Privilege management system and method

Abstract

The invention discloses a privilege management system, wherein a privilege management module is used for managing establishment of authorization strategy and distribution of privilege and setting a time constraint condition for relative privilege during authorization according to actual needs; an attribute certificate signing module signs an attribute certificate according to a binding relationship and the time constraint condition between a user and the privilege; a catalogue server stores the attribute certificate and user information; and an access management module establishes a safety mechanism between the user and a target resource, carries out privilege authentication according to the attribute certificate and the user information when the user tries to access the target resource todetermine whether the user is allowed to access the target resource or not, thereby protecting the safety of the target resource. In addition, the invention discloses a privilege management method. The privilege management system and method can conveniently carry out setting and automatic cancel on the privilege in time, thereby lowering the difficulty and the complexity of the privilege management and also the system risk.

Description

technical field [0001] The present invention relates to information security technology, in particular, to a system and a related method for managing user rights. Background technique [0002] With the development of information technology, many enterprises and institutions have realized information management, and implement user authority management according to the department and position of employees. The so-called user rights management refers to the management of the rights of users to access / use the system. [0003] Usually, when the existing user rights management system designs authorization management, the mainstream method is based on role policy management, which comprehensively and safely solves the management of various elements of user authorization management, the formulation of various authorization strategies and the Management functions such as the distribution of various permissions. The so-called role refers to the collection of permissions in the appli...

AI Technical Summary

Problems solved by technology

[0005] It can be seen from the above that in the existing authority management system, the grant and cancellation of user authority need to be manually operated by the administrator, and the automatic cancellation of authority cannot be realized.

That is to say, after the authorization, the administrator needs to monitor, modify or reset the authority, which not only increases the difficulty and complexity of authority management, but also leads to a great waste of manpower and material resources.

Especially in the case of a large number of personnel and frequent cancellation of authority, this defect is particularly prominent

[0006] In addition, in the existing rights management system, the administrator needs to manually intervene to cancel the rights, which leads to poor timeliness of rights management

Especially for occasions that require relatively strong timeliness of permissions (for example, a certain user has access to the system only for a period of time, after which the user will no longer be allowed to access the system), due to the inability to be flexible in time Modifying / removing permissions indiscriminately brings great risks to the system

[0007] However, if you only set permissions and no longer monitor them after authorization, you will not be able to modify or cancel permissions in time according to actual needs, resulting in users always enjoying the initially set permissions, which will inevitably lead to security risks in the system , increase system risk

Images