CN110881032B - Identification method and device for unauthorized account operation - Google Patents

Abstract

The invention discloses a method for identifying an account unauthorized operation, which is applied to an operation and maintenance authority management platform. The operation and maintenance authority management platform includes a plurality of business domain subsystems, and includes the following steps: when an account is detected to log in to the system, obtaining The account information of the account and the device information of the login device of the account; identify whether the account is a public account; if the account is not a public account, calculate the risk value of the account operation; if the obtained risk value exceeds the threshold, then the account Log out or modify permissions; and disclose the corresponding device. The present invention can be relatively simple, find possible common accounts without occupying resources, and ensure that the occurrence rate of unauthorized accounts is reduced; the summation calculation method can eliminate a large number of accidental data log-in situations.

Description

Identification method and device for account unauthorized operation

technical field

The invention relates to the field of Internet technology, and in particular, to a method and device for identifying an account unauthorized operation.

Background technique

In the operation and maintenance of the ICT professional department, due to the long-term absence of personnel, the team may focus on operation and maintenance and less on management, and the equipment ledger update lags and omissions often occur, and there is a lack of corresponding management and control methods.

In the daily operation and maintenance of the ICT professional department, the main security management risk points of unauthorized use of accounts: the ICT operation and maintenance work of the grass-roots unit has landed at the team level. After the position is adjusted, the adjustment information cannot be obtained immediately, resulting in a lag in the adjustment of permissions; There is a lack of effective management and control measures for the cross-use of high-privilege accounts, and the mixed use of high-privilege accounts and proxy approval are common; the remote login of accounts is a risk caused by different security and usage conditions of computer systems.

According to the State Grid (Information/3) 782-2015 document, in order to ensure the security of application system accounts, the information operation and maintenance department should do the following control:

1). Change the account permissions of the application system in a timely manner according to the adjustment of personnel positions to ensure that the rights and responsibilities are consistent.

2). Strictly control the abnormal use of high-privilege accounts (business approval, core data viewing).

3). Remote login of accounts (considering the differentiation of computer application environment security) supervision.

SUMMARY OF THE INVENTION

The present invention provides a method and device for identifying an account unauthorized operation to solve the above technical problems.

In order to achieve the above object, the technical scheme adopted in the present invention is:

The identification method for account unauthorized operation is applied to an operation and maintenance authority management platform, wherein the operation and maintenance authority management platform includes a plurality of business domain subsystems, and is characterized in that it includes the following steps:

Step 101, when it is detected that an account is logged into the system, the account information of the account and the device information of the login device of the account are obtained;

Step 102, identifying whether the account is a public account;

Step 103, if the account is not a public account, calculate the risk value of the account operation;

Step 104, if the obtained risk value exceeds the threshold, cancel the account or modify the authority;

The calculated risk value P1 _of the account operation is a physical risk value or an unauthorized risk value,

When the calculated risk value P1 _of the account operation is a physical risk value, the device information of the device corresponding to the account is ID ₁ (d ₁ , f ₁ , r ₂ ). The device information of the device logged in the account is ID ₂ (d ₂ , f ₂ , r ₂ ), then the physical risk value P ₁ :

P ₁ =|(d ₁ -d ₂ )*1000|+|(f ₁ -f ₂ )*100|+|(r ₁ -r ₂ )|

Wherein, d ₁ is the device number of the device corresponding to the account, d ₂ is the secondary node level position of the device logged in by the account, f ₁ is the secondary node level position of the device corresponding to the account, and f ₂ is the device logged in by the account. The hierarchical location below the secondary node of , r ₁ is the actual geographic location of the device corresponding to the account, and r ₂ is the actual geographic location of the device logged in by the account;

When the calculated risk value P ₁ of the account operation is the unauthorized risk value, the risk coefficient of each account owner exceeding the original authority is set as b ₁ , and the risk of the account owner logging in to the device is b ₂ :

Preferably, the account information includes: the authority of the account, the responsibilities of the account owner, and the device information of the device corresponding to the account.

As a preference, when the account shows that there are multiple logins, the risk value is accumulated:

Wherein, i and n are both integers and 1≤i≤n.

According to a second aspect of the embodiments of the present invention, an identification device for account unauthorized operation is provided, and the identification device for account unauthorized operation is applied to an operation and maintenance authority management platform, and the operation and maintenance authority management platform includes a plurality of business domain subsystems , which is characterized in that it includes:

The account detection module is used to obtain the account information of the account and the device information of the login device of the account when it is detected that an account is logged into the system;

The account identification module is used to identify whether the account is a public account;

The risk value calculation module is used to calculate the risk value of the account operation if the account is not a public account;

The authority modification module is used to cancel the account or modify the authority if the obtained risk value exceeds the threshold.

Preferably, the account information includes: the authority of the account, the responsibilities of the account owner, and the device information of the device corresponding to the account.

Compared with the prior art, the present invention can be relatively simple, find possible common accounts without occupying resources, and ensure that the occurrence rate of unauthorized accounts is reduced; the calculation method of summation can eliminate a large number of accidental data log-in situations.

Description of drawings

Fig. 1 is a kind of flow chart of the identification method of account unauthorized operation of the present invention;

FIG. 2 is a structural block diagram of an identification device for account unauthorized operation according to the present invention.

In the figure, 201-account detection module, 202-account identification module, 203-risk value calculation module, 204-authority modification module.

Detailed ways

The present invention will be described in detail below with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and structural, method, or functional changes made by those skilled in the art according to these embodiments are all included in the protection scope of the present invention.

The terminology used in the present invention is for the purpose of describing particular embodiments only and is not intended to limit the present invention. As used in this specification and the appended claims, the singular forms "a," "the," and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It will also be understood that the term "and/or" as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

As shown in FIG. 1, a method for identifying account unauthorized operation is applied to an operation and maintenance authority management platform. The operation and maintenance authority management platform includes multiple business domain subsystems, including the following steps:

Step 101, when it is detected that an account is logged into the system, the account information of the account and the device information of the login device of the account are obtained;

Step 102, identifying whether the account is a public account;

Step 103, if the account is not a public account, calculate the risk value of the account operation;

Step 104, if the obtained risk value exceeds the threshold, cancel the account or modify the authority.

Here, the account information may include: the authority of the account, the responsibilities of the account owner, and the device information of the device corresponding to the account. Specifically, through the collection of account information and device information, we can learn about the currently logged-in account information, the computer connection port of the logged-in device, the account user, account authority, physical location, etc. The personnel information may include the account user's department, position, responsibilities, etc.

In an implementation manner of the present invention, the calculated risk value P ₁ of the account operation may be a physical risk value, and the device information of the device corresponding to the account is ID ₁ (d ₁ , f ₁ , r ₂ ), and the account is logged in The device information of the device is ID ₂ (d ₂ , f ₂ , r ₂ ), then the physical risk value P ₁ is:

P ₁ =|(d ₁ -d ₂ )*1000|+|(f ₁ -f ₂ )*100|+|(r ₁ -r ₂ )|.

Among them, ID ₁ , d ₁ , f ₁ , and r ₁ respectively represent the device number of the device corresponding to the account, the level position of the secondary node, the level position below the secondary node, and the actual geographical location, ID ₂ , d ₂ , f ₂ , r ₂ represents the device number of the device logged in by the account, the level position of the secondary node, the level position below the secondary node, and the actual geographical location.

The actual geographic location distance value can be calculated by the actual value. The distance calculation value of the level position of the secondary node and the level position below the secondary node is obtained by converting the set value. 1000 is the risk given when the source of the account data changes at the level of the secondary node. value, 100 is the risk value assigned to occur under the secondary node. _The larger the value of P1, the greater the risk of co-ownership if the account is not cancelled.

In an implementation manner of the present invention, the calculated risk value P1 _of the account operation can be an overweight risk value, the risk value is overweight, the more levels are, the greater the difference between departments, and the risk value will increase explosively. The risk factor of each account owner exceeding the original authority is set to b ₁ , and the risk of the account owner logging in to the device is b ₂ :

In particular, when the account shows that there are multiple logins, the risk value can be accumulated:

Wherein, i and n are both integers and 1≤i≤n.

Correspondingly, the present invention also provides an identification device for account unauthorized operation, which is applied to an operation and maintenance authority management platform. The operation and maintenance authority management platform includes a plurality of business domain subsystems, as shown in FIG. 2 , including:

The account detection module 201 is configured to acquire the account information of the account and the device information of the login device of the account when it is detected that there is an account to log in to the system;

The account identification module 202 is used to identify whether the account is a public account;

The risk value calculation module 203 is used to calculate the risk value of the account operation if the account is not a public account;

The authority modification module 204 is configured to cancel the account or modify the authority if the obtained risk value exceeds the threshold.

The account information includes: the authority of the account, the responsibilities of the account owner, and the device information of the device corresponding to the account.

Regarding the apparatus in the above-mentioned embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be described in detail here.

The invention analyzes the relationship between the account owner and the login account device, the relationship between the account owner and the login device owner by combing the device port distribution map, the information and communication point personnel attribute data, and the personnel data, and uses the behavior setting tree to determine the relationship between the account owner and the login account device. specific violations. Therefore, it is relatively simple to find possible common accounts without occupying resources, so as to ensure that the occurrence rate of unauthorized accounts is reduced. The summation calculation method can exclude a large number of accidental data logging conditions.

Other embodiments of the invention will readily suggest themselves to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses or adaptations of the invention which follow the general principles of the invention and which include common knowledge or conventional techniques in the art not disclosed by the invention . The specification and examples are to be regarded as exemplary only, with the true scope and spirit of the invention being indicated by the claims of this application.

It should be understood that the present invention is not limited to the precise structures described above and illustrated in the accompanying drawings, and that various modifications and changes may be made without departing from its scope. The scope of the present invention is limited only by the appended claims.

Claims (5)

1. The identification method of the account number unauthorized operation is applied to an operation and maintenance authority management platform, the operation and maintenance authority management platform comprises a plurality of service domain subsystems, and the identification method is characterized by comprising the following steps:

step 101, when detecting that an account logs in a system, acquiring account information of the account and equipment information of account logging equipment;

step 102, identifying whether the account is a public account;

step 103, if the account is not a public account, calculating a risk value of the account operation;

step 104, if the obtained risk value exceeds a threshold value, canceling the account or modifying the authority;

calculating the risk value P of the account operation₁Either the physical risk value or the override risk value,

calculating the risk value P of the account operation₁When the physical risk value is the physical risk value, the device information of the device corresponding to the account is ID₁(d₁,f₁,r₂) The device information of the device logged in by the account is ID₂(d₂,f₂,r₂) Then the physical risk value P₁：

P₁＝|(d₁-d₂)*1000|+|(f₁-f₂)*100|+|(r₁-r₂)|

Wherein, ID₁、d₁、f₁、r₁Respectively representing the equipment number, the hierarchical position of the secondary node, the hierarchical position below the secondary node and the actual geographic position, ID, of the equipment corresponding to the account₂、d₂、f₂、r₂Respectively representing the equipment number, the hierarchical position of a secondary node, the hierarchical position below the secondary node and the actual geographic position of equipment logged in by the account;

calculating the risk value P of the account operation₁When the risk value is an unauthorized risk value, the risk coefficient of each account owner exceeding the original authority is set as b₁The risk of the account owner logging in the device is b₂：

2. The method for identifying account unauthorized operation according to claim 1, wherein the account information includes: the authority of the account, the responsibility of the account owner, and the equipment information of the equipment corresponding to the account.

3. The method for identifying unauthorized account operation according to claim 1, wherein when the account shows multiple logins, the risk values are accumulated:

wherein i and n are integers, and i is more than or equal to 1 and less than or equal to n.

4. The recognition device of account number unauthorized operation, characterized in that, be applied to operation and maintenance authority management platform, operation and maintenance authority management platform includes a plurality of business domain subsystems, its characterized in that includes:

the account detection module is used for acquiring account information of the account and equipment information of the account login equipment when detecting that the account logs in the system;

the account number identification module is used for identifying whether the account number is a public account number;

the risk value calculation module is used for calculating the risk value of the account operation if the account is not a public account;

the permission modification module is used for canceling the account number or modifying permission if the obtained risk value exceeds a threshold value;

the identification device for the account number unauthorized operation is used for executing an identification method for the account number unauthorized operation, and the identification method for the account number unauthorized operation specifically comprises the following steps:

step 101, when detecting that an account logs in a system, acquiring account information of the account and equipment information of account logging equipment;

step 102, identifying whether the account is a public account;

step 103, if the account is not a public account, calculating a risk value of the account operation;

step 104, if the obtained risk value exceeds a threshold value, canceling the account or modifying the authority;

calculating the risk value P of the account operation₁Either the physical risk value or the override risk value,

calculating the risk value P of the account operation₁When the physical risk value is the physical risk value, the device information of the device corresponding to the account is ID₁(d₁,f₁,r₂) The device information of the device logged in by the account is ID₂(d₂,f₂,r₂) Then the physical risk value P₁：

P₁＝|(d₁-d₂)*1000|+|(f₁-f₂)*100|+|(r₁-r₂)|

Wherein, ID₁、d₁、f₁、r₁Respectively representing the equipment number, the hierarchical position of the secondary node, the hierarchical position below the secondary node and the actual geographic position, ID, of the equipment corresponding to the account₂、d₂、f₂、r₂Respectively representing the equipment number, the hierarchical position of a secondary node, the hierarchical position below the secondary node and the actual geographic position of equipment logged in by the account;

calculating the risk value P of the account operation₁When the risk value is an unauthorized risk value, the risk coefficient of each account owner exceeding the original authority is set as b₁The risk of the account owner logging in the device is b₂：

5. The apparatus for recognizing an account unauthorized operation according to claim 4, wherein the account information includes: the authority of the account, the responsibility of the account owner, and the equipment information of the equipment corresponding to the account.

Images