递流程图，具体流程可以按照如图6所示：
步骤S602，运维人员选择传递密码操作包括：传递申请和接收传递。
步骤S604，传递申请或接收传递；
其中，管理服务平台调用安装在客户机上的加解密组件，密码服务向加解密组件查询出解密后密码，并使用自身的公钥进行加密反馈给管理平台临时存储，插入证书，安全登录管理服务平台，选择相应的主机，选择接受对应的传递操作。
步骤S606，密码服务用私钥解密临时存储的加密用户名和密码并向加解密组件申请加密请求，并得到新的加密后的用户名密码。
步骤S608，解密返回或加密返回；
其中，密码服务将新加密信息反馈给管理平台，管理平台保存新的加密密码，并更新传递状态结束。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明并不受所描述的动作顺序的限制，因为依据本发明，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本发明所必需的。
在本实施例中还提供了一种密码管理装置，应用于管理平台，用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述，下面对该装置中涉及到的模块进行说明。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。图7为根据本发明实施例的密码管理装置的结构框图。如图7所示，该装置包括：
接收模块70，设置为接收该管理平台所管辖的终端发送的密码信息；
管理模块72，与接收模块70连接，设置为根据密码信息对终端的密码进行密码管理。
通过上述各个模块的综合作用，管理平台能够根据管理平台所管辖的终端上报的密码信息，进而对密码信息对应的密码进行管理的技术手段，解决了相关技术中，密码管理方式需要维护人员参与而导致的需要较大工作量，影响密码管理效率以及密码管理安全性无法正常保证等问题，进而提供了一种安全的密码管理方式，大大提高了用户体验度。
可选地，接收模块70，设置为接收终端对密码信息进行加密，得到加密的密码信息，其 中，根据终端预先获取的数字证书中携带的公钥对密码信息进行加密。
图8为根据本发明实施例的密码管理装置的另一结构框图，上述装置，还包括：验证模块74，设置为与终端根据数字证书进行相互验证，其中，验证通过后，接收加密的密码信息。
图9为根据本发明实施例的密码管理装置的管理模块72的结构框图，如图9所示，管理模块72，包括：保存单元720，设置为保存密码信息对应的密码，和/或修改单元722，设置为将该管理平台保存的密码修改为接收到的密码信息对应的密码，和/或发送单元724，设置为将保存在本地的密码发送至指定终端。
在本发明实施例中，还提供了一种密码管理系统，图10为根据本发明实施例的密码管理系统的结构框图，如图10所示，包括：管理平台100、终端102，管理平台100，设置为接收该管理平台所管辖的终端102发送的密码信息，并根据密码信息对终端的密码进行密码管理。
通过本发明实施例上述提及的技术方案，管理平台能够根据终端上报的密码信息对密码信息对应的密码进行管理的技术手段，解决了相关技术中，密码管理方式需要维护人员参与而导致的需要较大工作量，影响密码管理效率以及密码管理安全性无法正常保证等问题，进而提供了一种安全的密码管理方式，大大提高了用户体验度，同时方便企业运维管理，减少维护成本，在提高效率的同时，保障密码安全。
需要说明的是，本发明实施例也可根据实际情况和安全要求进行修改，比如加解密可以通过非数字证书方式实现管理，数字证书存放也可以是软证书。本发明实施例所实现的统一密码管理服务是一种新颖的方式，能有效地将各类管理维护平台中的密码管理和运维有效结合起来，大大降低密码管理的复杂性和安全风险，提高运维效率，对数据中心平台建设、企业IT运维等领域建设具有重要意义。
综上所述，本发明实施例达到了以下技术效果：大大减少了运维复杂度、提高了访问效率，同时可以保证密码管理的安全。运维人员无需记住复杂密码、直接以服务和组件的方式提供人机交互接口，满足复杂应用架构设置需求，提供多级保护和异常处理机制，从而为企业节省了大量运维成本，提高了企业应用访问效率和体验，并且，在密码运维过程中，通过密码管理服务实现密码记录和运维，无需记录密码、密码传递也是在后台加密进行，保障了密码泄露和维护的复杂性。
在另外一个实施例中，还提供了一种软件，该软件用于执行上述实施例及优选实施方式中描述的技术方案。
在另外一个实施例中，还提供了一种存储介质，该存储介质中存储有上述软件，该存储介质包括但不限于：光盘、软盘、硬盘、可擦写存储器等。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的对象在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含， 例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
本发明实施例的上述技术方案，可以应用于密码管理过程中，管理平台能够根据终端上报的密码信息对密码信息对应的密码进行管理的技术手段，解决了相关技术中，密码管理方式需要维护人员参与而导致的需要较大工作量，影响密码管理效率以及密码管理安全性无法正常保证等问题，进而提供了一种安全的密码管理方式，大大提高了用户体验度。

Claims (11)

  1. 一种密码管理方法，包括：
    管理平台接收该管理平台所管辖的终端发送的密码信息；
    所述管理平台根据所述密码信息对所述终端的密码进行密码管理。
  2. 根据权利要求1所述的方法，其中，管理平台接收该管理平台所管辖的终端发送的密码信息，包括：
    所述管理平台接收所述终端对所述密码信息进行加密，得到加密的密码信息，其中，根据所述终端预先获取的数字证书中携带的公钥对所述密码信息进行加密。
  3. 根据权利要求2所述的方法，其中，管理平台接收该管理平台所管辖的终端发送的密码信息之前，还包括：
    所述管理平台与所述终端根据数字证书进行相互验证，其中，在验证通过后，所述管理平台接收所述加密的密码信息。
  4. 根据权利要求1所述的方法，其中，所述管理平台根据所述密码信息对所述终端的密码进行密码管理，包括：
    所述管理平台保存所述密码信息对应的密码，和/或
    所述管理平台将该管理平台保存的密码修改为接收到的密码信息对应的密码，和/或
    所述管理平台将保存在本地的密码发送至指定终端。
  5. 根据权利要求4所述的方法，其中，所述管理平台将该管理平台保存的密码修改为接收到的密码信息对应的密码，包括：
    所述管理平台将该管理平台保存的密码发送至所述终端，其中，所述终端根据所述终端预先获取的数字证书中携带的私钥对所述密码进行解密；
    在解密成功后，所述管理平台接收所述终端发送的密码信息，并将该管理平台保存的密码修改为接收到的密码信息对应的密码。
  6. 一种密码管理装置，应用于管理平台，包括：
    接收模块，设置为接收该管理平台所管辖的终端发送的密码信息；
    管理模块，设置为根据所述密码信息对所述终端的密码进行密码管理。
  7. 根据权利要求6所述的装置，其中，所述接收模块，设置为接收所述终端对所述密码信息进行加密，得到加密的密码信息，其中，根据所述终端预先获取的数字证书中携带的公钥对所述密码信息进行加密。
  8. 根据权利要求7所述的装置，其中，所述装置，还包括：
    验证模块，设置为与所述终端根据数字证书进行相互验证，其中，在验证通过后，接收所述加密的密码信息。
  9. 根据权利要求6所述的装置，其中，所述管理模块，包括：
    保存单元，设置为保存所述密码信息对应的密码，和/或
    修改单元，设置为将该管理平台保存的密码修改为接收到的密码信息对应的密码，和/或
    发送单元，设置为将保存在本地的密码发送至指定终端。
  10. 一种密码管理系统，其中，包括：管理平台、终端，
    所述管理平台，设置为接收该管理平台所管辖的终端发送的密码信息，并根据所述密码信息对所述终端的密码进行密码管理。
  11. 一种计算机存储介质，所述计算机存储介质存储有执行指令，所述执行指令用于执行权利要求1至5中任一项所述的方法。
PCT/CN2016/075543 2015-05-15 2016-03-03 密码管理方法及装置、系统 WO2016184221A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510249859.0 2015-05-15
CN201510249859.0A CN106302316A (zh) 2015-05-15 2015-05-15 密码管理方法及装置、系统

Publications (1)

Publication Number Publication Date
WO2016184221A1 true WO2016184221A1 (zh) 2016-11-24

Family

ID=57319361

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/075543 WO2016184221A1 (zh) 2015-05-15 2016-03-03 密码管理方法及装置、系统

Country Status (2)

Country Link
CN (1) CN106302316A (zh)
WO (1) WO2016184221A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110740124A (zh) * 2019-09-20 2020-01-31 平安普惠企业管理有限公司 账户密码分发方法、装置、存储介质和计算机设备
CN110826030A (zh) * 2019-11-08 2020-02-21 湖南长城医疗科技有限公司 一种自助软件和相关模块授权使用方法

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107204974B (zh) * 2017-04-14 2020-12-22 深圳市恒腾网络有限公司 一种用户密码的管理方法及移动终端
CN107506653B (zh) * 2017-07-17 2020-11-24 深圳前海微众银行股份有限公司 密码管理方法、装置和计算机可读存储介质
CN110401529A (zh) * 2019-07-23 2019-11-01 南瑞集团有限公司 一种密码管理方法
CN110691069B (zh) * 2019-09-04 2022-05-17 中体彩科技发展有限公司 终端高权密码的维护管理方法及系统

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101989984A (zh) * 2010-08-24 2011-03-23 北京易恒信认证科技有限公司 电子文件安全共享系统及方法
CN102014133A (zh) * 2010-11-26 2011-04-13 清华大学 在云存储环境下一种安全存储系统的实现方法
CN103237005A (zh) * 2013-03-15 2013-08-07 福建联迪商用设备有限公司 密钥管理方法及系统
CN103595730A (zh) * 2013-11-28 2014-02-19 中国科学院信息工程研究所 一种密文云存储方法和系统
CN103916358A (zh) * 2012-12-30 2014-07-09 航天信息股份有限公司 一种密钥扩散及校验方法和系统
US20140281529A1 (en) * 2013-03-18 2014-09-18 Edward C. Epp Key refresh between trusted units
CN104506483A (zh) * 2014-10-21 2015-04-08 中兴通讯股份有限公司 一种信息加密解密、管理密钥的方法、终端及网络服务器
CN104580487A (zh) * 2015-01-20 2015-04-29 成都信升斯科技有限公司 一种海量数据存储系统及处理方法

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101989984A (zh) * 2010-08-24 2011-03-23 北京易恒信认证科技有限公司 电子文件安全共享系统及方法
CN102014133A (zh) * 2010-11-26 2011-04-13 清华大学 在云存储环境下一种安全存储系统的实现方法
CN103916358A (zh) * 2012-12-30 2014-07-09 航天信息股份有限公司 一种密钥扩散及校验方法和系统
CN103237005A (zh) * 2013-03-15 2013-08-07 福建联迪商用设备有限公司 密钥管理方法及系统
US20140281529A1 (en) * 2013-03-18 2014-09-18 Edward C. Epp Key refresh between trusted units
CN103595730A (zh) * 2013-11-28 2014-02-19 中国科学院信息工程研究所 一种密文云存储方法和系统
CN104506483A (zh) * 2014-10-21 2015-04-08 中兴通讯股份有限公司 一种信息加密解密、管理密钥的方法、终端及网络服务器
CN104580487A (zh) * 2015-01-20 2015-04-29 成都信升斯科技有限公司 一种海量数据存储系统及处理方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110740124A (zh) * 2019-09-20 2020-01-31 平安普惠企业管理有限公司 账户密码分发方法、装置、存储介质和计算机设备
CN110826030A (zh) * 2019-11-08 2020-02-21 湖南长城医疗科技有限公司 一种自助软件和相关模块授权使用方法
CN110826030B (zh) * 2019-11-08 2023-09-15 湖南长城医疗科技有限公司 一种自助软件和相关模块授权使用方法

Also Published As

Publication number Publication date
CN106302316A (zh) 2017-01-04

Similar Documents

Publication Publication Date Title
WO2016184221A1 (zh) 密码管理方法及装置、系统
US10601801B2 (en) Identity authentication method and apparatus
KR102117584B1 (ko) 로컬 디바이스 인증
CN105027107B (zh) 迁移计算资源的计算机实现的方法及计算系统
US9674158B2 (en) User authentication over networks
CN109587101B (zh) 一种数字证书管理方法、装置及存储介质
TWI701929B (zh) 密碼運算、創建工作密鑰的方法、密碼服務平台及設備
US8984295B2 (en) Secure access to electronic devices
CN107800538B (zh) 一种自助设备远程密钥分发方法
US11323274B1 (en) Certificate authority
US9009469B2 (en) Systems and methods for securing data in a cloud computing environment using in-memory techniques and secret key encryption
US20130086381A1 (en) Multi-server authentication token data exchange
US9374360B2 (en) System and method for single-sign-on in virtual desktop infrastructure environment
CN109361508B (zh) 数据传输方法、电子设备及计算机可读存储介质
WO2020042798A1 (zh) 密码运算、创建工作密钥的方法、密码服务平台及设备
CN105337955A (zh) 一种虚拟桌面的管理控制系统和方法
US11363009B2 (en) System and method for providing secure cloud-based single sign-on connections using a security service provider having zero-knowledge architecture
TW201926943A (zh) 資料傳輸方法及系統
KR20230078706A (ko) 포스트 양자 암호화를 사용하는 인증서 기반 보안
US11606193B2 (en) Distributed session resumption
US9237017B2 (en) Lightweight authentication for on-premise rich clients
CN114139176A (zh) 一种基于国密的工业互联网核心数据的保护方法及系统
Moghaddam et al. Applying a single sign-on algorithm based on cloud computing concepts for SaaS applications
US11032708B2 (en) Securing public WLAN hotspot network access
US11888997B1 (en) Certificate manager

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16795708

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16795708

Country of ref document: EP

Kind code of ref document: A1