CN111597547B - Method and system for password management - Google Patents

Abstract

The invention discloses a method and a system for password management. The method comprises the following steps: responding to the password generation request, and generating a password, an initial password state and a password mark; the password mark is uniquely corresponding to the password; the password mark comprises an encrypted password and an identification mark; acquiring a password application rule of a password corresponding to the password mark; sending the password application rule and the password mark to a tracking module so that the tracking module monitors the password corresponding to the password mark according to the password application rule; and sending the password application rule, the initial password state and the password mark to an analysis module so that the analysis module determines whether the initial password state of the password corresponding to the password mark needs to be changed. The method improves the security and effectiveness of password management.

Description

Method and system for password management

technical field

The invention relates to the field of communication technology, in particular to a password management method and system.

Background technique

With the intelligentization of terminals and the increasing abundance of online business applications, many of people's daily needs have gradually migrated to online, and users are paying more and more attention to the application security of applications. However, when current users use applications online, they often use passwords for login authorization, identity verification, or file sharing. Therefore, keeping passwords secure is extremely important for securing applications.

It should be noted that ensuring password security means ensuring that passwords meet the requirements during use and preventing abnormal use of passwords. In order to prevent abnormal use of passwords during use, it is necessary to track and manage the usage of passwords after they are generated. At present, how to track and manage the usage of passwords after they are generated is one of the difficult problems in ensuring password security. In particular, there are security risks in the current process of tracking and managing passwords, resulting in poor security and effectiveness of password management.

Contents of the invention

Therefore, the present invention provides a password management method and system to solve the problem of poor security and effectiveness of password management in the prior art due to the difficulty of tracking and managing the use of passwords after they are generated.

In order to achieve the above object, the first aspect of the present invention provides a password management method, the method comprising:

Responding to a password generation request, generate a password, an initial password state, and a password mark; the password mark is uniquely corresponding to the password; the password mark includes an encrypted password and an identification mark;

Obtain the password application rules of the password corresponding to the password symbol;

Sending the password application rule and the password token to a tracking module, so that the tracking module monitors the password corresponding to the password token according to the password application rule;

Sending the password application rule, the initial password status and the password flag to an analysis module, so that the analysis module determines whether the initial password status of the password corresponding to the password flag needs to be changed.

Preferably, after the above-mentioned password application rules and the password flag are sent to the tracking module, it also includes:

Extracting the password limit from the password application rules;

Generate a limit label according to the password limit;

Sending the sublimit tag to the tracking module.

A second aspect of the present invention provides a password management method, the method comprising:

Receiving password application rules and password signs from the cryptographic module; the password signs uniquely correspond to the passwords; the password signs include encrypted passwords and identification marks;

monitoring the password corresponding to the password symbol according to the password application rules;

When the password corresponding to the password flag is applied and transferred, record the application transfer data of the password;

The application flow data is sent to the analysis module, so that the analysis module determines whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data.

Preferably, the above-mentioned step of monitoring the password corresponding to the password flag according to the password application rules includes:

extracting expected path parameters from the cryptographic application rules; the expected path parameters include expected sending address, expected intermediary address and expected target address;

The expected sending address, the expected intermediary address and the expected destination address are monitored.

A third aspect of the present invention provides a password management method, the method comprising:

Receiving a password sign, a password status and a password application rule from a cryptographic module; the password sign is uniquely corresponding to the password; the password sign includes an encrypted password and an identification sign;

Receive application flow data from the tracking module;

determining whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data and the password application rules;

When the initial password status needs to be changed, generate a password status change request;

Sending the encryption state change request to the execution module, so that the execution module generates and sends encryption state change information to all service nodes after changing the initial encryption state.

Preferably, before receiving the application flow data from the tracking module, it also includes:

Extracting the password time limit from the password application rules; the password time limit is the preset life span of the password corresponding to the password symbol;

Obtain the timing duration of the timer; the timing duration is the current life duration of the password corresponding to the password flag;

judging whether the timing duration is less than the password time limit;

When the timing duration is not less than the password time limit, generate an initial password state change request, and send the initial password state change request to the execution module, so that after the execution module changes the initial password state, generate and Send password status change information to all business nodes.

Preferably, the step of determining whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data and the password application rules includes:

extracting expected path parameters from the cryptographic application rules; the expected path parameters include expected sending address, expected intermediary address and expected target address;

extracting actual path parameters from the application flow data; the actual path parameters include actual sending address, actual intermediary address and actual target address;

comparing said actual path parameters with said expected path parameters;

When the expected path parameter does not include the actual path parameter, extract a password level from the password application rule; the password level includes a first-level password, a second-level password and a third-level password;

When the password level is a first-level password, it is determined that the initial password state of the password corresponding to the password flag needs to be changed;

When the password level is a secondary password, it is judged whether the expected intermediary address includes the actual intermediary address and whether the expected target address includes the actual target address; when it is judged that the expected intermediary address does not include the When the actual intermediary address or the expected target address does not include the actual target address, it is determined that the initial password state of the password corresponding to the password flag needs to be changed;

When the password level is a three-level password, judge whether the expected target address includes the actual target address; when the expected target address does not include the actual target address, determine the initial value of the password corresponding to the password flag Password status needs to be changed.

A fourth aspect of the present invention provides a password management system, the system comprising:

The first password generation module is used to respond to the password generation request and generate a password, an initial password state and a password mark; the password mark is uniquely corresponding to the password; the password mark includes an encrypted password and an identification mark;

A first password acquisition module, configured to acquire the password application rules of the password corresponding to the password symbol;

A first password sending module, configured to send the password application rule and the password symbol to a tracking module, so that the tracking module monitors the password corresponding to the password symbol according to the password application rule;

The second password sending module is configured to send the password application rules, the initial password state and the password flag to the analysis module, so that the analysis module determines whether the initial password state of the password corresponding to the password flag needs Make changes.

A fifth aspect of the present invention provides a password management system, the system comprising:

The first tracking receiving module is used to receive the password application rules and the password mark from the password module; the password mark is uniquely corresponding to the password; the password mark includes an encrypted password and an identification mark;

A first tracking and monitoring module, configured to monitor the password corresponding to the password symbol according to the password application rules;

The first tracking and recording module is used to record the application flow data of the password;

The first tracking sending module is configured to send the application flow data to the analysis module when the password corresponding to the password symbol is transferred to the analysis module, so that the analysis module can determine the password corresponding to the password symbol according to the application flow data. Whether the initial password state of the password needs to be changed.

A sixth aspect of the present invention provides a password management system, the system comprising:

The first analysis and receiving module is used to receive the password sign, password status and password application rules from the password module; the password sign is uniquely corresponding to the password; the password sign includes an encrypted password and an identification mark;

The second analysis receiving module is used to receive the application flow data from the tracking module;

The first analysis and decision-making module is used to determine whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data and the password application rules;

The first analysis and generation module is used to generate a password state change request when the initial password state needs to be changed;

The first analyzing and sending module is configured to send the encryption state change request to the execution module, so that the execution module generates and sends encryption state change information to all service nodes after changing the initial encryption state.

The present invention has the following advantages:

The present invention provides a password management method. The method firstly responds to a password generation request to generate a password, an initial password status and a password symbol, wherein the password symbol is uniquely corresponding to the password, and the password symbol includes an encrypted password and an identification symbol. The encrypted password It ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. Therefore, the security of the password management can be improved through the password mark. Secondly, the password application rule of the password corresponding to the password symbol is obtained, and then the password application rule and the password symbol are sent to the tracking module, so that the tracking module monitors the password corresponding to the password symbol according to the password application rule, and at the same time, the password application rule, initial The password status and password flag are sent to the analysis module, so that the analysis module can determine whether the initial password state of the password corresponding to the password flag needs to be changed, so as to avoid user losses caused by abnormal use of the password, that is, this method uses the password flag in the process of password management and initial password state improve the security and effectiveness of password management.

Description of drawings

The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the description, together with the following specific embodiments, are used to explain the present invention, but do not constitute a limitation to the present invention.

Fig. 1 is a flowchart of a password management method provided by an embodiment of the present invention;

FIG. 2 is a flowchart of a password management method provided by an embodiment of the present invention;

FIG. 3 is a flowchart of a password management method provided by an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a password management system provided by an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a password management system provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a password management system provided by an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a password management system provided by an embodiment of the present invention.

In the attached picture:

41: The first password generation module 42: The first password acquisition module

43: The first password sending module 44: The second password sending module

51: The first tracking receiving module 52: The first tracking monitoring module

53: The first tracking record module 54: The first tracking sending module

61: The first analysis receiving module 62: The second analysis receiving module

63: The first analysis and decision-making module 64: The first analysis and generation module

65: First analysis sending module 71: Password module

72: Tracking module 73: Analysis module

74: Execution Module

Detailed ways

Specific embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described here are only used to illustrate and explain the present invention, and are not intended to limit the present invention.

With the intelligentization of terminals and the increasing abundance of online business applications, many of people's daily needs have gradually migrated to online, and users are paying more and more attention to the application security of applications. However, when current users use applications online, they often use passwords for login authorization, identity verification, or file sharing. Therefore, keeping passwords secure is extremely important for securing applications.

It should be noted that ensuring password security means ensuring that passwords meet the requirements during use and preventing abnormal use of passwords. In order to prevent abnormal use of passwords during use, it is necessary to track and manage the usage of passwords after they are generated. At present, how to track and manage the usage of passwords after they are generated is one of the difficult problems in ensuring password security. In particular, there are security risks in the current process of tracking and managing passwords, resulting in poor security and effectiveness of password management.

In order to solve the above problems, the present embodiment provides a password management method applied to a password module, as shown in Figure 1, the method includes the following steps:

Step S101, responding to a password generation request, generating a password, an initial password state, and a password flag.

Wherein, the password generation request is a request received by the cryptographic module from a third-party application, and the password generation request carries a password generation rule.

In one embodiment, the password module responds to the password generation request, and generates a password, an initial password state, and a password flag according to a password generation rule carried in the password generation request. Wherein, the password generated by the password module may be of different types such as numbers, symbols, graphics and/or words. The initial state of the password can be set as an unused state or a valid state. The password mark uniquely corresponds to the password, and the password mark includes an encrypted password and an identification mark. Wherein, the encrypted password is a ciphertext after the password is encrypted by the cryptographic module, and the identification mark is a mark for uniquely identifying the password. In the process of password management, the cryptographic module can send the password token to other modules, so that other modules can obtain the unique correspondence between the password token and the password through the encrypted password and the identification token contained in the password token. Moreover, since the encrypted password is the encrypted ciphertext of the password, in the process of sending the password token to other modules by the password module, even if the hacker intercepts the password token, the password corresponding to the password token cannot be obtained through the password token. It can be seen that the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. hidden dangers and improve the security of password management.

In another implementation manner, the password generation request may also be a request generated by the password module according to its own requirements. The password module responds to the password generation request, and generates password, initial password status and password flag according to the agreement stored in the password module. Wherein, the password generated by the password module may be of different types such as numbers, symbols, graphics and/or words. The initial state of the password can be set as an unused state or a valid state. The password mark uniquely corresponds to the password, and the password mark includes an encrypted password and an identification mark. Among them, the encrypted password is the ciphertext after the password is encrypted by the cryptographic module, and the identification mark is a sign that uniquely identifies the password. The identification mark can also indicate the password type and/or tracking type of the password. The password type includes numbers, symbols, graphics and/or text, etc., and the tracking type includes clipboard type and/or text message type, etc.

Step S102, acquiring the password application rule of the password corresponding to the password flag.

Wherein, the password application rule is a requirement that needs to be met when the password is applied. Password application rules include: password times limit, password age limit, password level and/or expected path parameters. Wherein, the password limit is a specific application times threshold of the password, including a copy limit, a paste limit and/or a use limit. The password time limit is the preset lifetime of the password. The password level is the security requirement level of the password, which is usually a first-level password, a second-level password or a third-level password. Among them, the first-level password corresponds to high security requirements, and the security requirements corresponding to the second-level password are between the first-level password and the third-level password. Among the security requirements, the third-level password corresponds to the low security requirements. The expected path parameter is the address parameter of each business node where the password is expected to flow, including the expected sending address, the expected intermediary address and the expected target address, wherein the expected sending address is the generation address of the password flag, and the expected sending address can be the device serial number, Intranet logo or Internet Protocol (Internet Protocol, IP) address, etc.; the expected intermediary address is the address corresponding to the intermediate storage medium that the password logo is expected to pass through before use, generally the address corresponding to the clipboard or SMS center; the expected target address is to An address to which the password mark is expected to apply, and the expected target address may be a device serial number, an intranet mark, or an Internet Protocol (Internet Protocol, IP) address, etc.

Step S103, sending the password application rule and the password token to the tracking module, so that the tracking module monitors the password corresponding to the password token according to the password application rule.

It should be noted that, when the password module sends the password token to the tracking module, the tracking module can obtain the unique correspondence between the password token and the password through the encrypted password and the identification token contained in the password token. Moreover, since the encrypted password is the encrypted ciphertext of the password, when the password module sends the password token to the tracking module, even if the hacker intercepts the password token, the password corresponding to the password token cannot be obtained through the password token. It can be seen that the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. hidden dangers and improve the security of password management.

In one embodiment, after the password application rule and the password symbol are sent to the tracking module, in order to make the tracking module easily monitor the password corresponding to the password symbol according to the password application rule, the password module extracts the password limit from the obtained password application rule, and then Generate a limit label according to the password limit, and finally send the limit label to the tracking module. It should be noted that the password limit is the threshold of the number of times that the password can be used, including the copy limit, paste limit and/or use limit. and/or use labels, which all have an initial value of 0.

Step S104, sending the password application rules, the initial password status and the password flag to the analysis module, so that the analysis module determines whether the initial password status of the password corresponding to the password flag needs to be changed.

It should be noted that the password module sends the password token to the analysis module so that the analysis module can obtain the unique correspondence between the password token and the password through the encrypted password and the identification token contained in the password token. Moreover, since the encrypted password is the encrypted ciphertext of the password, even if the hacker intercepts the password symbol during the process of sending the password symbol to the analysis module by the password module, the password corresponding to the password symbol cannot be obtained through the password symbol. It can be seen that the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. hidden dangers and improve the security of password management.

This embodiment provides a method for password management applied to a cryptographic module. The method first responds to a password generation request to generate a password, an initial password state, and a password flag, wherein, the password flag is uniquely corresponding to the password, and the password flag contains encrypted Password and identification mark, the encrypted password ensures that the password is not leaked in the process of password management, and the identification mark ensures the unique correspondence between the password mark and the password in the process of password management. Therefore, the security of password management can be improved through the password mark. Secondly, the password application rule of the password corresponding to the password symbol is obtained, and then the password application rule and the password symbol are sent to the tracking module, so that the tracking module monitors the password corresponding to the password symbol according to the password application rule, and at the same time, the password application rule, initial The password status and password flag are sent to the analysis module, so that the analysis module can determine whether the initial password state of the password corresponding to the password flag needs to be changed, so as to avoid user losses caused by abnormal use of the password, that is, this method uses the password flag in the process of password management and initial password state improve the security and effectiveness of password management.

This embodiment also provides a method for password management, which is applied to the tracking module, as shown in Figure 2, the method includes the following steps:

S201. Receive a password application rule and a password flag from a password module.

Wherein, the password application rule is a requirement that needs to be met when the password is applied, and the password application rule includes: password times limit, password time limit, password level and/or expected path parameters. The password mark includes an encrypted password and an identification mark, wherein the encrypted password is a ciphertext after the password is encrypted by the cryptographic module, and the identification mark is a mark for uniquely identifying the password.

It should be noted that the tracking module obtains the unique correspondence between the password mark and the password through the encrypted password and the identification mark contained in the password mark. Moreover, since the encrypted password is the encrypted ciphertext of the password, in the process of using the password mark by the tracking module, even if the hacker intercepts the password mark, the password corresponding to the password mark cannot be obtained through the password mark. It can be seen that the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. hidden dangers and improve the security of password management.

In one embodiment, the tracking module also receives a secondary tag from the cryptographic module. The sublimit tag is a tag generated by the password module for the convenience of the tracking module to easily monitor the password corresponding to the password sign, wherein the sub limit tag includes copying a tag, pasting a tag and/or using a tag. The initial value of the sublimit label is 0.

S202. Monitor the password corresponding to the password flag according to the password application rules.

Wherein, the password application rules include password times limit, password time limit, password level and/or expected path parameters. In one embodiment, in order to comprehensively monitor the application flow process of the password token, the step of the tracking module monitoring the password corresponding to the password token according to the password application rules includes: first, the tracking module extracts the expected path parameters from the password application rules, and the expected path The parameters include an expected sending address, an expected intermediary address and an expected destination address; then, the tracking module monitors the expected sending address, the expected intermediary address and the expected destination address. It should be noted that since the expected path parameter is the address parameter of each business node where the password is expected to flow, it is only necessary to monitor the expected sending address, expected intermediary address, and expected target address in the expected path parameter to comprehensively monitor the password The application flow process of the logo, and the password management is carried out.

S203, when the password corresponding to the password flag is applied and transferred, record the application transfer data of the password.

Wherein, the cryptographic application flow data includes the actual path parameter and/or the current value of the sublimit label. The actual path parameter is the address parameter of each service node where the password is actually transferred, and the actual path parameter includes the actual sending address, the actual intermediary address and the actual target address. Secondary tags include copying tags, pasting tags, and/or using tags.

When it needs to be explained, the tracking module can easily monitor the password corresponding to the password symbol and record the application flow data of the password through the limit label, which is convenient for password management. In one embodiment, the tracking module monitors the password corresponding to the password sign. When the password corresponding to the password sign is copied for the first time, the tracking module adds 1 to the initial value of the copy label, that is, the current value of the copy label recorded by the tracking module is 1.

S204. Send the application flow data to the analysis module, so that the analysis module determines whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data.

This embodiment provides a method for password management applied to the tracking module. The method first receives password application rules and password signs from the password module, wherein, the password sign is uniquely corresponding to the password, and the password sign contains an encrypted password and identification The encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password symbol and the password during the password management process. Therefore, the security of password management can be improved through the password symbol. Secondly, monitor the password corresponding to the password symbol according to the password application rules, and when the password corresponding to the password symbol is transferred, record the application transfer data of the password; finally, send the application transfer data to the analysis module, so that the analysis module transfers the data according to the application Determine whether the initial password state of the password corresponding to the password flag needs to be changed to avoid user losses caused by abnormal use of the password, that is, this method improves the security and effectiveness of password management by using the password flag and the initial password state in the process of password management .

This embodiment also provides a method for password management, which is applied to the analysis module, as shown in Figure 3, the method includes the following steps:

Step 301, receiving the password flag, password status and password application rules from the password module.

Wherein, the password mark includes an encrypted password and an identification mark, wherein, the encrypted password is a ciphertext after the password is encrypted by the cryptographic module, and the identification mark is a mark for uniquely identifying the password. It should be noted that the analysis module obtains the unique correspondence between the password token and the password through the encrypted password and the identification token contained in the password token. Moreover, since the encrypted password is the encrypted ciphertext of the password, in the process of using the password mark by the analysis module, even if the hacker intercepts the password mark, the password corresponding to the password mark cannot be obtained through the password mark. It can be seen that the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. hidden dangers and improve the security of password management.

The initial state of the password is unused or valid.

The password application rules are the requirements that need to be met when the password is applied. The password application rules include: password times limit, password time limit, password level and/or expected path parameters.

In one embodiment, after receiving the password flag, password status and password application rules from the cryptographic module, the analysis module needs to judge whether the current lifetime of the password corresponding to the password flag has exceeded the password time limit before performing subsequent analysis. Steps include:

First, the analysis module extracts the password time limit from the password application rules. Wherein, the password time limit is the preset lifetime of the password corresponding to the password symbol.

Secondly, the analysis module obtains the timing duration of the timer, which is a timer generated together with the password in the password module, and the timing duration is the current lifetime of the password corresponding to the password flag.

Then, the analysis module judges whether the timing duration is less than the password time limit. When the timing duration is less than the password time limit, it means that the current life duration of the password symbol does not exceed the preset life duration, and the password corresponding to the password symbol can continue to be used without further modification The initial state of the password corresponding to the password flag is changed; when the timing time is not less than the password time limit, it means that the current lifetime of the password corresponding to the password symbol has exceeded the preset lifetime. It will not be able to continue to be used. Therefore, the analysis module generates a password status change request, and the password status change request is used to request that the password initial status of the password corresponding to the password flag be changed to an invalid status.

Finally, the analysis module sends the encryption state change request to the execution module, so that the execution module generates and sends encryption state change information to all service nodes after changing the encryption state. Wherein, all service nodes include a cryptographic module, a tracking module, an analysis module, and service nodes corresponding to the expected sending address, expected intermediary address, and expected target address included in the expected path parameters.

The analysis module judges whether the current lifetime of the password symbol has exceeded the password time limit, which can avoid the hidden danger of the expired password being illegally embezzled. When the current lifetime of the password corresponding to the password flag does not exceed the password time limit, the analysis module can continue to perform subsequent analysis.

Step 302, receiving application flow data from the tracking module.

Wherein, the application flow data includes the actual path parameter and/or the current value of the sublimit label. The actual path parameter is the address parameter of each service node where the password is actually transferred, and the actual path parameter includes the actual sending address, the actual intermediary address and the actual target address. Secondary tags include copying tags, pasting tags, and/or using tags.

Step 303: Determine whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data and password application rules.

Wherein, the initial state of the password is an unused state or a valid state. The password application rules are the requirements that need to be met when the password is applied. The password application rules include: password times limit, password time limit, password level and/or expected path parameters. The analysis module can timely determine whether the initial password status of the password corresponding to the password symbol needs to be changed, which can ensure that the password corresponding to the password symbol will not appear in the application transfer process, and the expired password can continue to be used, which can effectively avoid passwords being illegally stolen hidden dangers and improve the security and effectiveness of password management.

In one embodiment, the analysis module determines whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data and the password application rules, including:

In the first step, the password limit is extracted from the password application rules, and the current value of the limit label is extracted from the application flow data.

Wherein, the password limit includes a copy limit, a paste limit and/or a use limit; the limit label includes a copy label, a paste label and/or a use label. In one embodiment, the analysis module extracts the current values of copy limit, paste limit and/or use limit and copy label, paste label and/or use label, respectively.

The second step is to determine that the initial password state needs to be changed when the current value of the secondary limit tag meets the preset condition. The initial password state is an unused state or a valid state. The preset condition includes three cases, among which, the first case is: the current value of the copied label does not exceed the corresponding copying limit, the current value of the pasted label is 0, and the current value of the used label is 1. It should be noted that , the first case shows that the password corresponding to the password flag is used for the first time, and it can be determined that the initial password state needs to be changed from the unused state to the used state; the second case is that the current value of the copy label does not exceed the corresponding copy Second limit, the current value of the pasted label is 1 and the current value of the used label is 0. The second case shows that the password corresponding to the password flag is pasted for the first time, and it can be determined that the password status needs to be changed from unused to used state; the third case is that the current value of the pasted label is equal to the pasting limit or the current value of the use limit is equal to the use limit. The third case shows that the password corresponding to the password mark has reached the use limit, that is, the password status needs to be changed is in failure state.

In the third step, the expected path parameters are extracted from the password application rules, and the actual path parameters are extracted from the application flow data. Wherein, the expected path parameter includes an expected sending address, an expected intermediary address and an expected destination address. The actual path parameter contains the actual sending address, the actual intermediary address and the actual destination address.

The fourth step is to compare the actual path parameters with the expected path parameters. When the expected path parameter includes the actual path parameter, it means that the password corresponding to the password flag is in the normal application transfer process, and there is no need to process the initial password state of the password corresponding to the password flag.

In the fifth step, when the expected path parameter does not include the actual path parameter, the password level is extracted from the password application rule. Wherein, the password level includes a first-level password, a second-level password and a third-level password. It should be noted that since passwords of different password levels correspond to different security requirement levels, when the expected path parameter does not contain the actual path parameter, the initial password state of the password corresponding to the password flag is determined according to the password level contained in the password flag Whether it needs to be changed can balance the security and efficiency of passwords in the application flow process.

In the fifth step, when the password level is a first-level password, it is determined that the initial password status needs to be changed. It should be noted that since the first-level password corresponds to the highest security requirement, in order to avoid the hidden danger of the password corresponding to the password flag being illegally stolen to the greatest extent, as long as the expected path parameter does not contain the actual path parameter, the analysis module will consider the password flag The initial password state of the corresponding password needs to be changed to an invalid state to ensure the security of the password during the application transfer process.

Step 6, when the password level is a secondary password, the analysis module judges whether the expected intermediary address contains the actual intermediary address and whether the expected target address contains the actual target address; when the analysis module judges that the expected intermediary address does not contain the actual intermediary address or the expected target When the address does not contain the actual destination address, it is determined that the initial cryptographic state requires a change.

Step 7: When the password level is a third-level password, determine whether the expected target address includes the actual target address, and when the expected target address does not include the actual target address, determine that the password status needs to be changed. It should be noted that because the third-level password corresponds to low security requirements, in order to improve the efficiency of password use, as long as the expected target address contains the actual target address, the analysis module will consider the password corresponding to the password flag to be in the normal application flow process , only when the expected target address does not include the actual target address, the analysis module considers that the initial password state of the password corresponding to the password flag needs to be changed to an invalid state.

It should be noted that in the above steps, the first to second steps and the third to seventh steps have no necessary sequence relationship. When the received application flow data only contains the current value of the sublimit label, you can Execute the first and second steps; only when the received application flow data only contains actual path parameters, only the third to seventh steps can be executed.

Step 304, when the initial password status needs to be changed, generate a password status change request.

Wherein, the password status change request includes a password flag and a status to be changed.

Step 305, sending a cryptographic state change request to the execution module, so that the execution module generates and sends cryptographic state change information to all service nodes after changing the initial cryptographic state.

Among them, the cryptographic state change information includes the cryptographic flag and the changed cryptographic state; all business nodes include cryptographic modules, tracking modules, analysis modules, and business nodes corresponding to the expected sending address, expected intermediary address, and expected target address included in the expected path parameters.

This embodiment provides a password management method applied to the analysis module. The method first receives the password flag, password status and password application rules from the password module. Among them, the password mark is uniquely corresponding to the password, and the password mark includes an encrypted password and an identification mark, the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures that the password mark and the password are unique during the password management process Therefore, the security of password management can be improved through the password flag. Second, the application flow data from the tracking module is received. Then, determine whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data and the password application rules, and generate a password state change request when the initial password state needs to be changed. Finally, send a password status change request to the execution module, so that after the execution module changes the initial password status, it will generate and send password status change information to all business nodes, so as to avoid user losses caused by abnormal use of passwords, that is, this method passes through the process of password management The use of password flags and initial password states improves the security and effectiveness of password management.

This embodiment also provides a password management system, which is applied to a password module. As shown in FIG. Password sending module 44.

The first password generation module 41 is configured to respond to the password generation request and generate a password, an initial password state and a password flag. Wherein, the password generation request is a request received by the cryptographic module from a third-party application, and the password generation request carries a password generation rule.

In one embodiment, the first password generation module 41 responds to the password generation request, and generates the password, the initial password state and the password flag according to the password generation rule carried in the password generation request. Wherein, the password generated by the password module may be of different types such as numbers, symbols, graphics and/or words. The initial state of the password can be set as an unused state or a valid state. The password mark uniquely corresponds to the password, and the password mark includes an encrypted password and an identification mark. Wherein, the encrypted password is a ciphertext after the password is encrypted by the cryptographic module, and the identification mark is a mark for uniquely identifying the password. In the process of password management, the cryptographic module can send the password token to other modules, so that other modules can obtain the unique correspondence between the password token and the password through the encrypted password and the identification token contained in the password token. Moreover, since the encrypted password is the encrypted ciphertext of the password, in the process of sending the password token to other modules by the password module, even if the hacker intercepts the password token, the password corresponding to the password token cannot be obtained through the password token. It can be seen that the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. hidden dangers and improve the security of password management.

In another implementation manner, the password generation request may also be a request generated by the password module according to its own requirements. The first password generation module 41 responds to the password generation request and generates a password, an initial password state and a password flag according to the agreement stored in the password module. Wherein, the password generated by the password module may be of different types such as numbers, symbols, graphics and/or words. The initial state of the password can be set as an unused state or a valid state. The password mark uniquely corresponds to the password, and the password mark includes an encrypted password and an identification mark. Among them, the encrypted password is the ciphertext after the password is encrypted by the cryptographic module, and the identification mark is a sign that uniquely identifies the password. The identification mark can also indicate the password type and/or tracking type of the password. The password type includes numbers, symbols, graphics and/or text, etc., and the tracking type includes clipboard type and/or text message type, etc.

The first password acquisition module 42 is configured to acquire the password application rules of the password corresponding to the password flag. Wherein, the password application rule is a requirement that needs to be met when the password is applied. Password application rules include: password times limit, password age limit, password level and/or expected path parameters. Wherein, the password limit is a specific application times threshold of the password, including a copy limit, a paste limit and/or a use limit. The password time limit is the preset lifetime of the password. The password level is the security requirement level of the password, which is usually a first-level password, a second-level password or a third-level password. Among them, the first-level password corresponds to high security requirements, and the security requirements corresponding to the second-level password are between the first-level password and the third-level password. Among the security requirements, the third-level password corresponds to the low security requirements. The expected path parameter is the address parameter of each business node where the password is expected to flow, including the expected sending address, the expected intermediary address and the expected target address, wherein the expected sending address is the generation address of the password flag, and the expected sending address can be the device serial number, Intranet logo or Internet Protocol (Internet Protocol, IP) address, etc.; the expected intermediary address is the address corresponding to the intermediate storage medium that the password logo is expected to pass through before use, generally the address corresponding to the clipboard or SMS center; the expected target address is to An address to which the password mark is expected to apply, and the expected target address may be a device serial number, an intranet mark, or an Internet Protocol (Internet Protocol, IP) address, etc.

The first password sending module 43 is configured to send the password application rule and the password token to the tracking module, so that the tracking module monitors the password corresponding to the password token according to the password application rule.

It should be noted that the first password sending module 43 sends the password token to the tracking module so that the tracking module can obtain the unique correspondence between the password token and the password through the encrypted password and the identification token contained in the password token. Moreover, since the encrypted password is the encrypted ciphertext of the password, when the password module sends the password token to the tracking module, even if the hacker intercepts the password token, the password corresponding to the password token cannot be obtained through the password token. It can be seen that the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. hidden dangers and improve the security of password management.

In one embodiment, after the first password sending module 43 sends the password application rule and the password symbol to the tracking module, in order to make the tracking module easily monitor the password corresponding to the password symbol according to the password application rule, the password module is also provided with a first password extraction module and a second password generation module. The first password extraction module extracts the password limit from the obtained password application rules, then the second password generation module generates a limit tag according to the password limit, and finally the first password sending module 43 sends the limit tag to the tracking module. It should be noted that the password limit is the threshold of the number of times that the password can be used, including the copy limit, paste limit and/or use limit. and/or use labels, which all have an initial value of 0.

The second password sending module 44 is configured to send the password application rules, the initial password state and the password flag to the analysis module, so that the analysis module determines whether the initial password state of the password corresponding to the password flag needs to be changed.

It should be noted that the second password sending module 44 sends the password token to the analysis module so that the analysis module can obtain the unique correspondence between the password token and the password through the encrypted password and the identification token contained in the password token. Moreover, since the encrypted password is the encrypted ciphertext of the password, even if the hacker intercepts the password symbol during the process of sending the password symbol to the analysis module by the password module, the password corresponding to the password symbol cannot be obtained through the password symbol. It can be seen that the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. hidden dangers and improve the security of password management.

The working mode of each module in the password management system applied to the password module provided in this embodiment corresponds to each step in the method applied to the password management of the password module. Therefore, each module in the password management system applied to the password module For detailed working methods, refer to the password management method applied to the password module provided in this embodiment.

It should also be noted that each module in the password management system applied to the password module provided by this embodiment is a logical module, and its physical bearer is not limited. When the modules belong to different physical bearers, the modules can be linked to realize password management.

This embodiment provides a system for password management applied to a password module. The system first responds to a password generation request through the first password generation module 41 to generate a password, an initial password state, and a password sign, wherein the password sign and the password are unique Corresponding, and the password mark includes an encrypted password and an identification mark. The encrypted password ensures that the password is not leaked in the process of password management, and the identification mark ensures the unique correspondence between the password mark and the password in the process of password management. Therefore, the password mark can Improve the security of password management. Secondly, the first password acquisition module 42 acquires the password application rules of the password corresponding to the password sign, and then, the first password sending module 43 sends the password application rules and the password sign to the tracking module, so that the tracking module monitors the password corresponding to the password sign according to the password application rules. At the same time, the second password sending module 44 sends the password application rules, the initial password state and the password flag to the analysis module, so that the analysis module determines whether the initial password state of the password corresponding to the password flag needs to be changed, so as to avoid the abnormal use of the password Cause user losses, that is, the system improves the security and effectiveness of password management through the use of password symbols and initial password status in the process of password management.

This embodiment also provides a password management system, which is applied to the tracking module. As shown in Figure 5, the system includes: a first tracking receiving module 51, a first tracking monitoring module 52, a first tracking recording module 53 and a first Track sending module 54.

The first tracking receiving module 51 is configured to receive the password application rules and password signs from the password module. Wherein, the password application rule is a requirement that needs to be met when the password is applied, and the password application rule includes: password times limit, password time limit, password level and/or expected path parameters. The password mark includes an encrypted password and an identification mark, wherein the encrypted password is a ciphertext after the password is encrypted by the cryptographic module, and the identification mark is a mark for uniquely identifying the password.

It should be noted that the first tracking receiving module 51 obtains the unique correspondence between the password token and the password through the encrypted password and the identification token contained in the password token. Moreover, since the encrypted password is the encrypted ciphertext of the password, in the process of using the password mark by the tracking module, even if the hacker intercepts the password mark, the password corresponding to the password mark cannot be obtained through the password mark. It can be seen that the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. hidden dangers and improve the security of password management.

In one embodiment, the first trace receiving module 51 also receives a sublimit tag from the cryptographic module. The sublimit tag is a tag generated by the password module for the convenience of the tracking module to easily monitor the password corresponding to the password sign, wherein the sub limit tag includes copying a tag, pasting a tag and/or using a tag. The initial value of the sublimit label is 0.

The first tracking and monitoring module 52 is configured to monitor the password corresponding to the password flag according to the password application rules. Wherein, the password application rules include password times limit, password time limit, password level and/or expected path parameters. In one embodiment, in order to comprehensively monitor the application transfer process of the password token, in one embodiment, the first trace monitoring module 52 further includes a first trace extraction submodule and a first trace monitoring submodule. First, the first trace extraction submodule extracts the expected path parameters from the cryptographic application rules, the expected path parameters include the expected sending address, the expected intermediary address and the expected target address; then, the first tracking monitoring submodule tracking module monitors the expected sending address , expected intermediary address, and expected target address. It should be noted that, since the expected path parameter is the address parameter of each service node where the password is expected to flow, the first tracking and monitoring module 52 only needs to monitor the expected sending address, expected intermediary address and expected target address in the expected path parameter, It is possible to comprehensively monitor the application circulation process of the password sign and carry out password management.

The first tracking and recording module 53 is configured to record the application flow data of the password when the application flow of the password corresponding to the password flag occurs. Wherein, the cryptographic application flow data includes the actual path parameter and/or the current value of the sublimit label. The actual path parameter is the address parameter of each service node where the password is actually transferred, and the actual path parameter includes the actual sending address, the actual intermediary address and the actual target address. Secondary tags include copying tags, pasting tags, and/or using tags.

When it needs to be explained, the first tracking and recording module 53 can easily record the application flow data of the password through the sub-limit label, which is convenient for password management. In one embodiment, when the password corresponding to the password flag is copied for the first time, the first tracking and recording module 53 adds 1 to the initial value of the copy label, that is, the current value of the copy label recorded by the first tracking and recording module 53 is 1 .

The first tracking sending module 54 is configured to send the application flow data to the analysis module, so that the analysis module determines whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data.

The working mode of each module in the system applied to the password management of the tracking module provided in this embodiment corresponds to each step in the method applied to the password management of the tracking module, therefore, each module in the system applied to the password management of the tracking module For detailed working methods, refer to the password management method applied to the tracking module provided in this embodiment.

It should also be noted that each module in the system for password management applied to the tracking module provided by this embodiment is a logical module, and its physical bearer is not limited. When the modules belong to different physical bearers, the modules can be linked to realize password management.

The present embodiment provides a system applied to the password management of the tracking module. The system first receives the password application rules and the password sign from the password module through the first password generation module 41, wherein the password sign is uniquely corresponding to the password, and The password sign contains an encrypted password and an identification sign. The encrypted password ensures that the password is not leaked during the password management process. The identification sign ensures the unique correspondence between the password sign and the password during the password management process. Therefore, password management can be improved through the password sign security. Secondly, the first password acquisition module 42 monitors the password corresponding to the password sign according to the password application rules. When the password corresponding to the password sign is transferred, the first password sending module 43 records the application transfer data of the password; finally, the second password sending module 44 Send the application transfer data to the analysis module, so that the analysis module can determine whether the initial password status of the password corresponding to the password flag needs to be changed according to the application transfer data, so as to avoid user losses caused by abnormal use of passwords, that is, the system passes through the process of password management. The use of password flags and initial password states improves the security and effectiveness of password management.

This embodiment also provides a password management system, which is applied to the analysis module. As shown in Figure 6, the system includes: a first analysis receiving module 61, a second analysis receiving module 62, a first analysis decision module 63, An analysis generation module 64 and a first analysis sending module 65 .

Wherein, the first analyzing and receiving module 61 is used for receiving the password flag, password status and password application rules from the password module. Wherein, the password mark includes an encrypted password and an identification mark, wherein, the encrypted password is a ciphertext after the password is encrypted by the cryptographic module, and the identification mark is a mark for uniquely identifying the password. It should be noted that the first analyzing and receiving module 61 obtains the unique correspondence between the password token and the password through the encrypted password and the identification token contained in the password token. Moreover, since the encrypted password is the encrypted ciphertext of the password, in the process of receiving the password token by the first analyzing and receiving module 61, even if the hacker intercepts the password token, the password corresponding to the password token cannot be obtained through the password token. It can be seen that the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures the unique correspondence between the password mark and the password during the password management process. hidden dangers and improve the security of password management. The initial state of the password is unused or valid. The password application rules are the requirements that need to be met when the password is applied. The password application rules include: password times limit, password time limit, password level and/or expected path parameters.

In one embodiment, the system further includes a first analysis extraction module, a first analysis acquisition module, a second analysis decision module, a second analysis generation module and a second analysis sending module. After the first analysis receiving module 61 receives the password flag, password status and password application rules from the cryptographic module, it needs to judge whether the current lifetime of the password corresponding to the password flag has exceeded the password time limit, specifically: first, the first analysis extracts The module extracts the password time limit from the password application rules, wherein the password time limit is the preset life span of the password corresponding to the password symbol. Secondly, the first analysis and acquisition module acquires the timing duration of the timer, wherein the timer is a timer generated together with the password symbol in the password module, and the timer is a timer generated together with the password in the password module, and the timing duration is the password The current lifetime of the password corresponding to the flag. Then, the analysis module judges whether the timing duration is less than the password time limit. When the timing duration is less than the password time limit, it means that the current life duration of the password symbol does not exceed the preset life duration, and the password corresponding to the password symbol can continue to be used without further modification The initial state of the password corresponding to the password flag is changed; when the timing time is not less than the password time limit, it means that the current lifetime of the password corresponding to the password symbol has exceeded the preset lifetime. It will not be able to continue to be used, therefore, the second analysis generation module generates a password status change request, and the password status change request is used to request that the password initial status of the password corresponding to the password flag be changed to an invalid status. Finally, the second analyzing and sending module will send the password state change request to the execution module, so that after the execution module changes the password state, it will generate and send the password state change information to all service nodes. Wherein, all service nodes include a cryptographic module, a tracking module, an analysis module, and service nodes corresponding to the expected sending address, expected intermediary address, and expected target address included in the expected path parameters. It should be noted that the system judges whether the current lifetime of the password token has exceeded the password time limit, which can avoid the hidden danger of the expired password token being illegally stolen.

The second analysis receiving module 62 is configured to receive the application flow data from the tracking module. Wherein, the application flow data includes the actual path parameter and/or the current value of the sublimit label. The actual path parameter is the address parameter of each service node where the password is actually transferred, and the actual path parameter includes the actual sending address, the actual intermediary address and the actual target address. Secondary tags include copying tags, pasting tags, and/or using tags.

The first analysis and decision-making module 63 is configured to determine whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data and the password application rules. Wherein, the initial state of the password is an unused state or a valid state. The password application rules are the requirements that need to be met when the password is applied. The password application rules include: password times limit, password time limit, password level and/or expected path parameters. The first analysis and decision-making module 63 timely determines whether the initial password status of the password corresponding to the password flag needs to be changed, so as to ensure that the password corresponding to the password flag will not appear in the application circulation process and can continue to use the expired password, which can be effectively avoided. The hidden danger of password being illegally stolen, improving the security and effectiveness of password management.

The first analysis generating module 64 is configured to generate a password state change request when the initial password state needs to be changed. Wherein, the password status change request includes a password flag and a status to be changed.

The first analysis sending module 65 sends a password state change request to the execution module, so that after the execution module changes the initial password state, it generates and sends password state change information to all service nodes. Among them, the cryptographic state change information includes the cryptographic flag and the changed cryptographic state; all business nodes include cryptographic modules, tracking modules, analysis modules, and business nodes corresponding to the expected sending address, expected intermediary address, and expected target address included in the expected path parameters.

The working mode of each module in the password management system applied to the analysis module provided by this embodiment corresponds to each step in the method applied to the password management of the analysis module. Therefore, the methods of each module in the password management system applied to the analysis module For detailed working methods, please refer to the password management method applied to the analysis module provided in this embodiment.

It should also be noted that each module in the system for password management applied to the analysis module provided by this embodiment is a logical module, and its physical bearer is not limited. When the modules belong to different physical bearers, the modules can be linked to realize password management.

This embodiment provides a password management system applied to the analysis module. The first analysis receiving module 61 of the system first receives the password flag, password status and password application rules from the password module. Among them, the password mark is uniquely corresponding to the password, and the password mark includes an encrypted password and an identification mark, the encrypted password ensures that the password is not leaked during the password management process, and the identification mark ensures that the password mark and the password are unique during the password management process Therefore, the security of password management can be improved through the password flag. Secondly, the second analysis receiving module 62 receives the application flow data from the tracking module. Then, the first analysis and decision-making module 63 determines whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data and the password application rules. When the initial password state needs to be changed, the first analysis generation module 64 generates a password state change ask. Finally, the first analysis sending module 65 sends a password status change request to the execution module, so that after the execution module changes the initial password status, it generates and sends password status change information to all service nodes, so as to avoid user losses caused by abnormal use of passwords, that is, this system The security and effectiveness of the password management are improved by using the password flag and the initial password state in the password management process.

This embodiment also provides a password management system. As shown in FIG. 7 , the system includes a password module 71 , a tracking module 72 , an analysis module 73 and an execution module 74 .

Wherein, the password module 71 includes the first password generation module 41 , the first password acquisition module 42 , the first password sending module 43 and the second password sending module 44 .

The tracking module 72 includes the first tracking receiving module 51 , the first tracking monitoring module 52 , the first tracking recording module 53 and the first tracking sending module 54 .

The analysis module 73 includes the first analysis receiving module 61 , the second analysis receiving module 62 , the first analysis decision module 63 , the first analysis generation module 64 and the first analysis sending module 65 .

The execution module 74 includes an execution receiving module, an execution changing module, an execution generating module and an execution sending module. In one embodiment, the execution receiving module is used to receive the password state change request from the analysis module 73, and the password status change request includes a password flag and a state to be changed; the execution change module is used to respond to the password state change request, and change the password The initial password status of the password corresponding to the flag; the execution generation module is used to generate password status change information, the password status change information includes the password flag and the changed password status; the execution sending module is used to send the password status change information to all business nodes , to ensure that all business nodes synchronize the changed password status of the password corresponding to the password flag, avoid user losses caused by abnormal use of passwords, and improve the security and effectiveness of password management.

After the password module 71 , the tracking module 72 and the analysis module 73 receive the password status change information from the execution module 74 , they respectively synchronize the password status corresponding to the password flag to the changed password status. It should be noted that when the status of the changed password is invalid, the tracking module 72 ends the tracking of the password corresponding to the password flag.

It should also be noted that each module involved in the password management system provided by this embodiment is a logical module, and its physical load is not limited. When the modules belong to different physical bearers, the modules can be linked to realize password management.

It can be understood that, the above embodiments are only exemplary embodiments adopted for illustrating the principle of the present invention, but the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also regarded as the protection scope of the present invention.

Claims (10)

1. A method for password management, characterized in that the method comprises: In response to a password generation request, generate a password, an initial password status, and a password flag; the password flag is uniquely corresponding to the password; the password flag includes an encrypted password and an identification flag; wherein, the initial password status is unused or valid state, the identification mark is a mark that uniquely identifies the password, and the encrypted password is the encrypted ciphertext of the password; Obtain the password application rules of the password corresponding to the password symbol, the password application rules are used to indicate the requirements that need to be met when the password corresponding to the password symbol is applied, and the password application rules include: password times limit, password time limit, password level and/or expected path parameters; Sending the password application rule and the password token to a tracking module, so that the tracking module monitors the password corresponding to the password token according to the password application rule; Sending the password application rule, the initial password status and the password flag to an analysis module, so that the analysis module determines whether the initial password status of the password corresponding to the password flag needs to be changed. 2. The method according to claim 1, further comprising: Extracting the password limit from the password application rules; Generate a limit label according to the password limit; Sending the sublimit tag to the tracking module. 3. A method for password management, characterized in that the method comprises: Receive password application rules and password signs from the cryptographic module; the password signs uniquely correspond to the password; the password signs include encrypted passwords and identification signs; wherein, the identification signs are signs that uniquely identify passwords, and the encryption The password is the encrypted ciphertext of the password; The password corresponding to the password symbol is monitored according to the password application rules. The password application rules are used to indicate the requirements that need to be met when the password corresponding to the password symbol is applied. The password application rules include: password times limit, password Time limits, password levels and/or expected path parameters; When the password corresponding to the password flag is applied and transferred, record the application transfer data of the password; Send the application flow data to the analysis module, so that the analysis module determines whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data, and the initial password state is an unused state or valid state. 4. The method according to claim 3, wherein the step of monitoring the password corresponding to the password symbol according to the password application rules comprises: extracting expected path parameters from the cryptographic application rules; the expected path parameters include expected sending address, expected intermediary address and expected target address; The expected sending address, the expected intermediary address and the expected destination address are monitored. 5. A method for password management, characterized in that the method comprises: Receive password sign, password status and password application rules from the cryptographic module; the password sign is uniquely corresponding to the password; the password sign includes an encrypted password and an identification sign; wherein, the identification sign is a sign that uniquely identifies the password, The encrypted password is the encrypted ciphertext of the password; the password application rules are used to indicate the requirements to be met during the application of the password corresponding to the password flag, and the password application rules include: password times limit, password Time limits, password levels and/or expected path parameters; Receive application flow data from the tracking module; Determine whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data and the password application rule; the initial password state is an unused state or a valid state; When the initial password status needs to be changed, generate a password status change request; Sending the encryption state change request to the execution module, so that the execution module generates and sends encryption state change information to all service nodes after changing the initial encryption state. 6. The method according to claim 5, further comprising: before receiving the application flow data from the tracking module: Extracting the password time limit from the password application rules; the password time limit is the preset life span of the password corresponding to the password symbol; Obtain the timing duration of the timer; the timing duration is the current life duration of the password corresponding to the password flag; judging whether the timing duration is less than the password time limit; When the timing duration is not less than the password time limit, generate an initial password state change request, and send the initial password state change request to the execution module, so that after the execution module changes the initial password state, generate and Send password status change information to all business nodes. 7. The method according to claim 5, wherein the step of determining whether the initial password state of the password corresponding to the password flag needs to be changed according to the application transfer data and the password application rules includes: extracting expected path parameters from the cryptographic application rules; the expected path parameters include expected sending address, expected intermediary address and expected target address; Extracting actual path parameters from the application flow data; the actual path parameters include actual sending address, actual intermediary address and actual target address; comparing said actual path parameters with said expected path parameters; When the expected path parameter does not include the actual path parameter, extract a password level from the password application rule; the password level includes a first-level password, a second-level password and a third-level password; When the password level is a first-level password, it is determined that the initial password state of the password corresponding to the password flag needs to be changed; When the password level is a secondary password, it is judged whether the expected intermediary address includes the actual intermediary address and whether the expected target address includes the actual target address; when it is judged that the expected intermediary address does not include the When the actual intermediary address or the expected target address does not include the actual target address, it is determined that the initial password state of the password corresponding to the password flag needs to be changed; When the password level is a three-level password, judge whether the expected target address includes the actual target address; when the expected target address does not include the actual target address, determine the initial value of the password corresponding to the password flag Password status needs to be changed. 8. A password management system, characterized in that the system comprises: The first password generation module is used to respond to a password generation request and generate a password, an initial password state, and a password mark; the password mark is uniquely corresponding to the password; the password mark includes an encrypted password and an identification mark; wherein, the initial The password state is an unused state or a valid state, the identification mark is a mark that uniquely identifies the password, and the encrypted password is the encrypted ciphertext of the password; The first password acquisition module is used to acquire the password application rules of the password corresponding to the password symbol, the password application rules are used to indicate the requirements that need to be met when the password corresponding to the password symbol is applied, and the password application rules include : password limit, password age, password level and/or expected path parameters; A first password sending module, configured to send the password application rule and the password symbol to a tracking module, so that the tracking module monitors the password corresponding to the password symbol according to the password application rule; The second password sending module is configured to send the password application rules, the initial password state and the password flag to the analysis module, so that the analysis module determines whether the initial password state of the password corresponding to the password flag needs Make changes. 9. A password management system, characterized in that the system comprises: The first tracking and receiving module is used to receive password application rules and password marks from the password module; the password mark is uniquely corresponding to the password; the password mark includes an encrypted password and an identification mark; wherein the identification mark is unique A sign identifying a password, and the encrypted password is an encrypted ciphertext of the password; The first tracking and monitoring module is used to monitor the password corresponding to the password symbol according to the password application rule; the password application rule is used to indicate the requirements that need to be met when the password corresponding to the password symbol is applied. Rules include: password limit, password age, password level and/or expected path parameters; The first tracking and recording module is used to record the application flow data of the password; The first tracking sending module is configured to send the application flow data to the analysis module when the password corresponding to the password symbol is transferred to the analysis module, so that the analysis module can determine the password corresponding to the password symbol according to the application flow data. Whether the initial password state of the password needs to be changed, and the initial password state is an unused state or a valid state. 10. A password management system, characterized in that the system comprises: The first analysis and receiving module is used to receive the password sign, password status and password application rules from the password module; the password sign is uniquely corresponding to the password; the password sign includes an encrypted password and an identification mark; wherein, the identification The sign is a sign that uniquely identifies a password, and the encrypted password is the encrypted ciphertext of the password; the password application rule is used to indicate the requirements that need to be met when the password corresponding to the password sign is applied. Rules include: password limit, password age, password level and/or expected path parameters; The second analysis receiving module is used to receive the application flow data from the tracking module; The first analysis and decision-making module is used to determine whether the initial password state of the password corresponding to the password flag needs to be changed according to the application flow data and the password application rule; the initial password state is an unused state or a valid state; The first analysis and generation module is used to generate a password state change request when the initial password state needs to be changed; The first analyzing and sending module is configured to send the encryption state change request to the execution module, so that the execution module generates and sends encryption state change information to all service nodes after changing the initial encryption state.

Images