WO2019114137A1 - 密码调用方法、服务器及存储介质 - Google Patents

密码调用方法、服务器及存储介质 Download PDF

Info

Publication number
WO2019114137A1
WO2019114137A1 PCT/CN2018/077618 CN2018077618W WO2019114137A1 WO 2019114137 A1 WO2019114137 A1 WO 2019114137A1 CN 2018077618 W CN2018077618 W CN 2018077618W WO 2019114137 A1 WO2019114137 A1 WO 2019114137A1
Authority
WO
WIPO (PCT)
Prior art keywords
password
access password
access
service system
management platform
Prior art date
Application number
PCT/CN2018/077618
Other languages
English (en)
French (fr)
Inventor
彭捷
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2019114137A1 publication Critical patent/WO2019114137A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/133—Protocols for remote procedure calls [RPC]

Definitions

  • the present application relates to the field of password management, and in particular, to a password invocation method, a server, and a computer readable storage medium.
  • the enterprise manages the management of the privileged account by using the password decentralized management mode.
  • the administrator of each business system manages the account password of the business system that it is responsible for, and it is extremely inconvenient to manually manage the account password. Therefore, the password management platform came into being, realizing the full automatic management of the company's privileged account password.
  • the passwords of all the business systems of the enterprise are uniformly allocated, managed, and updated by the password management platform.
  • the password is remotely authenticated to the password management platform, and the password of the service system is invoked.
  • the call may fail.
  • the remote call fails, the existing password management platform cannot obtain the password and cannot access the service system.
  • the present application provides a password invoking method, a server, and a computer readable storage medium.
  • the main purpose of the method is to call a locally stored password for decryption and access when the access password of a service system is failed to be remotely invoked to the password management platform.
  • the business system is to call a locally stored password for decryption and access when the access password of a service system is failed to be remotely invoked to the password management platform.
  • a password calling method including:
  • Receiving step receiving a request sent by the client to obtain an access password of a service system
  • Extracting step extracting an access password of the business system stored in the server cache and logging in to the business system;
  • the first determining step determining whether the access password in the cache can be used to enter the service system. If the access to the service system is enabled, the access password is valid, and the process ends. If the service system cannot be entered, the access password is invalid, and the execution is disabled. Second judgment step;
  • the second determining step is: determining whether the password management platform is in an open state. If the password management platform is in the open state, the access password is obtained from the password management platform, and if the password management platform is in the closed state, the configuration file from the local storage device is obtained. Obtaining the access password, and feeding the access password to the client.
  • the method before the step of feeding back the access password to the client, the method further includes:
  • the access password obtained from the password management platform or the configuration file is encrypted. If there is no encryption, the access password is directly fed back to the client. If encrypted, the access password is decrypted by using a preset encryption and decryption rule, and the decrypted password is decrypted. The access password is fed back to the client.
  • the access password is stored in the cache before the access password is fed back to the client.
  • the method further includes:
  • the preset encryption and decryption rule refers to adding or decrypting an access password by using an AES128 algorithm and a key.
  • the method further includes:
  • the access password identifier of each service system forms a one-to-one mapping relationship with the identifier of the service system, and when the server receives the request for obtaining the access password of the service system, according to the The identity of the service system obtains the corresponding access password from the configuration file or cache.
  • the application further provides a server, the server includes: a memory, a processor and a display, wherein the memory stores a password calling program, and the password calling program is executed by the processor, and the following steps can be implemented:
  • Receiving step receiving a request sent by the client to obtain an access password of a service system
  • Extracting step extracting an access password of the business system stored in the server cache and logging in to the business system;
  • the first determining step determining whether the access password in the cache can be used to enter the service system. If the access to the service system is enabled, the access password is valid, and the process ends. If the service system cannot be entered, the access password is invalid, and the execution is disabled. Second judgment step;
  • the second determining step is: determining whether the password management platform is in an open state. If the password management platform is in the open state, the access password is obtained from the password management platform, and if the password management platform is in the closed state, the configuration file from the local storage device is obtained. Obtaining the access password, and feeding the access password to the client.
  • the method further includes:
  • the preset encryption and decryption rule refers to adding or decrypting an access password by using an AES128 algorithm and a key.
  • the present application further provides a computer readable storage medium, where the computer readable storage medium includes a password calling program, and when the password calling program is executed by the processor, the password call as described above may be implemented. Any step in the method.
  • the password calling method, the server and the computer readable storage medium proposed by the application determine the access password of a service system in the cache and the switch state of the password management platform, and if the access password in the cache is invalid and the password management platform switch is turned off The identity is verified, the locally stored password is decrypted, and the access password of the service system is extracted, so that the service system can be used in time.
  • FIG. 1 is a schematic diagram of a preferred embodiment of a server of the present application.
  • FIG. 2 is a block diagram showing a preferred embodiment of the password invoking program of FIG. 1;
  • FIG. 3 is a flowchart of a first embodiment of a method for calling a password according to the present application
  • FIG. 4 is a flowchart of a second embodiment of a method for calling a password according to the present application
  • FIG. 5 is a schematic diagram of an application environment of a password calling method of the present application.
  • FIG. 1 it is a schematic diagram of a preferred embodiment of the server 1 of the present application.
  • the server 1 may be a server, a smart phone, a tablet computer, a personal computer, a portable computer, and other electronic devices having computing functions.
  • the server 1 includes a memory 11, a processor 12, a display 13, a network interface 14, and a communication bus 15.
  • the network interface 14 can optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).
  • Communication bus 15 is used to implement connection communication between these components.
  • the memory 11 includes at least one type of readable storage medium.
  • the at least one type of readable storage medium may be a non-volatile storage medium such as a flash memory, a hard disk, a multimedia card, a card type memory, or the like.
  • the memory 11 may be an internal storage unit of the server 1, such as a hard disk of the server 1.
  • the memory 11 may also be an external storage unit of the server 1, such as a plug-in hard disk equipped on the server 1, a smart memory card (SMC), and a secure digital ( Secure Digital, SD) cards, flash cards (FC cards), etc.
  • the memory 11 can be used not only for storing application software installed in the server 1 and various types of data, such as a password calling program 10, a password in a configuration file, but also for temporarily storing the output. Or the data to be output.
  • the processor 12 in some embodiments, may be a Central Processing Unit (CPU), microprocessor or other data processing chip for running program code or processing data stored in the memory 11, such as executing a password caller. 10 computer program code, etc.
  • CPU Central Processing Unit
  • microprocessor or other data processing chip for running program code or processing data stored in the memory 11, such as executing a password caller. 10 computer program code, etc.
  • Display 13 can be referred to as a display screen or display unit.
  • the display 13 can be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an Organic Light-Emitting Diode (OLED) touch sensor.
  • the display 13 is used to display information processed in the server 1 and a work interface for displaying visualizations, such as a key input page displaying encryption or decryption.
  • the server 1 may further include a user interface
  • the user interface may include an input unit such as a keyboard, a voice output device such as an audio, a headphone, etc., and optionally the user interface may further include a standard wired interface and a wireless interface.
  • the program code of the password calling program 10 is stored in the memory 11 as a computer storage medium, and when the processor 12 executes the program code of the password calling program 10, the following steps are implemented:
  • Receiving step receiving a request sent by the client to obtain an access password of a business system.
  • the server 1 finds the secret key input page of the service system and inputs the secret key, and the server 1 receives the client's request for obtaining the access password of the service system, and runs the password.
  • Call program 10 For example, when a manager of a business system inside Ping An Bank needs to access the business system, find the key input page of the business system, input the secret key of the business system, and the server 1 receives the request of the client to obtain the access password of the business system. .
  • the extracting step extracting the access password of the business system stored in the server cache and logging in to the business system.
  • the access password of the service system is extracted from the cache of the server 1 and registered in the service system.
  • the cache refers to a buffer for data exchange.
  • the access password of the service system is stored in the cache for a short time. If the service system is not accessed for a long time, the service system is cached. Access passwords are automatically deleted to prevent system cache from being used. Therefore, the server 1 first extracts the access password login service system of the service system in the cache.
  • the first determining step determining whether the access password in the cache can be used to enter the service system. If the access to the service system is enabled, the access password is valid, and the process ends. If the service system cannot be entered, the access password is invalid, and the execution is disabled. Second judgment step.
  • the server 1 determines whether the access password of the service system in the cache can be used to enter the service system. If the business system can be entered, the access password is valid. If the service system cannot be entered, the access password is invalid, and the second determining step is performed. The access password is invalid because the access password has been automatically deleted by the cache, and the password management platform has updated the access password. Since the information and information of the enterprise are very confidential, in order to prevent the data information from being stolen, the access password of the business system is modified every month, every 15 days, even every time, and the modification and update of the access password is performed by the password management platform. Automatically completed. For example, it is determined whether the access password of a certain service system in the server cache can enter the service system corresponding to the Ping An Bank. If the login enters the service system, the access password is valid. If the corresponding access password is not found or the login fails, the cache is cached. The access password has been deleted or the access password has been modified to perform the next step.
  • the second determining step is: determining whether the password management platform is in an open state. If the password management platform is in the open state, the access password is obtained from the password management platform, and if the password management platform is in the closed state, the configuration file from the local storage device is obtained. Obtaining the access password, and feeding the access password to the client.
  • the password invoicing program 10 determines whether the password management platform is in an open state. If the password management platform is enabled, the access password is obtained remotely from the password management platform. If the password management platform is down, obtain the access password from the configuration file of the local storage device. Among them, whether the password management platform is turned on is judged by the value of a field stored in the database. For example, the password invoking program determines that the value of the field stored in the database indicating that the CyberArk password management platform is turned on or off is Y, indicating that the CyberArk password management platform is turned on, and the password invoking program remotely calls the access password from the CyberArk password management platform.
  • the password management platform is mainly responsible for automatic management of the account and automatic update of the password.
  • the access password is obtained from the configuration file of the local storage device.
  • the local storage device refers to a local storage unit of the server 1, such as a hard disk.
  • the obtained access password is fed back to the client to access the business system. For example, when the field value of the open or closed state of the CyberArk password management platform is N, the access password obtained in the configuration file of the local storage device is fed back to the client to access the service system.
  • the configuration file of the local storage may further store passwords of multiple service systems, and assign identifiers to passwords of each service system, and use the identifiers to form a one-to-one mapping relationship between passwords of each service system and the system.
  • the passwords of the three service systems A, B, and C are stored in the configuration file, and the password assignment identifiers of the three service systems A, B, and C are 01, 02, and 03 respectively, forming a mapping relationship.
  • the password with the ID of 01 is obtained according to the mapping relationship.
  • the method for assigning identifiers in the cache is similar to this, and will not be described here.
  • the password calling method in the foregoing embodiment determines whether the access password in the cache is valid by receiving a request for the client to obtain an access password of the service system. If the access password is valid, the access password is extracted to access the service system. If the access password is invalid, it is judged whether the password management platform can be called. If it can be called, the password management platform is called to obtain the access password feedback to the client. If it cannot be called, the access password in the configuration file is obtained and fed back to the client to enter the service. The system, thus preventing the remote call of the password management platform from failing to use the business system in time.
  • FIG. 2 is a block diagram of a preferred embodiment of the password invoking program of FIG. 1.
  • a module as referred to in this application refers to a series of computer program instructions that are capable of performing a particular function.
  • the password calling program 10 includes: a receiving module 110, an extracting module 120, a determining module 130, a calling module 140, an obtaining module 150, an encryption and decryption module 160, and a feedback module 170, which are implemented by the modules 110-170.
  • the functions or operational steps are similar to the above, and are not described in detail here, exemplarily, for example:
  • the receiving module 110 is configured to receive a request for the client to obtain an access password of a service system.
  • the extracting module 120 extracts an access password of the service system stored in the server cache and logs in to the service system;
  • the determining module 130 is configured to determine whether the access password in the cache is used to enter the service system or determine whether the password management platform is in an open state and determine whether the password is encrypted.
  • the calling module 140 is configured to remotely acquire an access password from the password management platform
  • the obtaining module 150 is configured to obtain an access password from a configuration file of the local storage device.
  • the encryption and decryption module 160 is configured to encrypt or decrypt the access password to obtain an encrypted or unencrypted access password
  • the feedback module 170 is configured to feed back the decrypted password to the client.
  • FIG. 3 it is a flowchart of the first embodiment of the password calling method of the present application.
  • the password invoking method when the processor 12 executes the computer program of the password calling program 10 stored in the memory 11, the password invoking method includes: Step S10 - Step S70:
  • Step S10 is a schematic diagram of an application environment of the password calling method of the present application.
  • the page of the service system 5 is found in the server 1, and the application enters the service system.
  • the receiving module 110 receives the request of the client 3 to obtain the access password of the service system 5, and runs the password.
  • Call program 10 For example, when a manager of a business system inside the Ping An Bank needs to access the service system, find a page of the service system and apply to enter the service system, and the receiving module 110 receives a request for the client to obtain an access password of the service system.
  • step S20 after the password invoicing program 10 is run, the extraction module 120 extracts the access password of the service system 5 from the cache of the server 1 and logs in to the service system 5.
  • the cache refers to a buffer for data exchange.
  • the access password of the service system 5 is stored in the cache for a short time. If the service system 5 is not accessed for a long time, the cache is used. The access password of the service system 5 is automatically deleted to prevent the system cache from being occupied. Therefore, the extraction module 120 first extracts the access password login service system 5 of the service system 5 in the cache.
  • step S30 the determining module 130 determines whether the access password of the service system 5 in the cache can be used to enter the service system 5. If the business system 5 can be entered, the access password is valid. If the service system 5 cannot be accessed, the access password is invalid, and step S40 is performed. The access password is invalid because the access password has been automatically deleted by the cache, and the password management platform 4 has updated the access password. Since the information and information of the enterprise are very confidential, in order to prevent the data information from being stolen, the access password of the business system 5 is modified every month, every 15 days, or even once, and the modification and update of the access password is managed by the password. Platform 4 is done automatically.
  • the access password of a certain service system 5 in the server cache can enter the service system 5 corresponding to the Ping An Bank. If the login enters the service system 5, the access password is valid, and if the corresponding access password is not found or the login fails, If the cache has deleted the access password or the access password has been modified, perform the next step.
  • step S40 when the access password in the cache is invalid, the determining module 120 determines whether the password management platform 4 is in an open state. If the password management platform 4 is in the on state, step S50 is performed. If the password management platform 4 is in the off state, step S60 is performed. Whether the password management platform 4 is in the open state is determined by the value of a field stored in the database.
  • the determining module 120 determines that the value of the field stored in the database indicating that the CyberArk password management platform is turned on or off is Y, indicating that the CyberArk password management platform is in an open state, and the determining module 120 determines that the stored in the database indicates that the CyberArk password management platform is turned on or The value of the closed state field is N, indicating that the CyberArk password management platform is down.
  • the password management platform 4 refers to a password management platform such as CyberArk, and is mainly responsible for automatic management of accounts and automatic updating of passwords.
  • step 50 the calling module 140 remotely calls the access password from the password management platform 4.
  • the calling module 140 calls the access password of the business system from the CyberArk password management platform.
  • step S60 when the determining module 130 determines that the field value indicating that the password management platform 4 is turned on or off in the database is N, the obtaining module 150 obtains the access password from the configuration file of the local storage device.
  • the local storage device refers to a local storage unit of the server 1, such as a hard disk.
  • the access password obtained in the configuration file of the local storage device is fed back to the client to access the service system.
  • the configuration file of the local storage may further store passwords of the plurality of service systems 5, and assign identifiers to the passwords of each service system 5, and use the identifiers to form a one-to-one correspondence between the passwords of each service system 5 and the system. Mapping relationship.
  • the passwords of the three service systems A, B, and C are stored in the configuration file, and the password assignment identifiers of the three service systems A, B, and C are 01, 02, and 03 respectively, forming a mapping relationship.
  • the password with the ID of 01 is obtained according to the mapping relationship.
  • the method for assigning identifiers in the cache is similar to this, and will not be described here.
  • step S70 the feedback module 170 feeds back the obtained access password to the client 3 and accesses the service system 5.
  • the feedback module 170 sends the access password to the client 3, and the user logs in to the service system using the access password to process the service. For example, after the management personnel of a certain business system inside the Ping An Bank receive the access password of the business system, they log in to the business system.
  • the password calling method in the foregoing embodiment determines whether the access password of the service system in the cache is valid after the client obtains the access password request of the service system, and if the cached access password is valid, the access password in the cache is used. Feedback to the client, if the cached access password is invalid, it is judged whether the password management platform can be remotely called. If it can be called, the password management platform is called to obtain the access password. If it cannot be called, the access password in the configuration file is obtained, and finally The access password is fed back to the client, thereby preventing the remote call of the password management platform from failing and failing to use the business system in time.
  • a second embodiment of the password invocation method is proposed based on the first embodiment. As shown in FIG. 4, when the processor 12 executes the computer program of the password calling program 10 stored in the memory 11, the following steps are implemented to implement the password calling method:
  • Step S10 - Step S120 The steps S10 to S60 and the step S120 are the same as those in the first embodiment, and details are not described herein again.
  • step S70 when the calling module 140 calls the access password of the service system 5 from the password management platform 4, the determining module 130 determines whether the access password obtained from the password management platform 4 is the same as the access password in the configuration file, and if not, Then, the password management platform 4 has updated the access password of the service system, and step S80 is performed.
  • the password management platform 4 updates the access password
  • the new access password is stored in the configuration file of the local storage device. If the access password obtained from the password management platform 4 is different from the access password in the configuration file, the password management platform 4 has not updated the new access password to the configuration of the local storage device when the access password of the password management platform 4 is invoked. In the file.
  • Step S80 the encryption and decryption module 160 saves the new access password of the service system 5 in the password management platform 4 to the configuration file of the local storage device, and encrypts the updated access password, and at the same time, the key is preset. Ways, such as SMS or email, are sent to the client.
  • the AES128 method is used to encrypt the new access password and store it in a locally stored configuration file.
  • the AES128 method has different encryption modes for accessing password encryption, such as an electronic codebook (ECB) mode, a Cipher-block chaining (CBC) mode, and a Cipher feedback (Cipher feedback, CFB). ) mode, output feedback (OFB) mode, etc.
  • EFB electronic codebook
  • CBC Cipher-block chaining
  • OFB output feedback
  • the ECB mode refers to dividing a 16-byte (or 128-bit) access password into small blocks, encrypting each small block access password separately using the same key, and finally encrypting each encrypted access password according to the split.
  • the order is synthesized by the encrypted access password.
  • the access password is not a multiple of 16, the data is padded to a multiple of 16, including: NoPadding, PKCS5Padding, ISO10126Padding, PaddingMode.Zeros, PaddingMode.PKCS7.
  • the access password that needs to be encrypted is ⁇ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ⁇ .
  • the access password after padding is ⁇ 1, 2, 3, 4,5,6,7,8,9,10,0,0,0,0,0 ⁇ .
  • the encryption may also be to assign two different keys, and after encrypting the first key pair separately for each small block access password, use the second key to once again encrypt the encrypted small block.
  • the access password is used for secondary encryption, and then the encrypted small block password is synthesized into the encrypted password in the order before the division.
  • the CES mode can also be used to encrypt the password using the AES128 method.
  • the CBC mode refers to dividing a password into a plurality of cipher blocks, each cipher block is XORed with the previous cipher block before being encrypted with the key, and then encrypted.
  • the first cipher block is XORed with the initial vector (IV) and then encrypted.
  • step S90 after the obtaining module 150 obtains the access password from the configuration file of the password management platform 4 or the local storage device, the determining module 130 determines whether the access password is encrypted. If the access password is not encrypted, step S110 is performed, and if the access password is encrypted, step S100 is performed, and step S110 is performed.
  • the determining whether the access password is encrypted refers to determining whether the acquired password is encrypted by using an AES128 method or other algorithms. For example, if the obtained access password is input to the corresponding service system, if the access to the service system is entered, the access password is not encrypted. If the access to the service system is not available, the access password is not encrypted.
  • step S100 the encryption and decryption module 160 decrypts the access password by using the key.
  • the decryption refers to performing an inverse AES128 mode operation on the encrypted access password by using a key. Similar to encryption, it will not be described here.
  • step S110 the feedback module 170 stores the unencrypted access password into the cache, and the client 3 extracts the access password in the cache to access the service system 5.
  • the cache records the storage time of each access password. When an access password is stored in the cache for more than a certain period of time and is called, the access password stored in the cache is automatically deleted, thereby reducing the buffer burden. For example, the storage time of the access password stored in the cache is set to 24 hours. When an access password in the cache is not called within 24 hours, the cache automatically deletes the access password.
  • the password calling method in this embodiment determines whether the access password is encrypted after obtaining the access password from the configuration file of the password management platform or the local storage device, and decrypts the encrypted access password and stores the password. In the cache, and then feedback to the client, the password management is more comprehensive, and the password protection is more secure.
  • the embodiment of the present application further provides a computer readable storage medium, where the computer readable storage medium includes a password calling program 10, and when the password calling program 10 is executed by the processor, the following operations are implemented:
  • Receiving step receiving a request sent by the client to obtain an access password of a service system
  • Extracting step extracting an access password of the business system stored in the server cache and logging in to the business system;
  • the first determining step determining whether the access password in the cache can be used to enter the service system. If the access to the service system is enabled, the access password is valid, and the process ends. If the service system cannot be entered, the access password is invalid, and the execution is disabled. Second judgment step;
  • the second determining step is: determining whether the password management platform is in an open state. If the password management platform is in the open state, the access password is obtained from the password management platform, and if the password management platform is in the closed state, the configuration file from the local storage device is obtained. Obtaining the access password, and feeding the access password to the client.
  • the method before the step of feeding back the access password to the client, the method further includes:
  • the access password obtained from the password management platform or the configuration file is encrypted. If there is no encryption, the access password is directly fed back to the client. If encrypted, the access password is decrypted by using a preset encryption and decryption rule, and the decrypted password is decrypted. The access password is fed back to the client.
  • the access password is stored in the cache before the access password is fed back to the client.
  • the method further includes:
  • the preset encryption and decryption rule refers to adding or decrypting an access password by using an AES128 algorithm and a key.
  • the method further includes:
  • the access password identifier of each service system forms a one-to-one mapping relationship with the identifier of the service system, and when the server receives the request for obtaining the access password of the service system, according to the The identity of the service system obtains the corresponding access password from the configuration file or cache.
  • the technical solution of the present application which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM as described above). , a disk, an optical disk, including a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the methods described in the various embodiments of the present application.
  • a terminal device which may be a mobile phone, a computer, a server, or a network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种密码调用方法、服务器及存储介质，该方法包括：接收客户端获取某业务系统的访问密码的请求；提取服务器缓存中存储的该业务系统的访问密码登录该业务系统；判断能否使用缓存中的访问密码进入该业务系统，若能进入该业务系统，则说明访问密码有效，流程结束，若不能进入该业务系统，则说明访问密码失效，判断密码管理平台是否为开启状态，若密码管理平台为开启状态，则从密码管理平台调用获取所述访问密码，若密码管理平台为关闭状态，则从本地存储设备的配置文件中获取所述访问密码，将所述访问密码反馈给客户端，从而能够灵活调用业务系统的访问密码。

Description

密码调用方法、服务器及存储介质
优先权申明
本申请要求于2017年12月13日提交中国专利局、申请号为201711323477.3，名称为“密码调用方法、服务器及存储介质”的中国专利申请的优先权，该中国专利申请的整体内容以参考的方式结合本申请中。
技术领域
本申请涉及密码管理领域，尤其涉及一种密码调用方法、服务器及计算机可读存储介质。
背景技术
在企业的运营管理中，企业对于特权账号的管理使用密码分散管理方式进行管理，各个业务系统的管理员管理其所负责的业务系统的账号密码，手动进行账号密码管理极其不便。因此，密码管理平台应运而生，实现了企业的特权账号密码的全面自动化管理。一般地，企业的所有业务系统的密码由密码管理平台统一负责分配、管理及更新，当用户需要访问某业务系统时，向密码管理平台远程进行身份验证，调用该业务系统的密码。但是，向密码管理平台远程调用业务系统密码的过程中，可能会出现调用失败的情况，现有的密码管理平台在远程调用失败时，用户无法获取密码，无法访问业务系统。
发明内容
鉴于以上内容，本申请提供一种密码调用方法、服务器及计算机可读存储介质，其主要目的是向密码管理平台远程调用某业务系统的访问密码失败时，能够调用本地存储的密码进行解密，访问该业务系统。
为实现上述目的，本申请提供一种密码调用方法，该方法包括：
接收步骤：接收客户端发送的获取某业务系统的访问密码的请求；
提取步骤：提取服务器缓存中存储的该业务系统的访问密码登录该业务系统；
第一判断步骤：判断能否使用缓存中的访问密码进入该业务系统，若能进入该业务系统，则说明访问密码有效，流程结束，若不能进入该业务系统，则说明访问密码失效，执行第二判断步骤；
第二判断步骤：判断密码管理平台是否为开启状态，若密码管理平台为开启状态，则从密码管理平台调用获取所述访问密码，若密码管理平台为关闭状态，则从本地存储设备的配置文件中获取所述访问密码，将所述访问密码反馈给客户端。
优选地，所述将所述访问密码反馈给客户端的步骤之前，所述方法还包括：
判断从密码管理平台或配置文件中获取的访问密码是否加密，若没有加密，则直接将访问密码反馈给客户端，若加密，则利用预设的加解密规则对访问密码进行解密，将解密后的访问密码反馈给客户端。
优选地，所述将访问密码反馈给客户端之前，将访问密码存储到缓存中。
优选地，所述方法还包括：
判断从密码管理平台获取的访问密码与配置文件中的访问密码是否相同，若不相同，则以从密码管理平台获取的访问密码更新配置文件中的访问密码，并对更新后的访问密码进行加密处理。
优选地，所述预设的加解密规则是指利用AES128算法和密钥对访问密码进行加或解密。
优选地，所述方法还包括：
为每个业务系统的访问密码分配标识，每个业务系统的访问密码标识与该业务系统的标识形成一一对应的映射关系，当服务器接收到获取该业务系统的访问密码的请求时，根据该业务系统的标识从配置文件或缓存中获取对应的访问密码。
此外，本申请还提供一种服务器，该服务器包括：存储器、处理器及显示器，所述存储器上存储密码调用程序，所述密码调用程序被所述处理器执行，可实现如下步骤：
接收步骤：接收客户端发送的获取某业务系统的访问密码的请求；
提取步骤：提取服务器缓存中存储的该业务系统的访问密码登录该业务 系统；
第一判断步骤：判断能否使用缓存中的访问密码进入该业务系统，若能进入该业务系统，则说明访问密码有效，流程结束，若不能进入该业务系统，则说明访问密码失效，执行第二判断步骤；
第二判断步骤：判断密码管理平台是否为开启状态，若密码管理平台为开启状态，则从密码管理平台调用获取所述访问密码，若密码管理平台为关闭状态，则从本地存储设备的配置文件中获取所述访问密码，将所述访问密码反馈给客户端。
优选地，所述方法还包括：
判断从密码管理平台获取的访问密码与配置文件中的访问密码是否相同，若不相同，则以从密码管理平台获取的访问密码更新配置文件中的访问密码，并对更新后的访问密码进行加密处理。
优选地，所述预设的加解密规则是指利用AES128算法和密钥对访问密码进行加或解密。
此外，为实现上述目的，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中包括密码调用程序，所述密码调用程序被处理器执行时，可实现如上所述密码调用方法中的任意步骤。
本申请提出的密码调用方法、服务器及计算机可读存储介质，对缓存中某业务系统的访问密码和密码管理平台开关状态进行判断，在缓存中的访问密码失效且密码管理平台开关关闭的情况下验证身份，对本地存储的密码进行解密，提取出该业务系统的访问密码，从而能够及时地使用业务系统。
附图说明
图1为本申请服务器较佳实施例的示意图；
图2为图1中密码调用程序较佳实施例的模块示意图；
图3为本申请密码调用方法第一实施例的流程图；
图4为本申请密码调用方法第二实施例的流程图；
图5为本申请密码调用方法的应用环境示意图。
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
如图1所示，是本申请服务器1较佳实施例的示意图。
在本实施例中，服务器1可以是服务器、智能手机、平板电脑、个人电脑、便携计算机以及其他具有运算功能的电子设备。
该服务器1包括：存储器11、处理器12、显示器13、网络接口14及通信总线15。其中，网络接口14可选地可以包括标准的有线接口、无线接口(如WI-FI接口)。通信总线15用于实现这些组件之间的连接通信。
存储器11至少包括一种类型的可读存储介质。所述至少一种类型的可读存储介质可为如闪存、硬盘、多媒体卡、卡型存储器等的非易失性存储介质。在一些实施例中，所述存储器11可以是所述服务器1的内部存储单元，例如该服务器1的硬盘。在另一些实施例中，所述存储器11也可以是所述服务器1的外部存储单元，例如所述服务器1上配备的插接式硬盘，智能存储卡(Smart Media Card,SMC)，安全数字(Secure Digital,SD)卡，闪存卡(Flash Card,FC)等。
在本实施例中，所述存储器11不仅可以用于存储安装于所述服务器1的应用软件及各类数据，例如密码调用程序10、配置文件中的密码，还可以用于暂时地存储已经输出或者将要输出的数据。
处理器12在一些实施例中可以是一中央处理器(Central Processing Unit,CPU)，微处理器或其它数据处理芯片，用于运行存储器11中存储的程序代码或处理数据，例如执行密码调用程序10的计算机程序代码等。
显示器13可以称为显示屏或显示单元。在一些实施例中显示器13可以是LED显示器、液晶显示器、触控式液晶显示器以及有机发光二极管(Organic Light-Emitting Diode,OLED)触摸器等。显示器13用于显示在服务器1中处理的信息以及用于显示可视化的工作界面，如：显示加密或解密的密钥输入页面。
优选地，该服务器1还可以包括用户接口，用户接口可以包括输入单元比如键盘(Keyboard)、语音输出装置比如音响、耳机等，可选地用户接口还可以包括标准的有线接口、无线接口。
在图1所示的服务器实施例中，作为一种计算机存储介质的存储器11中存储密码调用程序10的程序代码，处理器12执行密码调用程序10的程序代码时，实现如下步骤：
接收步骤：接收客户端发送的获取某业务系统的访问密码的请求。
本实施例中，当客户端需要访问某业务系统时，在服务器1中找到该业务系统的秘钥输入页面并输入秘钥，服务器1接收客户端获取该业务系统的访问密码的请求，运行密码调用程序10。例如，平安银行内部某业务系统的管理人员需要访问该业务系统时，找到该业务系统的秘钥输入页面，输入该业务系统的秘钥，服务器1接收客户端获取该业务系统的访问密码的请求。
提取步骤：提取服务器缓存中存储的该业务系统的访问密码登录该业务系统。
本实施例中，该密码调用程序10运行后，从服务器1的缓存中提取该业务系统的访问密码并登录该业务系统。其中所述缓存是指数据交换的缓冲区，前期访问业务系统时，业务系统的访问密码在短时间内存留在缓存上的密码，若长时间没有访问该业务系统，则缓存上该业务系统的访问密码自动被删除，防止占用系统缓存。因此，服务器1先提取缓存中该业务系统的访问密码登录业务系统。
第一判断步骤：判断能否使用缓存中的访问密码进入该业务系统，若能进入该业务系统，则说明访问密码有效，流程结束，若不能进入该业务系统，则说明访问密码失效，执行第二判断步骤。
本实施例中，服务器1判断能否使用缓存中该业务系统的访问密码进入该业务系统。如果可以进入该业务系统，说明该访问密码有效。如果不能进入该业务系统，则说明访问密码失效，执行第二判断步骤。其中，所述访问密码失效一方面是由于该访问密码已被缓存自动删除，另一方面是由于密码管理平台已更新该访问密码。由于企业的资料、信息是非常机密的，为了防止资料信息被盗取，业务系统的访问密码每个月、每15天，甚至每用一次就要 修改，访问密码的修改更新是由密码管理平台自动完成的。例如，判断服务器缓存中某业务系统的访问密码能否进入平安银行对应的业务系统，若登录进入该业务系统，则说明访问密码有效，若找不到对应的访问密码或登录失败，则说明缓存已删除该访问密码或访问密码已修改，执行下一步骤。
第二判断步骤：判断密码管理平台是否为开启状态，若密码管理平台为开启状态，则从密码管理平台调用获取所述访问密码，若密码管理平台为关闭状态，则从本地存储设备的配置文件中获取所述访问密码，将所述访问密码反馈给客户端。
本实施例中，当缓存中的访问密码失效时，密码调用程序10判断密码管理平台是否为开启状态。如果密码管理平台为开启状态，从密码管理平台远程调用获取访问密码。如果密码管理平台为关闭状态，从本地存储设备的配置文件中获取访问密码。其中，密码管理平台是否为开启状态是通过存储在数据库中的一个字段的值判断的。例如，密码调用程序判断存储在数据库中表示CyberArk密码管理平台开启或关闭状态的字段的值为Y，说明CyberArk密码管理平台为开启状态，密码调用程序从CyberArk密码管理平台远程调用获取访问密码。其中，所述密码管理平台主要负责账号的自动化管理与密码的自动更新。
当密码调用程序10判断数据库中表示密码管理平台开启或关闭状态的字段值为N时，从本地存储设备的配置文件中获取访问密码。所述本地存储设备指该服务器1的本地存储单元，如硬盘。最后将获取的访问密码反馈给客户端，进入该业务系统访问。例如，表示CyberArk密码管理平台开启或关闭状态的字段值为N时，将本地存储设备的配置文件中获取的访问密码，反馈给客户端访问该业务系统。进一步地，所述本地存储器的配置文件还可以存储多个业务系统的密码，并为每个业务系统的密码分配标识，利用标识将每个业务系统的密码与该系统形成一一对应的映射关系。例如，配置文件中存储分别存储了A、B和C三个业务系统的密码，为A、B、C三个业务系统的密码分配标识分别为01、02、03，形成映射关系，当需要获取A业务系统的密码时，根据映射关系获取标识为01的密码。缓存中的标识分配方法与此类似，在此不再赘述。
上述实施例提出的密码调用方法，通过接收客户端获取某业务系统的访 问密码的请求，判断缓存中的访问密码是否有效，若访问密码有效，则提取该访问密码对该业务系统进行访问，若访问密码无效，则判断密码管理平台是否可以调用，若可以调用，则调用密码管理平台获取访问密码反馈给客户端，若无法调用，则获取配置文件中的访问密码反馈给客户端，进入该业务系统，从而防止密码管理平台远程调用失败，无法及时使用业务系统。
如图2所示，是图1中密码调用程序较佳实施例的模块示意图。本申请所称的模块是指能够完成特定功能的一系列计算机程序指令段。
在本实施例中，密码调用程序10包括：接收模块110、提取模块120、判断模块130、调用模块140、获取模块150、加解密模块160、反馈模块170，所述模块110-170所实现的功能或操作步骤均与上文类似，此处不再详述，示例性地，例如其中：
接收模块110，用于接收客户端获取某业务系统的访问密码的请求；
提取模块120，提取服务器缓存中存储的该业务系统的访问密码登录该业务系统；
判断模块130，用于判断能否使用缓存中的访问密码进入该业务系统或判断密码管理平台是否为开启状态及判断密码是否加密；
调用模块140，用于从密码管理平台远程调用获取访问密码；
获取模块150，用于从本地存储设备的配置文件中获取访问密码；
加解密模块160，用于将访问密码进行加密或解密，得到加密或没有加密的访问密码；
反馈模块170，用于将解密后的密码反馈给客户端。
如图3所示，是本申请密码调用方法第一实施例的流程图。
在本实施例中，处理器12执行存储器11中存储的密码调用程序10的计算机程序时实现密码调用方法包括：步骤S10-步骤S70：
步骤S10，如图5所示，是本申请密码调用方法的应用环境示意图。当客户端3需要访问某业务系统5时，在服务器1中找到该业务系统5的页面，申请进入该业务系统，接收模块110接收客户端3获取该业务系统5的访问密码的请求，运行密码调用程序10。例如，平安银行内部某业务系统的管理人员需要 访问该业务系统时，找到该业务系统的页面，申请进入该业务系统，接收模块110接收客户端获取该业务系统的访问密码的请求。
步骤S20，该密码调用程序10运行后，提取模块120从服务器1的缓存中提取该业务系统5的访问密码并登录该业务系统5。其中所述缓存是指数据交换的缓冲区，前期访问业务系统5时，业务系统5的访问密码在短时间内存留在缓存上的密码，若长时间没有访问该业务系统5，则缓存上该业务系统5的访问密码自动被删除，防止占用系统缓存。因此，提取模块120先提取缓存中该业务系统5的访问密码登录业务系统5。
步骤S30，判断模块130判断能否使用缓存中该业务系统5的访问密码进入该业务系统5。如果可以进入该业务系统5，说明该访问密码有效。如果不能进入该业务系统5，则说明访问密码失效，执行步骤S40。其中，所述访问密码失效一方面是由于该访问密码已被缓存自动删除，另一方面是由于密码管理平台4已更新该访问密码。由于企业的资料、信息是非常机密的，为了防止资料信息被盗取，业务系统5的访问密码每个月、每15天，甚至每用一次就要修改，访问密码的修改更新是由密码管理平台4自动完成的。例如，判断服务器缓存中某业务系统5的访问密码能否进入平安银行对应的业务系统5，若登录进入该业务系统5，则说明访问密码有效，若找不到对应的访问密码或登录失败，则说明缓存已删除该访问密码或访问密码已修改，执行下一步骤。
步骤S40，当缓存中的访问密码失效时，判断模块120判断密码管理平台4是否为开启状态。如果密码管理平台4为开启状态，执行步骤S50。如果密码管理平台4为关闭状态，执行步骤S60。其中，密码管理平台4是否为开启状态是通过存储在数据库中的一个字段的值判断的。例如，判断模块120判断存储在数据库中表示CyberArk密码管理平台开启或关闭状态的字段的值为Y，说明CyberArk密码管理平台为开启状态，判断模块120判断存储在数据库中表示CyberArk密码管理平台开启或关闭状态的字段的值为N，说明CyberArk密码管理平台为关闭状态。其中，所述密码管理平台4是指如CyberArk等密码管理平台，主要负责账号的自动化管理与密码的自动更新。
步骤50，调用模块140从密码管理平台4远程调用获取访问密码。例如，当CyberArk密码管理平台为开启状态时，调用模块140从CyberArk密码管理平台调用出该业务系统的访问密码。
步骤S60，当判断模块130判断数据库中表示密码管理平台4开启或关闭状态的字段值为N时，获取模块150从本地存储设备的配置文件中获取访问密码。所述本地存储设备指该服务器1的本地存储单元，如硬盘。例如，表示CyberArk密码管理平台开启或关闭状态的字段值为N时，将本地存储设备的配置文件中获取的访问密码，反馈给客户端访问该业务系统。进一步地，所述本地存储器的配置文件还可以存储多个业务系统5的密码，并为每个业务系统5的密码分配标识，利用标识将每个业务系统5的密码与该系统形成一一对应的映射关系。例如，配置文件中存储分别存储了A、B和C三个业务系统的密码，为A、B、C三个业务系统的密码分配标识分别为01、02、03，形成映射关系，当需要获取A业务系统的密码时，根据映射关系获取标识为01的密码。缓存中的标识分配方法与此类似，在此不再赘述。
步骤S70，反馈模块170将获取的访问密码反馈给客户端3，进入该业务系统5访问。获取模块150获取该业务系统的访问密码后，反馈模块170将访问密码发送给客户端3，用户使用访问密码登录进入该业务系统，处理业务。例如，平安银行内部某业务系统的管理人员收到该业务系统的访问密码后，登录进入该业务系统。
上述实施例提出的密码调用方法，通过在客户端获取某业务系统的访问密码的请求后，判断缓存中该业务系统的访问密码是否有效，若缓存的访问密码有效，则将缓存中的访问密码反馈给客户端，若缓存的访问密码失效，则判断密码管理平台是否能够远程调用，若可以调用，则调用密码管理平台获取访问密码，若无法调用，则获取配置文件中的访问密码，最后将访问密码反馈给客户端，从而防止密码管理平台远程调用失败，无法及时使用业务系统。
基于第一实施例提出密码调用方法的第二实施例。如图4所示，处理器12执行存储器11中存储的密码调用程序10的计算机程序时实现密码调用方法的如下步骤：
步骤S10-步骤S120。其中，步骤S10-步骤S60、步骤S120与第一实施例中内容相同，这里不再赘述。
步骤S70，当调用模块140从密码管理平台4调用获取某业务系统5的访问 密码时，判断模块130判断从密码管理平台4获取的访问密码与配置文件中的访问密码是否相同，若不相同，则说明密码管理平台4已经更新了该业务系统的访问密码，执行步骤S80。其中，所述密码管理平台4更新访问密码时，都会将新的访问密码存入本地存储设备的配置文件中。若从密码管理平台4获取的访问密码与配置文件中的访问密码不同，则说明在调用密码管理平台4的访问密码时，密码管理平台4还没将新的访问密码更新至本地存储设备的配置文件中。
步骤S80，加解密模块160将密码管理平台4中该业务系统5的新访问密码保存到本地存储设备的配置文件，并对更新后的访问密码进行加密处理，同时，将密钥以预设的方式，如短信或邮箱等方式，发送至客户端。例如，利用AES128方式对新访问密码进行加密，存入本地存储的配置文件中。其中，所述利用AES128方式对访问密码加密有不同的加密模式，如电子密码本(Electronic codebook,ECB)模式、密码分组链接(Cipher-block chaining,CBC)模式、密文反馈(Cipher feedback,CFB)模式、输出反馈(Output feedback,OFB)模式等。其中，ECB模式是指将16字节(或128比特)的访问密码分成若干小块，将每小块访问密码使用相同的密钥单独加密，最后将加密后的每小块访问密码按照分割前的顺序合成加密后的访问密码。其中，在加密过程中，若访问密码不是16的倍数，则将数据进行填充到16的倍数，所述填充方式包括：NoPadding，PKCS5Padding,ISO10126Padding，PaddingMode.Zeros，PaddingMode.PKCS7。例如，需要加密的访问密码为{1,2,3,4,5,6,7,8,9,10}，利用PaddingMode.Zeros填充方式，则填充后访问密码为{1,2,3,4,5,6,7,8,9,10,0,0,0,0,0,0}。进一步地，所述的加密还可以是分配两个不同的密钥，在将第一个密钥对每个小块访问密码单独加密后，使用第二个密钥再一次对加密后的小块访问密码进行二次加密，然后将加密后的每小块密码按照分割前的顺序合成加密后的密码。在另一个实施例中，利用AES128方式对密码加密还可以用CBC模式。CBC模式是指将密码分成若干个密码块，每个密码块在与密钥加密前先与前一个密码块进行异或操作，然后再加密。第一个密码块则与初始向量(IV)进行异或操作再加密。
步骤S90，获取模块150从密码管理平台4或本地存储设备的配置文件中获取访问密码后，判断模块130判断访问密码是否加密。如果访问密码没有加密， 执行步骤S110，如果访问密码加密，执行步骤S100，再执行步骤S110。其中，所述判断访问密码是否加密是指判断获取的密码是否使用AES128方式或其他算法进行加密。例如，将获取的访问密码输入对应的业务系统，若能够进入该业务系统，则说明该访问密码没有加密，若不能够进入该业务系统，则说明该访问密码没有加密。
步骤S100,加解密模块160利用密钥对访问密码进行解密。所述解密是指利用密钥对加密的访问密码进行反AES128方式操作。与加密类似，在此不再赘述。
步骤S110，反馈模块170将没有加密的访问密码存储到缓存中，客户端3提取缓存中的访问密码对该业务系统5进行访问。其中，所述缓存记录每个访问密码的存入时间，某个访问密码在缓存中的存储超过一定时间而调用时，自动删除缓存中存储的该访问密码，减少缓存负担。例如，设置缓存中存储的访问密码的存储时间为24小时，当缓存中某访问密码在24小时未被调用时，缓存自动删除该访问密码。
相比于第一实施例，本实施例提出的密码调用方法，在从密码管理平台或本地存储设备的配置文件中获取访问密码后，判断访问密码是否加密，对加密的访问密码进行解密，存储到缓存中，再反馈给客户端，使密码管理更全面，密码的保护更加安全。
此外，本申请实施例还提出一种计算机可读存储介质，所述计算机可读存储介质中包括密码调用程序10，所述密码调用程序10被处理器执行时实现如下操作：
接收步骤：接收客户端发送的获取某业务系统的访问密码的请求；
提取步骤：提取服务器缓存中存储的该业务系统的访问密码登录该业务系统；
第一判断步骤：判断能否使用缓存中的访问密码进入该业务系统，若能进入该业务系统，则说明访问密码有效，流程结束，若不能进入该业务系统，则说明访问密码失效，执行第二判断步骤；
第二判断步骤：判断密码管理平台是否为开启状态，若密码管理平台为开启状态，则从密码管理平台调用获取所述访问密码，若密码管理平台为关 闭状态，则从本地存储设备的配置文件中获取所述访问密码，将所述访问密码反馈给客户端。
优选地，所述将所述访问密码反馈给客户端的步骤之前，所述方法还包括：
判断从密码管理平台或配置文件中获取的访问密码是否加密，若没有加密，则直接将访问密码反馈给客户端，若加密，则利用预设的加解密规则对访问密码进行解密，将解密后的访问密码反馈给客户端。
优选地，所述将访问密码反馈给客户端之前，将访问密码存储到缓存中。
优选地，所述方法还包括：
判断从密码管理平台获取的访问密码与配置文件中的访问密码是否相同，若不相同，则以从密码管理平台获取的访问密码更新配置文件中的访问密码，并对更新后的访问密码进行加密处理。
优选地，所述预设的加解密规则是指利用AES128算法和密钥对访问密码进行加或解密。
优选地，所述方法还包括：
为每个业务系统的访问密码分配标识，每个业务系统的访问密码标识与该业务系统的标识形成一一对应的映射关系，当服务器接收到获取该业务系统的访问密码的请求时，根据该业务系统的标识从配置文件或缓存中获取对应的访问密码。
本申请之计算机可读存储介质的具体实施方式与上述密码调用方法的具体实施方式大致相同，在此不再赘述。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、装置、物品或者方法不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、装置、物品或者方法所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、装置、物品或者方法中还存在另外的相同要素。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述 实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在如上所述的一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
以上仅为本申请的优选实施例，并非因此限制本申请的专利范围，凡是利用本申请说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本申请的专利保护范围内。

Claims (20)

  1. 一种密码调用方法，应用于服务器，其特征在于，所述方法包括：
    接收步骤：接收客户端发送的获取某业务系统的访问密码的请求；
    提取步骤：提取服务器缓存中存储的该业务系统的访问密码登录该业务系统；
    第一判断步骤：判断能否使用缓存中的访问密码进入该业务系统，若能进入该业务系统，则说明访问密码有效，流程结束，若不能进入该业务系统，则说明访问密码失效，执行第二判断步骤；
    第二判断步骤：判断密码管理平台是否为开启状态，若密码管理平台为开启状态，则从密码管理平台调用获取所述访问密码，若密码管理平台为关闭状态，则从本地存储设备的配置文件中获取所述访问密码，将所述访问密码反馈给客户端。
  2. 根据权利要求1所述的密码调用方法，其特征在于，所述将所述访问密码反馈给客户端的步骤之前，所述方法还包括：
    判断从密码管理平台或配置文件中获取的访问密码是否加密，若没有加密，则直接将访问密码反馈给客户端，若加密，则利用预设的加解密规则对访问密码进行解密，将解密后的访问密码反馈给客户端。
  3. 根据权利要求2所述的密码调用方法，其特征在于，所述将访问密码反馈给客户端之前，将访问密码存储到缓存中。
  4. 根据权利要求1所述的密码调用方法，其特征在于，所述方法还包括：
    判断从密码管理平台获取的访问密码与配置文件中的访问密码是否相同，若不相同，则以从密码管理平台获取的访问密码更新配置文件中的访问密码，并利用预设的加解密规则对更新后的访问密码进行加密处理。
  5. 根据权利要求2至4所述的密码调用方法，其特征在于，所述预设的加解密规则是指利用AES128算法和密钥对访问密码进行加或解密。
  6. 根据权利要求1所述的密码调用方法，其特征在于，所述方法还包括：
    为每个业务系统的访问密码分配标识，以使每个业务系统的访问密码标识与该业务系统的标识形成一一对应的映射关系，并在服务器接收到获取该业务系统的访问密码的请求时，根据该业务系统的标识从配置文件或缓存中获取对应的访问密码。
  7. 根据权利要求1所述的密码调用方法，其特征在于，所述判断密码管理平台是否为开启状态是通过存储在数据库中的一个字段的值判断的。
  8. 一种服务器，其特征在于，所述服务器包括：存储器、处理器及显示器，所述存储器上存储有密码调用程序，所述密码调用程序被所述处理器执行，可实现如下步骤：
    接收步骤：接收客户端发送的获取某业务系统的访问密码的请求；
    提取步骤：提取服务器缓存中存储的该业务系统的访问密码登录该业务系统；
    第一判断步骤：判断能否使用缓存中的访问密码进入该业务系统，若能进入该业务系统，则说明访问密码有效，流程结束，若不能进入该业务系统，则说明访问密码失效，执行第二判断步骤；
    第二判断步骤：判断密码管理平台是否为开启状态，若密码管理平台为开启状态，则从密码管理平台调用获取所述访问密码，若密码管理平台为关闭状态，则从本地存储设备的配置文件中获取所述访问密码，将所述访问密码反馈给客户端。
  9. 根据权利要求8所述的服务器，其特征在于，所述将所述访问密码反馈给客户端的步骤之前，还可实现如下步骤：
    判断从密码管理平台或配置文件中获取的访问密码是否加密，若没有加密，则直接将访问密码反馈给客户端，若加密，则利用预设的加解密规则对访问密码进行解密，将解密后的访问密码反馈给客户端。
  10. 根据权利要求9所述的服务器，其特征在于，所述将访问密码反馈给客户端之前，将访问密码存储到缓存中。
  11. 根据权利要求8所述的服务器，其特征在于，所述密码调用程序被所述处理器执行，还可实现如下步骤：
    判断从密码管理平台获取的访问密码与配置文件中的访问密码是否相同，若不相同，则以从密码管理平台获取的访问密码更新配置文件中的访问密码，并利用预设的加解密规则对更新后的访问密码进行加密处理。
  12. 根据权利要求9或11所述的服务器，其特征在于，所述预设的加解密规则是指利用AES128算法和密钥对访问密码进行加或解密。
  13. 根据权利要求8所述的服务器，其特征在于，所述密码调用程序被所 述处理器执行，还可实现如下步骤：
    为每个业务系统的访问密码分配标识，以使每个业务系统的访问密码标识与该业务系统的标识形成一一对应的映射关系，并在服务器接收到获取该业务系统的访问密码的请求时，根据该业务系统的标识从配置文件或缓存中获取对应的访问密码。
  14. 根据权利要求8所述的服务器，其特征在于，所述判断密码管理平台是否为开启状态是通过存储在数据库中的一个字段的值判断的。
  15. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中包括密码调用程序，所述统密码调用程序被处理器执行时实现如下步骤：
    接收步骤：接收客户端发送的获取某业务系统的访问密码的请求；
    提取步骤：提取服务器缓存中存储的该业务系统的访问密码登录该业务系统；
    第一判断步骤：判断能否使用缓存中的访问密码进入该业务系统，若能进入该业务系统，则说明访问密码有效，流程结束，若不能进入该业务系统，则说明访问密码失效，执行第二判断步骤；
    第二判断步骤：判断密码管理平台是否为开启状态，若密码管理平台为开启状态，则从密码管理平台调用获取所述访问密码，若密码管理平台为关闭状态，则从本地存储设备的配置文件中获取所述访问密码，将所述访问密码反馈给客户端。
  16. 根据权利要求15所述的计算机可读存储介质，其特征在于，所述将所述访问密码反馈给客户端的步骤之前，还可实现如下步骤：
    判断从密码管理平台或配置文件中获取的访问密码是否加密，若没有加密，则直接将访问密码反馈给客户端，若加密，则利用预设的加解密规则对访问密码进行解密，将解密后的访问密码反馈给客户端。
  17. 根据权利要求16所述的计算机可读存储介质，其特征在于，所述将访问密码反馈给客户端之前，将访问密码存储到缓存中。
  18. 根据权利要求15所述的计算机可读存储介质，其特征在于，所述密码调用程序被所述处理器执行，还可实现如下步骤：
    判断从密码管理平台获取的访问密码与配置文件中的访问密码是否相同，若不相同，则以从密码管理平台获取的访问密码更新配置文件中的访问密码， 并利用预设的加解密规则对更新后的访问密码进行加密处理。
  19. 根据权利要求16或18所述的计算机可读存储介质，其特征在于，所述预设的加解密规则是指利用AES128算法和密钥对访问密码进行加或解密。
  20. 根据权利要求15所述的计算机可读存储介质，其特征在于，所述密码调用程序被所述处理器执行，还可实现如下步骤：
    为每个业务系统的访问密码分配标识，以使每个业务系统的访问密码标识与该业务系统的标识形成一一对应的映射关系，并在服务器接收到获取该业务系统的访问密码的请求时，根据该业务系统的标识从配置文件或缓存中获取对应的访问密码。
PCT/CN2018/077618 2017-12-13 2018-02-28 密码调用方法、服务器及存储介质 WO2019114137A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711323477.3A CN108418785B (zh) 2017-12-13 2017-12-13 密码调用方法、服务器及存储介质
CN201711323477.3 2017-12-13

Publications (1)

Publication Number Publication Date
WO2019114137A1 true WO2019114137A1 (zh) 2019-06-20

Family

ID=63125357

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077618 WO2019114137A1 (zh) 2017-12-13 2018-02-28 密码调用方法、服务器及存储介质

Country Status (2)

Country Link
CN (1) CN108418785B (zh)
WO (1) WO2019114137A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114095150A (zh) * 2021-11-12 2022-02-25 微位（深圳）网络科技有限公司 身份鉴定方法、装置、设备及可读存储介质
CN115471168A (zh) * 2021-12-14 2022-12-13 国网上海市电力公司 自动化流程处理方法、装置、电子设备和计算机可读介质

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109347839B (zh) * 2018-10-25 2023-03-28 深圳壹账通智能科技有限公司 集中式密码管理方法、装置、电子设备及计算机存储介质
CN110008727B (zh) * 2019-04-10 2020-07-21 南方电网数字电网研究院有限公司 加密敏感参数的处理方法、装置、计算机设备和存储介质
CN111597547B (zh) * 2020-05-26 2023-04-28 中国联合网络通信集团有限公司 一种密码管理的方法和系统
CN113221154A (zh) * 2021-06-01 2021-08-06 平安信托有限责任公司 服务密码获取方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2004192098A (ja) * 2002-12-09 2004-07-08 Bsi Co Ltd 携帯電話を用いた公衆無線ｌａｎサービスの利用方法
CN101753313A (zh) * 2008-12-11 2010-06-23 中国移动通信集团安徽有限公司 密码管理方法、系统及密码管理服务器
CN102866998A (zh) * 2011-07-05 2013-01-09 中兴通讯股份有限公司 一种同步系统中集中式密码管理方法和系统
CN102868732A (zh) * 2012-08-27 2013-01-09 北京小米科技有限责任公司 一种基于账户密码的登录实现方法、系统及装置
CN104283668A (zh) * 2014-07-24 2015-01-14 山东大学（威海） 基于移动终端获得应用密码的方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102542206A (zh) * 2010-12-23 2012-07-04 康佳集团股份有限公司 为终端增加权限用户的方法及其装置
US9069947B2 (en) * 2011-09-29 2015-06-30 Oracle International Corporation Privileged account manager, access management
US10049205B2 (en) * 2014-06-25 2018-08-14 Oracle International Corporation Asserting identities of application users in a database system based on delegated trust
CN106685973B (zh) * 2016-12-30 2019-09-20 东软集团股份有限公司 记住登录信息的方法及装置、登录控制方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2004192098A (ja) * 2002-12-09 2004-07-08 Bsi Co Ltd 携帯電話を用いた公衆無線ｌａｎサービスの利用方法
CN101753313A (zh) * 2008-12-11 2010-06-23 中国移动通信集团安徽有限公司 密码管理方法、系统及密码管理服务器
CN102866998A (zh) * 2011-07-05 2013-01-09 中兴通讯股份有限公司 一种同步系统中集中式密码管理方法和系统
CN102868732A (zh) * 2012-08-27 2013-01-09 北京小米科技有限责任公司 一种基于账户密码的登录实现方法、系统及装置
CN104283668A (zh) * 2014-07-24 2015-01-14 山东大学（威海） 基于移动终端获得应用密码的方法及装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114095150A (zh) * 2021-11-12 2022-02-25 微位（深圳）网络科技有限公司 身份鉴定方法、装置、设备及可读存储介质
CN114095150B (zh) * 2021-11-12 2024-01-26 微位（深圳）网络科技有限公司 身份鉴定方法、装置、设备及可读存储介质
CN115471168A (zh) * 2021-12-14 2022-12-13 国网上海市电力公司 自动化流程处理方法、装置、电子设备和计算机可读介质

Also Published As

Publication number Publication date
CN108418785A (zh) 2018-08-17
CN108418785B (zh) 2020-07-21

Similar Documents

Publication Publication Date Title
WO2019114137A1 (zh) 密码调用方法、服务器及存储介质
US9946895B1 (en) Data obfuscation
WO2021003980A1 (zh) 黑名单共享方法、装置、计算机设备和存储介质
US7587608B2 (en) Method and apparatus for storing data on the application layer in mobile devices
US9122888B2 (en) System and method to create resilient site master-key for automated access
US20230283456A1 (en) Database encryption key management
US11290446B2 (en) Access to data stored in a cloud
CN111488598A (zh) 访问控制方法、装置、计算机设备和存储介质
WO2020206953A1 (zh) 一种数据处理方法及系统
CN102855448B (zh) 一种字段级数据库加密装置
WO2022028289A1 (zh) 数据加密方法、数据解密方法、装置、终端和存储介质
US11606202B2 (en) Methods and systems for secure data transmission
US10630722B2 (en) System and method for sharing information in a private ecosystem
US10142100B2 (en) Managing user-controlled security keys in cloud-based scenarios
CN106992851A (zh) 基于TrustZone的数据库文件口令加解密方法、装置及终端设备
CN104618096A (zh) 保护密钥授权数据的方法、设备和tpm密钥管理中心
US11849026B2 (en) Database integration with an external key management system
US11190353B2 (en) Computer implemented methods and systems for managing a cryptographic service
US8639941B2 (en) Data security in mobile devices
CN111666558B (zh) 密钥轮换方法、装置、计算机设备及存储介质
CN111917711B (zh) 数据访问方法、装置、计算机设备和存储介质
US20200342121A1 (en) Encrypted storage of data
CN114428784A (zh) 数据存取方法、装置、计算机设备及存储介质
US10826693B2 (en) Scalable hardware encryption
CN114372242A (zh) 密文数据的处理方法、权限管理服务器和解密服务器

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18889106

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 22.09.2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18889106

Country of ref document: EP

Kind code of ref document: A1