CN102075357B

CN102075357B - Multi-domain security management method for network management system

Info

Publication number: CN102075357B
Application number: CN 201010621252
Authority: CN
Inventors: 张珏; 曹东
Original assignee: Wuhan NEC Fiber Optic Communications Industry Co Ltd
Current assignee: Wuhan NEC Fiber Optic Communications Industry Co Ltd
Priority date: 2010-12-31
Filing date: 2010-12-31
Publication date: 2013-05-08
Anticipated expiration: 2030-12-31
Also published as: CN102075357A

Abstract

The invention provides a multi-domain security management method for a network management system, which comprises the following steps of: 1) creating one or more logic security management domains; 2) distributing network elements to corresponding logic security management domains; 3) creating a user group and assigning different users to the user groups; 4) creating an operating rights set; 5) specifying the rights set for the logic security management domains and establishing an association relation of the logic security management domains and the operating rights set; and 6) specifying an association relation of the one or more logic security management domains and the operating rights set for the user group, and finally establishing an association relation of the user group, the logic security management domains and the operating rights set. By the method, a problem of control in different domains by different rights in the network management system is solved, and different rights in different management domains are distributed to the users flexibly.

Description

Multi-domain security management method for network management system

Technical field

The present invention relates to SDH (SDH (Synchronous Digital Hierarchy))/MSTP (based on the multi-service transport platform of SDH)/PTN (Packet Transport Network) transmission network, pay close attention to the Authority and Domain Based Management management of network management system, control flexibly user right, stop undelegated customer access network resource and Network Management Function.

Background technology

In recent years, along with the transmission network scale constantly enlarges, the transmission network of telecom operators had formed many producers, the situation of transmitting more and depositing.The equipment of transmission network management centralized management all kinds and each producer, real-time monitoring warning and performance, the configuration diverse network connects and business.Because transmission network management is centralized management, and the function of the scope of management and realization is more and more, therefore the safety management of webmaster is proposed higher requirement.User expectation provides control of authority means flexibly, for designated user is given one or more operating right.

The various types of equipment of the various producers of management in network management system, and be distributed in different physical regions.User expectation has different administration authorities to different zones, for example there is the modification authority in the A territory, to the B territory only checking authority.Configure user authority and control its operation, facilitate the control of authority management so flexibly, improves Security of the system.

The prior art relevant with the present invention, its technical scheme one is as follows:

The granularity of control of authority is the territory, and binds with the physical domain of true environment, and a user's authority is for specific one or more physical domain.

Can be found out by technique scheme, there is following defective in prior art scheme one:

User right directly and the physical domain binding, may scene and exist: the user has operating right to some some network element of physical domain A, and some network element of territory B is had operating right, the user authority setting management area just has problems under this scene.

Technical scheme two:

The granularity of control of authority is network element, and user's authority arranges for each network element.

Can be found out by technique scheme, there is following defective in the prior art scheme:

It is loaded down with trivial details that user right distributes, and need to carry out right assignment and control for each network element, and exist a large amount of redundant informations.

Summary of the invention

Technical problem to be solved by this invention is: a kind of multi-domain security management method for network management system is provided, and by this method, in the solution network management system, authority control problem is divided in a minute territory, gives flexibly the different rights of the different management domains of user assignment.

The technical solution adopted in the present invention is: multi-domain security management method for network management system comprises:

S1) create one or more logical security management domain;

S2) distribute network element to corresponding logical security management domain;

S3) create user's group, assign different user to this user's group;

S4) creation operation authority set;

S5) to the set of logical security management domain specified right, set up the incidence relation of logical security management domain-operating right set;

S6) user is organized the incidence relation of specifying one or more logical security management domains-operating right set, finally set up the incidence relation of user's group-logical security management domain-operating right set.

The logical security management domain of described step S1 is virtual domain logic, and it comprises the network element of one or more physical domain.

User's group of described step S3 comprises keeper, Systems Operator and observer.These user's groups are system default values, can also be according to user's oneself requirements definition New Consumers group.

The operating right set of described step S4 comprises system, operates and checks authority set.

Described System Privileges collection comprises system manager's relevant operating right item, for example comprises that network element operating right item, network element check that authority items, business operations competence item, business check authority items and user's operating right item; The operating right collection comprises that network element operating right item, network element check that authority items, business operations competence item and business check authority items; Check that authority set comprises that network element checks that authority items and business check authority items.

Described network element checks that authority items comprises the operation of checking network element attribute, checking network element state, and network element operating right item comprises the operation that creates NE, deletes network element and revise network element.

The incidence relation of user's group-logical security management domain of described step S6-operating right set comprises: administrator's group-all logical security management domain-System Privileges collection, operator user's group-all logical security management domain-operating right collection, and observer user's group-all domain logics-check authority set.

Advantage of the present invention: in network management system, the method has solved the subject matter of minute territory safety, for different user, provides rights management mechanism flexibly.

At first it has solved the binding of safety and physical domain, and without any related, the user can assign the range of management of network element to the scope of user management network element flexibly with physical address.Secondly, it has reduced the operating time of security configuration, need to not carry out independent authority configuration for each network element, only uses the logical security management domain is unified configure user group and authority set, alleviates the servicing time.

Description of drawings

Fig. 1 is key diagram of the present invention.

Fig. 2 is normal flow figure of the present invention.

Fig. 3 is authority incidence relation figure of the present invention.

Embodiment

At first create virtual logical security management domain (this territory and physical domain are not contacted directly, and the logical security management domain can be regarded the set of a group NEs as, but the network element in this set can belong to respectively different physical domain) according to user's needs; Then according to user's actual safety management demand, the physical NE of different physical domain is divided in this logic manage territory; Create user's group, add the associated user to this user's group; Give different safety management authorities to the logical security management domain at last, and the contact of designated user group and logical security management domain.The user just can manage different network elements in various different physical domain flexibly according to actual conditions like this, and different equipment is had different operating right set, satisfies minute territory decentralized management requirement of webmaster.

The invention provides following technical scheme:

This programme mainly comprises following concept:

1. network element: true physical equipment and Virtual NE equipment.

2. physical domain: real equipment control territory, generally divide according to the region, for example all physical equipments of Wuhan City can be regarded a physical domain as.

3. logical security management domain: virtual logical security management domain out, be mainly used in user's security control, virtual Domain and physical domain are not contacted directly, and he is the set of a group NEs, the network element that can comprise different physical domain, can the flexible assignment network element in domain logic.

Example: domain logic=network element 1, network element 24 ...

4. user: real user.

5. the user organizes: one group of user's set with identity logic safety management domain and identical authority.

Example: user's group=keeper, the Systems Operator ...

The user organizes that the default administrator of having organizes, operator user's group and observer user's group etc., and the user can also self-defined user's group.

6. authority items: the set of operating right can configure according to the function granularity.

Example: network element operating right item=create NE, the deletion network element is revised network element ...

7. authority set: distribute to the set of user function authority items.

Example: keeper's operating right collection=network element operating right item, the business operations competence item ...

Wherein, action-item is that system is self-defining, and action-item is the set of operation; Authority set is the set of action-item, and which action-item the user can select see the following form 1～3.

The authority items that table 1 authority set comprises

Annotate: the authority set system default has system, operates, checks authority set etc.OAM refers to Operations, Administration and Maintenance.

The operational set that table 2 authority items comprises

The authority key name	Operational set
		Network element operating right item	Create NE, the deletion network element is revised network element .. etc.
Network element is checked authority	Check network element attribute, check network element state .. etc.

Annotate: by system definition, the user can not be self-defined according to the function granularity for authority items.

Table 3 user organizes the incidence relation of corresponding domain logic-authority set

User's group name	Domain logic: corresponding authority set
		Administrator's group	All network element domain logics: System Privileges collection
Operator user's group	All network element domain logics: operating right collection
		Observer user's group	All network element domain logics: check authority set
User Defined group 1	Domain logic A: System Privileges collection

User Defined group 2

Domain logic A: operating right collection; Domain logic B: check authority set

Annotate: authority is user's group, domain logic, operating right collection three incidence relation at last.

This mechanism mainly comprises the steps:

S1) at first create one to a plurality of domain logics according to user's request.

S2) then according to user's actual requirement, the network element of different physical domain is divided in different domain logics.

S3) create user's group, and assign the associated user in user's group.

S4) create the authority set (the authority set acquiescence has the keeper, operator, observer etc.) of different authority set or use system default.

S5) different logical security management domains is distributed different authority set.

S6) one or more logical securities territories (containing operating right collection relation) are assigned to particular group of users.

Embodiment:

For a kind of webmaster right management method is provided, by this method, in the solution network management system, authority control problem is divided in a minute territory, gives flexibly the different rights of the different management domains of user assignment.

Normal flow of the present invention is as follows:

Step 1: create the logical security territory.

Step 2: distribute network element to the logical security territory.

Step 3: creation operation authority set.

Step 4: virtual Domain is formulated the authority set.

Step 5: the user is specified virtual Domain and authority set.

Claims

1. multi-domain security management method for network management system is characterized in that comprising:

S1) create one or more logical security management domain; Described logical security management domain is virtual domain logic, and it comprises the network element of one or more physical domain;

S3) create user's group, assign different user to this user's group;

S4) creation operation authority set;

2. method according to claim 1 is characterized in that: user's group of step S3 comprises keeper, Systems Operator and observer.

3. method according to claim 1, it is characterized in that: the operating right set of step S4 comprises system, operates and checks authority set.

4. method according to claim 3 is characterized in that: the System Privileges collection comprises that network element operating right item, network element check that authority items, business operations competence item, business check authority items and user's operating right item; The operating right collection comprises that network element operating right item, network element check that authority items, business operations competence item and business check authority items; Check that authority set comprises that network element checks that authority items and business check authority items.

5. method according to claim 4, it is characterized in that: network element checks that authority items comprises the operation of checking network element attribute, checking network element state, network element operating right item comprises the operation that creates NE, deletes network element and revise network element.

6. according to claim 2 or 3 described methods, it is characterized in that: the incidence relation of user's group-logical security management domain of step S6-operating right set comprises: administrator's group-all logical security management domain-System Privileges collection, operator user's group-all logical security management domain-operating right collection, and observer user's group-all domain logics-check authority set.