CN111447090A - Configuration management and control system among multi-service systems - Google Patents

Configuration management and control system among multi-service systems Download PDF

Info

Publication number
CN111447090A
CN111447090A CN202010217267.1A CN202010217267A CN111447090A CN 111447090 A CN111447090 A CN 111447090A CN 202010217267 A CN202010217267 A CN 202010217267A CN 111447090 A CN111447090 A CN 111447090A
Authority
CN
China
Prior art keywords
branch
configuration
branch system
central
interface
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202010217267.1A
Other languages
Chinese (zh)
Inventor
毛正阳
袁晨思
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Eisoo Information Technology Co Ltd
Original Assignee
Shanghai Eisoo Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Eisoo Information Technology Co Ltd filed Critical Shanghai Eisoo Information Technology Co Ltd
Priority to CN202010217267.1A priority Critical patent/CN111447090A/en
Publication of CN111447090A publication Critical patent/CN111447090A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08Configuration management of networks or network elements
    • H04L41/0893Assignment of logical groups to network elements
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/02Standardisation; Integration
    • H04L41/0246Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols
    • H04L41/0253Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols using browsers or web-pages for accessing management information
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08Configuration management of networks or network elements
    • H04L41/0803Configuration setting
    • H04L41/0813Configuration setting characterised by the conditions triggering a change of settings
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/02Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Lock And Its Accessories (AREA)

Abstract

The invention relates to a configuration management and control system among multi-service systems, which is used for deploying configuration management and control requirements of at least two sets of same service systems and comprises a central system consisting of one set of service systems and a plurality of branch systems consisting of the rest service systems, wherein the central system is used for setting configuration management and control rules for each branch system and uniformly controlling the configuration of each branch system in a locking configuration mode; the branch systems are used for receiving and verifying the configuration calling request of the caller, executing configuration operation by judging whether the configuration calling request passes the verification, and each branch system is respectively provided with a uniform calling interface through which the caller modifies the system configuration of the branch system. Compared with the prior art, the method has the advantages that on the premise of ensuring that each set of service system can be independently operated and maintained, the service system can follow unified use rules and security strategies to meet the management and control requirements of a group or an organization, the cost of configuration management and control can be greatly reduced, and the like.

Description

Configuration management and control system among multi-service systems
Technical Field
The invention belongs to the field of computer internet, relates to a unified user management and control system, and particularly relates to a configuration management and control system among multi-service systems.
Background
With the rapid development of informatization construction, enterprises, public institutions and institutions are continuously constructing and deploying a plurality of sets of same business systems, and uniformly setting and managing each set of business systems. The service systems are still independent from each other, and each service system has independent organization and user management, so that a large amount of isolated and dispersed organization and user information is generated. With the increasing number of service systems, great manpower and material resources are required to be consumed for configuration management and control of multiple sets of same service systems in different areas. Aiming at the problem, most enterprises and public institutions choose to build a set of unified organization user management system. Most of the unified solutions adopt a group policy management and control method, that is, clients are managed, the method requires that each client is added to the same domain, and each terminal is directly configured and controlled in a top-down manner, so that the method has high requirements on the top management and control system, and the data processing is complex, thereby resulting in high cost and low management and control efficiency; in addition, in this way, due to the one-to-many management and control way, the security of the managed multiple service systems cannot be guaranteed, and the independent operation and maintenance capabilities of different service systems are easily affected.
Disclosure of Invention
The present invention provides a configuration management and control system between multiple service systems to overcome the above-mentioned drawbacks of the prior art.
The purpose of the invention can be realized by the following technical scheme:
a configuration management and control system among multiple service systems is used for deploying configuration management and control requirements of at least two sets of same service systems, and comprises a central system consisting of one set of service systems and a plurality of branch systems consisting of the rest service systems, wherein the central system is used for setting configuration management and control rules for each branch system and uniformly controlling the configuration of each branch system in a locking configuration mode; the branch systems are used for receiving and verifying the configuration calling request of the caller, executing configuration operation by judging whether the configuration calling request passes the verification, and each branch system is respectively provided with a uniform calling interface through which the caller modifies the system configuration of the branch system.
The configuration operation of each branch system comprises three operations of setting, locking and unlocking, wherein the branch system in the locking operation is in a non-editable state, the branch system in the unlocking state is in an editable state, and the setting operation is the setting for configuring the branch system. When the branch system is locked, a separate locking operation may be performed or both the locking operation and the setting operation may be performed on the branch system.
Furthermore, the calling interface of each branch system adopts an HTTP-based interface.
Each branch system comprises a verification unit and a session credential generation unit, wherein the verification unit is used for verifying the identity of a caller; the session credential generating unit is used for generating a legal session credential on the branch system, the session credential is used for being distributed to the central system, and the central system utilizes the session credential distributed by the branch system to carry out verification on the verification unit of the branch system. The branch system generates legal conversation evidence by utilizing the conversation evidence generating unit, and after the conversation evidence is issued to the central system, the central system firstly registers once with the branch system through the conversation evidence, after the registration is passed, the branch system records the host address of the central system, and the host address is used as one of the bases for subsequently judging whether to allow the allocation interface to be called. The definition of the host address comprises the domain name or IP of the host, and both can be used as legal bases.
When the caller calls the call interface of the branch system, send the interface request including carrying conversation credential of the branch system to the branch system, when the branch system processes the interface request, the verification unit compares the source host address of the interface request with recording the host address at first, when the two are identical, verify through caller carrying conversation credential that the branch system sends, if verify and is valid, carry out the relevant configuration logic, if verify and not carry the credential or carry the invalid credential, do not carry out any setting operation.
In the working state, the specific operation of executing the setting operation on the branch system is as follows:
11) the central system carries the conversation credential of the branch system and the key value-value combination of a plurality of strategies required to be configured, and requests a branch system configuration interface;
12) after receiving the request of the central system, the branch system checks the host address of the request source, compares the host address with the host address registered by the central system and recorded by the branch system, judges whether the request source is from the registered central system, if so, analyzes the key value pair of each strategy to be configured, calls through an internal interface, applies each strategy, and if not, does not execute the configuration setting.
In the working state of the system, the specific operation of executing the locking operation on the branch system is as follows:
the branch system checks the source host address of the call interface request and compares the source host address with the host address registered by the central system recorded by the branch system to judge whether the request source is from the registered central system; if yes, setting the configuration to be in a locking state; otherwise, locking of the configuration is not performed; after locking, the central system sets the central system matched with the locker as the only service end for editing and unlocking.
In the working state of the system, the specific operation of executing unlocking control on the branch system is as follows:
when the unlocking person calls the calling interface of the branch system to unlock, the branch system detects whether the request source of the interface is consistent with the host address of the locking person recorded in the system, if so, the unlocking person is judged to be the locking person, and the central system sets the configuration of the branch system to be in an editable state.
Compared with the prior art, the invention has the following advantages:
1. the invention carries out unified configuration on a plurality of sets of service systems by taking one set of service system as a central system, is suitable for deploying a plurality of sets of same service systems in a network environment, and can follow unified use rules and security strategies on the premise of ensuring that each set of service system can be independently operated and maintained so as to meet the management and control requirements of a group or an organization and greatly reduce the cost of configuration management and control;
2. the invention carries out strategy configuration and distribution in a centralized way through the central system, thereby greatly reducing the technical requirements on branch system administrators and having stronger guarantee on the uniformity, the correctness and the timeliness of the strategy configuration of the branch system;
3. the system can realize the configuration management and control among different service systems by deploying the system of the invention without influencing the independent operation and maintenance capability of different service systems, even if the service systems deployed in different domains, different environments and systems have different organization and user management modes, different provided organization and user operation interfaces and different organization and user information formats;
4. the system of the invention does not need to require that each client is added into the same domain, but the configuration from the server to the server, and only needs to provide the configuration parameters of the central system of the management branch system, thus realizing the setting, locking and unlocking of any service system;
5. each set of branch system is provided with an interface based on an HTTP protocol, a caller needs to modify the system configuration of the branch system through the interface, the central system can control the configuration of a plurality of sets of service systems in a configuration locking mode, the locked configuration is not allowed to be edited by systems (including the branch system) except the non-central system, and the security of configuration management and control can be greatly improved.
Drawings
FIG. 1 is a schematic flow chart of the system for implementing the setting and locking and unlocking of the branch system;
fig. 2 is a schematic view of a scenario in which the system of the present invention is applied in the embodiment.
Detailed Description
The invention is described in detail below with reference to the figures and specific embodiments. It is to be understood that the embodiments described are only a few embodiments of the present invention, and not all embodiments. All other embodiments, which can be obtained by a person skilled in the art without any inventive step based on the embodiments of the present invention, shall fall within the scope of protection of the present invention.
Examples
The invention relates to a configuration management and control system among multiple service systems, which is applied to the configuration management and control requirements of deploying multiple sets (at least 2 sets) of same service systems, and realizes the unified management and control of service system configuration by setting a unified configuration setting HTTP interface. Specifically, the system comprises a central system and a plurality of branch systems, wherein the central system consists of one set of service systems, and the rest service systems are used as the branch systems.
The central system is used for sending a configuration management and control request to the branch system and modifying the system configuration of the branch system after the configuration management and control request passes the verification.
Each branch system opens a calling interface which is an HTTP protocol-based interface. The caller needs to modify the system configuration of the branch system through this interface. Each branch system is provided with a verification unit and a session credential generation unit, and the verification unit is used for verifying the identity of a caller; the session credential generating unit is used for generating a session credential which is legal on the branch system.
After the branch system issues the session credential to the central system, the central system first needs to use the session credential to perform a registration with the branch system, and after the registration is passed, the branch system records the host address of the central system and uses the host address as one of the bases for subsequently judging whether to allow the configuration interface to be called. The definition of the host address comprises the domain name or IP of the host, and both can be used as legal bases.
When the central system calls the configuration interface of the branch system, the session credentials of the branch system need to be carried in the request. When the branch system processes the interface request, the verification unit compares the source host address of the request with the recording host address, and when the source host address and the recording host address are consistent, the verification unit verifies whether the caller carries the session credential sent by the branch system, and if the caller does not carry the credential or carries the invalid credential, no setting operation is executed. The configuration of the branch system is mainly completed by three operations of setting, locking and unlocking. Specifically, the method comprises the following steps:
the setting of the present invention refers to setting of configuration of a branching system.
As shown in S1 in fig. 1, the setting process of the branch system by the central system is as follows:
1. the central system carries the session credentials of the branch system and the key-value pair combinations of a plurality of strategies to be configured to request the configuration interface of the branch system.
2. After the branch system receives the request from the central system, it checks the request source host address and compares it with the host address registered by the central system recorded by the branch system to judge if the request source comes from the registered central system
3. And if so, analyzing the key-value pair of each policy to be configured, calling through an internal interface, and applying each policy.
4. If not, no configuration setting is performed.
The locking of the present invention refers to setting the branch system configuration to a non-editable state.
The locking may be performed simultaneously with the setting or may be performed separately. When the setting is performed simultaneously, the central system needs to add an additional parameter indicating that locking is required in each configuration parameter, in addition to transferring the configuration parameters when the configuration interface of the branch system is called. When the locking is carried out independently, the central system does not transmit the configuration parameters when calling the configuration interface of the branch system, and only transmits the parameters which indicate the locking requirement. The locking parameters are determined according to the implementation convention, such as JSON format { locked: true }, etc.
Whether or not to proceed simultaneously with the setting, the branch system will check whether the configuration can be locked by the following procedure, as shown at S2 in fig. 1:
1. the request source host address is checked and compared with the host address registered by the central system recorded by the branch system to judge whether the request source is from the registered central system.
2. If so, the configuration is set to a locked state.
3. If not, no locking of the configuration is performed.
In the locked state, the branch system itself cannot edit or unlock the configuration. Only the central system that matches the locker can edit and unlock.
The unlocking of the present invention refers to setting the branch system configuration to an editable state.
As shown in S3 in fig. 1, when the unlocker calls the unlocking interface to unlock, the branch system checks whether the source of the request of the interface is consistent with the address of the host of the locker recorded in the system, and if so, that is, the unlocker is the locker, the configuration is set to be editable in the system.
Only the central system matched with the locker can be unlocked, and the branch system can not be unlocked.
Fig. 2 is a certain application scenario of the configuration management and control system among multiple service systems according to this embodiment of the present invention, and based on the features of the system of the present invention, three sets of service systems exist in the system of fig. 2, which are respectively deployed in shanghai, changsha, and new york. Each service system has an independent user system and can be operated and maintained independently. The Shanghai headquarters system is used as a central system, and the Changsha branch system and the New York branch system can be configured and controlled, including configuration setting, locking configuration and unlocking configuration. The Changsha branch system and the New York branch system are respectively provided with respective calling interfaces based on an HTTP protocol. The shanghai headquarters system is registered with the branch system as a central system in advance, and the branch system records the host address of the central system to be used as one of the bases for subsequently judging whether to allow the configuration interface to be called, in the embodiment, the session credential (authentication credential) of the changsha branch system is Eq19D1c, and the session credential (authentication credential) of the new york branch system is c9D1k 31. For configuration management and control of each branch system, the present embodiment sets: 1. the Shanghai headquarter system sets a login mode of using a password and a short message authentication code when a user of the Changsha branch system logs in. 2. The Shanghai headquarters system sets the New York Branch system to prohibit logging in using mobile devices.
The invention is suitable for deploying a plurality of sets of same service systems in a network environment, and the service systems can follow unified use rules and security strategies on the premise of ensuring that each set of service system can be independently operated and maintained so as to meet the management and control requirements of a group or an organization. One set of service system is used as a central system to carry out unified configuration on a plurality of sets of service systems, so that the cost of configuration management and control can be greatly reduced; the invention can control the configuration of the plurality of service systems by locking the configuration mode, and the locked configuration does not allow to be edited by systems (including branch systems) except the non-central system, thereby greatly improving the security of configuration management and control and not influencing the independent operation and maintenance capability of different service systems.
While the invention has been described with reference to specific embodiments, the invention is not limited thereto, and those skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope of the invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims (10)

1. A configuration management and control system among multiple service systems is used for deploying configuration management and control requirements of at least two sets of same service systems, and is characterized by comprising a central system consisting of one set of service systems and a plurality of branch systems consisting of the rest service systems, wherein the central system is used for setting configuration management and control rules for each branch system and uniformly controlling the configuration of each branch system in a locking configuration mode; the branch systems are used for receiving and verifying the configuration calling request of the caller, executing configuration operation by judging whether the configuration calling request passes the verification, and each branch system is respectively provided with a uniform calling interface through which the caller modifies the system configuration of the branch system.
2. The system according to claim 1, wherein the configuration operations on each of the branch systems include setting, locking, and unlocking, the branch system in the locked state is in a non-editable state, the branch system in the unlocked state is in an editable state, and the setting operation is a setting for configuring the branch system.
3. The system according to claim 1, wherein the call interface of each branch system is an HTTP protocol-based interface.
4. The system as claimed in claim 2, wherein each of the branch systems includes a verification unit and a session credential generation unit, the verification unit is configured to verify an identity of a caller; the session credential generating unit is used for generating a legal session credential on the branch system, the session credential is used for being distributed to the central system, and the central system utilizes the session credential distributed by the branch system to carry out verification on the verification unit of the branch system.
5. The system of claim 4, wherein the branch system generates a legal session credential by the session credential generating unit, and issues the session credential to the central system, and then the central system first registers with the branch system through the session credential, and after the registration is passed, the branch system records a host address of the central system, and the host address is one of the bases for subsequently determining whether to allow the configuration interface to be invoked.
6. The system of claim 5, wherein when the caller calls the call interface of the branch system, the interface request including the session credential carrying the branch system is sent to the branch system, and when the branch system processes the interface request, the verifying unit first compares the source host address of the interface request with the recorded host address, and when the source host address and the recorded host address are consistent, the verifying unit verifies whether the caller carries the session credential sent by the branch system, if the verification is valid, the relevant configuration logic is executed, and if the caller does not carry the credential or carries the invalid credential, no setting operation is executed.
7. The system according to claim 5, wherein the specific operation of performing the setting operation on the branch system is:
11) the central system carries the conversation credential of the branch system and the key value-value combination of a plurality of strategies required to be configured, and requests a branch system configuration interface;
12) after receiving the request of the central system, the branch system checks the host address of the request source, compares the host address with the host address registered by the central system and recorded by the branch system, judges whether the request source is from the registered central system, if so, analyzes the key value pair of each strategy to be configured, calls through an internal interface, applies each strategy, and if not, does not execute the configuration setting.
8. The system according to claim 2, wherein a separate locking operation is performed on the branch system or both the locking operation and the setting operation are performed on the branch system.
9. The system according to claim 5, wherein the specific operation of performing the locking operation on the branch system is:
the branch system checks the source host address of the call interface request and compares the source host address with the host address registered by the central system recorded by the branch system to judge whether the request source is from the registered central system; if yes, setting the configuration to be in a locking state; otherwise, locking of the configuration is not performed; after locking, the central system sets the central system matched with the locker as the only service end for editing and unlocking.
10. The system according to claim 5, wherein the specific operation of performing unlocking control on the branch system is:
when the unlocking person calls the calling interface of the branch system to unlock, the branch system detects whether the request source of the interface is consistent with the host address of the locking person recorded in the system, if so, the unlocking person is judged to be the locking person, and the central system sets the configuration of the branch system to be in an editable state.
CN202010217267.1A 2020-03-25 2020-03-25 Configuration management and control system among multi-service systems Pending CN111447090A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010217267.1A CN111447090A (en) 2020-03-25 2020-03-25 Configuration management and control system among multi-service systems

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010217267.1A CN111447090A (en) 2020-03-25 2020-03-25 Configuration management and control system among multi-service systems

Publications (1)

Publication Number Publication Date
CN111447090A true CN111447090A (en) 2020-07-24

Family

ID=71652442

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010217267.1A Pending CN111447090A (en) 2020-03-25 2020-03-25 Configuration management and control system among multi-service systems

Country Status (1)

Country Link
CN (1) CN111447090A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114281428A (en) * 2021-12-28 2022-04-05 挂号网(杭州)科技有限公司 Configuration method of service dictionary, electronic equipment and storage medium

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106302435A (en) * 2016-08-11 2017-01-04 上海泛微网络科技股份有限公司 A kind of based on grouping of the world economy classification decentralized management system
CN108959902A (en) * 2018-06-07 2018-12-07 北京百悟科技有限公司 A kind of mutli-system integration platform and method, computer readable storage medium

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106302435A (en) * 2016-08-11 2017-01-04 上海泛微网络科技股份有限公司 A kind of based on grouping of the world economy classification decentralized management system
CN108959902A (en) * 2018-06-07 2018-12-07 北京百悟科技有限公司 A kind of mutli-system integration platform and method, computer readable storage medium

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
NEWBUNNY: "gitlab 修改默认分支 及 分支保护", 《CSDN》 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114281428A (en) * 2021-12-28 2022-04-05 挂号网(杭州)科技有限公司 Configuration method of service dictionary, electronic equipment and storage medium

Similar Documents

Publication Publication Date Title
US20210314312A1 (en) System and method for transferring device identifying information
US8756423B2 (en) System and method for establishing a secure group of entities in a computer network
US8935398B2 (en) Access control in client-server systems
EP2790370B1 (en) Authentication method and system oriented to heterogeneous network
CN112822675B (en) MEC environment-oriented OAuth 2.0-based single sign-on mechanism
CN110781476A (en) Flexible micro-service security access control method and system
CN111314340B (en) Authentication method and authentication platform
US20070143408A1 (en) Enterprise to enterprise instant messaging
CN111147526B (en) Security authentication method for realizing multi-cloud control across public network
CN107426223B (en) Cloud document encryption and decryption method, cloud document encryption and decryption device and cloud document processing system
CN108881309A (en) Access method, device, electronic equipment and the readable storage medium storing program for executing of big data platform
CN110677407B (en) Safety control method of lightweight block chain platform
US11765167B2 (en) System and method for secure onboarding of network devices
CN109150800A (en) Login access method, system and storage medium
JP4904939B2 (en) Group participation management method, system and program
CN114928460A (en) Multi-tenant application integration framework system based on micro-service architecture
CN102333099B (en) Security control method and equipment
CN1481109A (en) Identity authentication system with dynamic cipher based on wireless transmission platform
CN111953491B (en) SSH Certificate and LDAP based two-step authentication auditing method
CN111447090A (en) Configuration management and control system among multi-service systems
CN116260656B (en) Main body trusted authentication method and system in zero trust network based on blockchain
CN102316119B (en) Security control method and equipment
CN113807700B (en) Method and system for issuing and receiving aircraft in-wing command scheduling based on block chain
KR100639992B1 (en) Security apparatus for distributing client module and method thereof
CN114615309B (en) Client access control method, device, system, electronic equipment and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20200724