WO2022062918A1

WO2022062918A1 - Control method for strategy implementation, strategy implementation system, and computing device

Info

Publication number: WO2022062918A1
Application number: PCT/CN2021/117706
Authority: WO
Inventors: 陈作朋; 李鹤
Original assignee: 统信软件技术有限公司
Priority date: 2020-09-25
Filing date: 2021-09-10
Publication date: 2022-03-31
Also published as: CN112202750A; CN112202750B

Abstract

Disclosed in the present invention is a control method for strategy implementation, performed in a strategy control device. The method comprises: receiving a strategy implementation request sent by a configuration platform, and determining, on the basis of the strategy implementation request, a strategy rule to be implemented; determining a device identifier for one or more terminals which implement the strategy rule; adding the strategy rule to a message queue on the basis of the device identifier of the one or more terminals, so as to send the strategy rule to the one or more terminals by means of the message queue; obtaining, from the message queue, an implementation result returned by each terminal after implementing the strategy rule; and sending the implementation result of each terminal to the configuration platform, so as to show the implementation result at the configuration platform. Also disclosed in the present invention are a corresponding strategy implementation system and a computing device. According to the technical solution of the present invention, each terminal can be controlled more conveniently and efficiently to implement the corresponding strategy rule.

Description

Policy execution control method, policy execution system and computing device

technical field

The present invention relates to the technical field of network communication, and in particular, to a control method for policy execution, a policy execution system and a computing device.

Background technique

With the strong support of national policies, more and more enterprises such as military industry, government, and banks have adopted localized operating systems. Most of the domestic operating systems are secondary developed on the basis of the Linux kernel. Therefore, for corporate offices, the security and centralized management of Linux systems are also being paid more and more attention.

In the prior art, Microsoft AD (Active Directory, Active Directory) is a directory service provided by Microsoft to the SERVER platform based on LDAP, which realizes centralized control and simplified management of resources through the domain mode. The AD domain is a large security boundary. As long as the user passes the authentication when logging in, all the resources allowed to be accessed in this domain can be directly accessed, without the need for separate authentication, thereby realizing resource sharing. For users, based on the AD domain, "My Documents" on the user's desktop can be redirected to the file server. On the one hand, user data can be backed up centrally to avoid user data loss due to system reinstallation or hardware damage; On the other hand, users can find their own data no matter which computer they log on to.

However, multi-level security policies are set in the AD domain, and each level of policy corresponds to different rules, resulting in a relatively complex overall security configuration in the AD domain, high thresholds, and high requirements for administrators' skills. On the other hand, the AD domain mainly relies on the Windows operating system, and cannot manage user policies based on the Linux operating system.

Therefore, a control method and a policy execution system for policy execution are required to solve the problems existing in the above technical solutions.

SUMMARY OF THE INVENTION

To this end, the present invention provides a method, system and computing device for controlling policy execution to solve or at least alleviate the above problems.

According to one aspect of the present invention, a method for controlling policy execution is provided, which is executed in a policy control device, the policy control device is connected to a configuration platform and is connected to one or more terminals, the method comprising: receiving a configuration platform The policy execution request sent, determine the policy rule to be executed based on the policy execution request; determine the device identification of one or more terminals that execute the policy rule; add the policy rule based on the device identification of one or more terminals to the message queue, so as to send the policy rule to the one or more terminals through the message queue; obtain the execution result returned by each terminal after executing the policy rule from the message queue; The execution result is sent to the configuration platform, so that the execution result is displayed on the configuration platform. The invention also discloses a corresponding policy execution system and computing device.

Optionally, in the method for controlling policy execution according to the present invention, before adding the policy rule to the message queue, the method further includes the step of: receiving a subscription request for the policy rule sent by one or more terminals based on the corresponding device identifier.

Optionally, the method for controlling policy execution according to the present invention further includes the steps of: receiving an identity authentication request sent by a terminal, and returning a corresponding access permission identifier to the terminal after the authentication is passed; The access permission identifies the sent access request.

Optionally, in the method for controlling policy execution according to the present invention, before receiving the identity authentication request sent by the terminal, the method includes the steps of: receiving a registration account request sent by the terminal; access account number and access password corresponding to the identity, so that the terminal sends an identity authentication request based on the corresponding access account number and access password.

Optionally, in the method for controlling policy execution according to the present invention, the policy control device includes: a policy server, connected to the configuration platform, and adapted to receive a policy execution request sent by the configuration platform; a message queue server, connected to the policy server and one or more terminals; and an access control server, connected to the policy server and one or more terminals, adapted to receive an identity authentication request sent by the terminal, and to send an authentication request to the terminal after passing the authentication A corresponding access permission identifier is returned, and it is adapted to receive an access request sent by the terminal based on the access permission identifier.

Optionally, in the method for controlling policy execution according to the present invention, the terminal is adapted to generate a corresponding device identifier based on hardware information, and the terminal includes: a pluggable authentication module (PAM), which is connected to the access control server , suitable for sending an identity authentication request to the access control server, and receiving the access permission identifier returned by the access control server; a process monitoring module (Agent), the process monitoring module is connected to the message queue server, and is suitable for terminal-based The device identifier obtains policy rules from the message queue; and a message bus module (DBUS), connected to the process monitoring module, is adapted to execute the policy rules.

Optionally, in the method for controlling policy execution according to the present invention, the message queue server is an NSQ message queue server; and the access control server is OpenLDAP.

Optionally, in the method for controlling policy execution according to the present invention, the policy includes one or more of an application customization policy, a desktop customization policy, a password policy, and a firewall policy.

According to one aspect of the present invention, there is provided a policy execution system, comprising: a policy control device adapted to execute the above method to control the execution of a policy; a configuration platform connected to the policy control device and adapted to report to the policy control device The policy control device sends a policy execution request, and is adapted to receive the execution result of each terminal returned by the policy control device, and display the execution result; and a plurality of terminal groups, each terminal group includes one or more terminals, The terminal is adapted to acquire the policy rule from the message queue based on the corresponding device identifier, execute the policy rule, and is adapted to send the execution result to the message queue.

Optionally, in the policy execution system according to the present invention, the policy control device includes: a policy server, connected to the configuration platform, and adapted to receive a policy execution request sent by the configuration platform; a message queue server, connected to the configuration platform The policy server and one or more terminals are connected; and the access control server is connected to the policy server and one or more terminals, and is adapted to receive an identity authentication request sent by the terminal, and return corresponding to the terminal after the authentication is passed. The access permission identifier is adapted to receive an access request sent by the terminal based on the access permission identifier.

Optionally, in the policy enforcement system according to the present invention, the access control server is further adapted to: receive a registration account request sent by the terminal; generate an access account and an account corresponding to the terminal user identity based on the registration account request. access password, so that the terminal sends an identity authentication request based on the corresponding access account number and access password.

Optionally, in the policy enforcement system according to the present invention, the terminal is adapted to generate a corresponding device identifier based on hardware information, and the terminal includes: a pluggable authentication module (PAM), connected to the access control server, adapted to to send an identity authentication request to the access control server, and receive the access permission identifier returned by the access control server; a process monitoring module (Agent), the process monitoring module is connected to the message queue server, and is suitable for terminal-based device identification Obtaining policy rules from the message queue; and a message bus module (DBUS), connected to the process monitoring module, adapted to execute the policy rules.

Optionally, in the policy execution system according to the present invention, the message queue server is an NSQ message queue server; and the access control server is OpenLDAP.

Optionally, in the policy execution system according to the present invention, the policy includes one or more of an application customization policy, a desktop customization policy, a password policy, and a firewall policy.

According to one aspect of the present invention, there is provided a computing device comprising: at least one processor; a memory storing program instructions, wherein the program instructions are configured to be adapted to be executed by the at least one processor, the program instructions comprising using Instructions for executing the control method of policy execution as described above.

According to one aspect of the present invention, there is provided a readable storage medium storing program instructions, which, when the program instructions are read and executed by a computing device, cause the computing device to execute the above-mentioned control method for policy execution.

According to the technical solution of the present invention, by providing a configuration platform for configuring and managing various policies, the configuration platform is connected to the policy control device, so that policy managers can configure corresponding policy rules for terminals through the configuration platform, and request policies The control device controls the corresponding terminal execution policy rules, and obtains the execution result of the terminal. In this way, by using the configuration platform for policy configuration, not only is the operation simple and the configuration efficiency high, but also it is beneficial to control each terminal to execute the corresponding policy rules more efficiently.

Further, the present invention can divide multiple terminals into multiple terminal groups based on the area where each terminal is located, and each terminal group includes one or more terminals arranged in a corresponding area, so that partition management of the terminals can be realized.

In addition, according to the method for controlling policy execution of the present invention, policy execution for controlling multiple terminal devices of the Linux operating system can be realized.

The above description is only an overview of the technical solutions of the present invention, in order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand , the following specific embodiments of the present invention are given.

Description of drawings

To achieve the above and related objects, certain illustrative aspects are described herein in conjunction with the following description and drawings, which are indicative of the various ways in which the principles disclosed herein may be practiced, and all aspects and their equivalents are intended to be within the scope of the claimed subject matter. The above and other objects, features and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout this disclosure, the same reference numbers generally refer to the same parts or elements.

FIG. 1 shows a schematic diagram of a policy enforcement system 100 according to an embodiment of the present invention;

FIG. 2 shows a schematic diagram of a computing device 200 according to one embodiment of the present invention; and

FIG. 3 shows a flowchart of a method 300 for controlling policy execution according to an embodiment of the present invention.

detailed description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be more thoroughly understood, and will fully convey the scope of the present disclosure to those skilled in the art.

FIG. 1 shows a schematic diagram of a policy enforcement system 100 according to an embodiment of the present invention.

As shown in FIG. 1 , the policy execution system 100 includes one or more terminals 110 , a configuration platform 150 and a policy control device 200 . Wherein, the policy control device 200 is connected in communication with the configuration platform 150, and is connected in communication with one or more terminals 110, for example, through a wired or wireless network connection. Here, the present invention does not limit the specific connection manner of the policy control device 200 with the configuration platform 150 and the terminal 110 .

The terminal 110 is a terminal device used by a user, which may specifically be a personal computer such as a desktop computer, a notebook computer, or a mobile phone, a tablet computer, a multimedia device, a smart wearable device, etc., but is not limited thereto.

In one embodiment, the terminal 110 may be a terminal device installed with a Linux operating system, but the present invention is not limited to the specific type of the operating system installed on the terminal 110 . It should be noted that, in the specific embodiment, the present invention only takes the Linux operating system as an example to specifically describe the policy execution system 100 . However, it should be understood that the policy execution system 100 of the present invention is not limited to the specific type of the operating system installed on the terminal.

In the embodiment of the present invention, the policy control device 200 may be used to control the terminal 110 to execute the policy. It can be implemented as a computing device such as a desktop computer, a notebook computer, a processor chip, a mobile phone, a tablet computer, etc., or can be implemented as a system composed of multiple computing devices.

The configuration platform 150 can be a Web platform provided for administrators (policy managers) to configure and manage various policies, and the administrator can access the configuration platform 150 through a browser. By connecting the configuration platform 150 to the policy control device 200, after the configuration platform 150 configures the policy rules for the terminal 110, the administrator can request the policy control device 200 to control the corresponding terminal to execute the policy rules through the configuration platform 150.

In one embodiment, the policy enforcement system 100 may include multiple terminal groups, and each terminal group is arranged with one or more terminals 110 . That is, each terminal 110 in the system 100 may be arranged in different terminal groups. In this way, the configuration platform 150 can configure corresponding policy rules for different terminal groups, and request the policy control device 200 to control each terminal 110 in the terminal group to execute the policy rules corresponding to the terminal group. It should be noted that each terminal group may correspond to a different area. Specifically, the present invention may divide multiple terminals 110 into multiple terminal groups based on the area where each terminal 110 is located, and each terminal group includes a layout within a corresponding area. One or more terminals 110, in this way, the partition management of the terminals can be realized.

In the embodiment of the present invention, the policy control device 200 is adapted to execute the control method of policy execution to control the terminal to execute the policy. The control method 300 of the policy execution of the present invention will be described in detail below.

In one embodiment, the policies that the policy control device 200 based on the present invention can control to be executed by the terminal include one or more of application customization policies, desktop customization policies, password policies, and firewall policies. However, the present invention is not limited to the types of strategies listed above.

In one embodiment, as shown in FIG. 1 , the policy control device 200 includes a policy server 250 , a message queue server 210 , and an access control server 220 . The policy server 250 is connected to the message queue server 210 and the access control server 220 respectively. Furthermore, the policy server 250 is connected with the configuration platform 150 , for example, through a registry connection, so that the policy server 250 can receive the policy execution request sent by the configuration platform 150 .

The message queue server 210 is connected to one or more terminals 110, and the message queue server 210 includes a message queue. Therefore, the policy server 250 establishes a communication connection with one or more terminals 110 through the message queue server 210, and performs asynchronous communication based on the message queue in the message queue server 210.

In one embodiment, the access control server 220 is connected to one or more terminals 110 . The access control server 220 may receive the identity authentication request sent by the terminal 110, and return the corresponding access permission identifier to the terminal 110 after the authentication is passed. Furthermore, the access control server 220 receives the access request sent by the terminal 110 based on the access permission identifier.

In one embodiment, before receiving the identity authentication request sent by the terminal 110, the access control server 220 may also receive a request for registering an account sent by the terminal 110. The access control server 220 may generate and store an access account and an access password corresponding to the user identity of the terminal 110 based on the registered account request, so that the terminal 110 sends an identity authentication request to the access control server 220 based on the corresponding access account and access password. In this way, the access control server 220 stores the access accounts and access passwords corresponding to the multiple terminals 110 , and also stores the information of the terminal group corresponding to each terminal 110 in the access control server 220 .

In one embodiment, the access control server is, for example, OpenLDAP, and the message queue server 210 is, for example, an NSQ message queue server, but the present invention is not limited thereto.

In one embodiment, the terminal 110 may generate a corresponding device identification based on the hardware information. The terminal 110 includes a pluggable authentication module (PAM), a process monitoring module (Agent), and a message bus module (DBUS).

As shown in FIG. 1 , a pluggable authentication module (PAM) is connected to the access control server 220, so that the terminal 110 can send an account registration request to the access control server 220 through the pluggable authentication module to obtain the corresponding access account number and access password. Further, the pluggable authentication module sends an identity authentication request to the access control server 220 based on the corresponding access account number and access password, receives the access permission identifier returned by the access control server 220, and sends an access request to the access control server 220 based on the access permission identifier to The identity authentication of the terminal 110 is completed, and the communication between the terminal 110 and the policy control device 200 is established. The pluggable authentication module includes an authentication management module (Auth), an account management module (Account), a session management module (Session), and a password management module (Password).

The process monitoring module (Agent) is connected to the message queue server 210, and communicates with the policy server 250 of the policy control device 200 through the message queue. The terminal 110 receives and sends messages through the process monitoring module. Specifically, the process monitoring module can obtain the corresponding policy rule from the message queue based on the device identification of the terminal 110, and can return the execution result of the terminal 110 executing the policy rule to the policy server 250 of the policy control device 200 through the message queue.

A message bus module (DBUS) may be used to enable communication between processes of the terminal 110 . The message bus module is connected with the process monitoring module. After the process monitoring module obtains the policy rules, the policy rules can be executed by calling the message bus module.

In one embodiment, policy enforcement system 100 also includes a data storage system 140 connected to policy server 250 . The data storage system 140 is, for example, a MySQL relational data storage system, but is not limited thereto. The data storage system 140 can store service data. The service data includes, for example, terminal group information, terminal information, user information, policy information, application information, behavior logs, etc., and can also store information among terminal groups, terminals, users, applications, and policies. Correspondence.

In one embodiment, the policy enforcement system 100 also includes a Redis memory coupled to the policy server 250 .

According to the policy execution system 100 of the present invention, by providing the configuration platform 150 for configuring and managing various policies, the configuration platform 150 is connected to the policy control device 200 , so that the policy administrator can configure the corresponding terminal 110 through the configuration platform 150 . and request the policy control device 200 to control the corresponding terminal 110 to execute the policy rule, and obtain the execution result of the terminal 110 . In this way, by using the configuration platform for policy configuration, not only is the operation simple and the configuration efficiency high, but also it is beneficial to control each terminal to execute the corresponding policy rules more efficiently.

Further, the present invention can divide multiple terminals 110 into multiple terminal groups based on the area where each terminal 110 is located, and each terminal group includes one or more terminals 110 arranged in a corresponding area. Partition management.

In one embodiment, the policy control device 200 of the present invention can be implemented as a computing device, so that the control method of the policy execution of the present invention can be executed in the computing device.

FIG. 2 shows a structural diagram of a computing device 200 according to an embodiment of the present invention. As shown in FIG. 2 , in a basic configuration 202 , computing device 200 typically includes system memory 206 and one or more processors 204 . Memory bus 208 may be used for communication between processor 204 and system memory 206 .

Depending on the desired configuration, the processor 204 may be any type of process, including but not limited to: a microprocessor (μP), a microcontroller (μC), a digital information processor (DSP), or any combination thereof. Processor 204 may include one or more levels of cache, such as L1 cache 210 and L2 cache 212 , processor core 214 , and registers 216 . Exemplary processor cores 214 may include arithmetic logic units (ALUs), floating point units (FPUs), digital signal processing cores (DSP cores), or any combination thereof. The example memory controller 218 may be used with the processor 204 , or in some implementations, the memory controller 218 may be an internal part of the processor 204 .

Depending on the desired configuration, system memory 206 may be any type of memory including, but not limited to, volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. System memory 106 may include an operating system 220 , one or more applications 222 , and program data 224 . Application 222 is actually a number of program instructions that instruct processor 204 to perform corresponding operations. In some implementations, the application 222 may be arranged to cause the processor 204 to operate with the program data 224 on the operating system.

Computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (eg, output device 242 , peripheral interface 244 , and communication device 246 ) to base configuration 202 via bus/interface controller 230 . Example output devices 242 include graphics processing unit 248 and audio processing unit 250 . They may be configured to facilitate communication via one or more A/V ports 252 with various external devices such as displays or speakers. Example peripheral interfaces 244 may include serial interface controller 254 and parallel interface controller 256, which may be configured to facilitate communication via one or more I/O ports 258 and input devices such as keyboard, mouse, pen, etc. , voice input devices, touch input devices) or other peripherals (eg printers, scanners, etc.) The example communication device 246 may include a network controller 260 that may be arranged to facilitate communication via one or more communication ports 264 with one or more other computing devices 262 over a network communication link.

A network communication link may be one example of a communication medium. Communication media may typically embody computer readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media. A "modulated data signal" can be a signal of which one or more of its data sets or whose alterations can be made in such a way as to encode information in the signal. By way of non-limiting example, communication media may include wired media, such as wired or leased line networks, and various wireless media, such as acoustic, radio frequency (RF), microwave, infrared (IR), or other wireless media . The term computer readable medium as used herein may include both storage media and communication media.

In the computing device 200 according to the present invention, the application 222 includes a plurality of program instructions for executing the policy execution control method 300, and these program instructions can instruct the processor 204 to execute the policy execution control method 300 of the present invention, so that the computing device 200 can pass The control method 300 for executing the policy of the present invention is executed to realize the control terminal to execute the policy.

FIG. 3 shows a flowchart of a method 300 for controlling policy execution according to an embodiment of the present invention. The method 300 is suitable for execution in a policy control device 200, such as the aforementioned computing device 200.

According to an embodiment of the present invention, the policy control device 200 is connected to the configuration platform 150 and is connected to one or more terminals 110 . Here, the terminal 110 is a terminal device used by the user. The configuration platform 150 can be a Web platform provided for administrators (policy managers) to configure and manage various policies, and the administrator can access the configuration platform 150 through a browser. By connecting the configuration platform 150 to the policy control device 200, after the configuration platform 150 configures the policy rules for the terminal 110, the administrator can request the policy control device 200 to control the corresponding terminal to execute the policy rules through the configuration platform 150.

In one embodiment, multiple terminals 110 may be arranged in different terminal groups. In this way, when controlling multiple terminals 110 to execute policies according to the method 300 of the present invention, the configuration platform 150 configures corresponding policy rules for different terminal groups to request the policy control device 200 to control the execution of each terminal 110 in the terminal group. The policy rule corresponding to this endpoint group. It should be noted that each terminal group may correspond to a different area. Specifically, the present invention may divide multiple terminals 110 into multiple terminal groups based on the area where each terminal 110 is located, and each terminal group includes a layout within a corresponding area. One or more terminals 110, in this way, the partition management of the terminals can be realized.

In one embodiment, the terminal 110 may be a terminal device installed with a Linux operating system, so that the policy execution control method 300 of the present invention can realize the control and management of the policy execution of multiple terminal devices installed with the Linux operating system , in other words, the method 300 for controlling policy execution of the present invention can control multiple terminal devices to execute corresponding policies based on the Linux operating system.

It should be noted that, in the specific embodiment, the present invention only takes the Linux operating system as an example to specifically describe the control method 300 for policy execution. However, it should be understood that the method 300 for controlling policy execution of the present invention is not limited to the specific type of the operating system installed on the terminal. Any type of operating system that can control the terminal execution policy through the method 300 of the present invention falls within the protection scope of the present invention.

It should also be noted that the policies that can be controlled by the terminal based on the method 300 of the present invention include one or more of an application customization policy, a desktop customization policy, a password policy, and a firewall policy. However, the present invention is not limited to the types of strategies listed above.

As shown in FIG. 3, the method 300 begins at step S310.

In step S310, a policy execution request sent by the administrator on the configuration platform 150 is received, and a policy rule to be executed is determined based on the policy execution request. Here, the administrator configures the policy rules to be executed for one or more terminals 110 on the configuration platform 150 and sends a policy execution request to the policy control device 200 to request the policy control device 200 to control these terminals 110 to execute the corresponding policy rules . Here, the policy rules include, for example, one or more of an application customization policy, a desktop customization policy, a password policy, and a firewall policy.

According to one embodiment, the administrator configures the policy rule on the configuration platform 150 based on the device identification of each terminal 110 that executes the policy rule, and sends the policy execution request. In this way, the policy execution request also includes device identifiers corresponding to one or more terminals 110 that execute policy rules.

Thus, in step S320, the policy control device 200 may determine the device identifiers of one or more terminals 110 that execute the policy rule according to the policy execution request.

According to an embodiment of the present invention, the policy control device 200 and one or more terminals 110 may implement asynchronous communication based on a message queue.

Subsequently, in step S330, the policy control device 200 adds the policy rule to the message queue based on the determined device identifiers of the one or more terminals 110, so as to send the policy rule to the corresponding one or more terminals 110 through the message queue , so that the corresponding terminal 110 can be controlled to execute the configured policy rule.

It should be noted that, based on the message queue, the policy control device 200 and one or more terminals 110 may perform data interaction in a publish-and-subscribe mode. Specifically, the terminal 110 may generate a corresponding unique device identifier based on its own hardware information, in other words, each terminal 110 corresponds to a device identifier capable of identifying the terminal 110 . In addition, the terminal 110 may send a subscription request based on its own device identification to subscribe to the corresponding topic message in the message queue, that is, to subscribe to the policy rule corresponding to the topic message.

In an example, before executing step S330, the policy control device 200 may receive a request for subscribing to corresponding policy rules sent by one or more terminals based on the device identifier. In this way, after the policy control device 200 encapsulates the policy rule based on the device ID of the terminal 110 into a topic message and adds it to the message queue, the terminal 110 can obtain the topic message and policy rule corresponding to its own device ID from the message queue.

After the policy control device 200 determines the device identifiers of one or more terminals 110 that execute the policy rule, when controlling these terminals 110 to execute the policy rule, it sends the message queue with the terminal 110 (device identifier) that needs to execute the policy rule. The corresponding topic message is implemented. Specifically, the policy control device 200 adds the topic message to the message queue by encapsulating the policy rule into a corresponding topic message based on the determined device identifiers of one or more terminals 110 . In this way, the terminal 110 that subscribes to the topic message based on its own device identifier (that is, the terminal 110 corresponding to the device identifier in the topic message) can obtain the topic message corresponding to its own device identifier from the message queue, thereby obtaining the topic The policy rule corresponding to the message. Further, one or more terminals 110 can execute corresponding policy rules.

Subsequently, in step S340, the policy control device 200 obtains the execution result returned by each terminal 110 after executing the policy rule from the message queue. Here, after executing the policy rule, each terminal 110 may encapsulate the execution result of the policy rule into a corresponding topic message and add it to the message queue. In this way, the policy control device 200 can acquire the topic message corresponding to each terminal 110 from the message queue to acquire the execution result of the policy rule corresponding to each terminal 110 .

Finally, in step S350 , the policy control device 200 sends the execution result of each terminal 110 to the configuration platform 150 , so that the configuration platform 150 displays the execution result of each terminal 110 .

According to one embodiment, the policy control device 200 includes a policy server 250 , a message queue server 210 , and an access control server 220 . The policy server 250 is connected to the message queue server 210 and the access control server 220 respectively. And, the policy server 250 is connected with the configuration platform 150 , so that the policy server 250 can receive the policy execution request sent by the configuration platform 150 .

The message queue server 210 is connected to one or more terminals 110, and the message queue server 210 includes a message queue. Therefore, the policy server 250 establishes a communication connection with one or more terminals 110 through the message queue server 210 , and performs asynchronous communication based on the message queue in the message queue server 210 .

According to one embodiment, the access control server 220 is connected to one or more terminals 110 . In the method 300 of the present invention, before step S310 is executed, the policy control device 200 may receive the identity authentication requests sent by one or more terminals 110 through the access control server 220, and return the corresponding access permission to the terminal 110 after the authentication is passed logo. Furthermore, the access control server 220 receives the access request sent by the terminal 110 based on the access permission identifier.

That is, before the policy control device 200 controls one or more terminals 110 to execute corresponding policy rules, the terminal 110 needs to send an identity authentication request to the policy control device 200, and the access control server 220 receives the identity authentication request of the terminal 110 , Perform identity authentication on the terminal 110 . After the terminal 110 passes the identity authentication, the access control server 220 returns the corresponding access permission identifier to the terminal 110 . Further, the terminal 110 can send an access request to the policy control device 200 (the policy server 250 ) based on the access permission identifier, so as to perform data interaction with the policy control device 200 (the policy server 250 ), so as to subscribe to the corresponding topic message based on the device identifier, Obtain policy rules, execute policy rules, and return execution results.

According to an embodiment, before receiving the identity authentication request sent by the terminal 110, the policy control device 200 further receives the account registration request sent by the terminal 110 through the access control server 220. Further, the access control server 220 generates an access account and an access password corresponding to the user identity of the terminal 110 based on the registered account request, so that the terminal 110 sends an identity authentication request to the access control server 220 based on the corresponding access account and access password. In this way, the access control server 220 stores the access accounts and access passwords corresponding to the multiple terminals 110 , and also stores the information of the terminal group corresponding to each terminal 110 in the access control server 220 .

Wherein, as shown in FIG. 1, a pluggable authentication module (PAM) is connected to the access control server 220, so that the terminal 110 can send a registration account request to the access control server 220 through the pluggable authentication module to obtain the corresponding access account and access control password. Further, the pluggable authentication module sends an identity authentication request to the access control server 220 based on the corresponding access account number and access password, receives the access permission identifier returned by the access control server 220, and sends an access request to the access control server 220 based on the access permission identifier to The identity authentication of the terminal 110 is completed, and the communication between the terminal 110 and the policy control device 200 is established. The pluggable authentication module includes an authentication management module (Auth), an account management module (Account), a session management module (Session), and a password management module (Password).

The process monitoring module (Agent) is connected to the message queue server 210, and communicates with the policy server 250 of the policy control device 200 through the message queue. The terminal 110 receives and sends messages through the process monitoring module. Specifically, the process monitoring module can obtain the corresponding policy rules from the message queue based on the device identification of the terminal 110, and can return the execution result of the terminal 110 executing the policy rules to the policy server 250 of the policy control device 200 through the message queue.

According to the control method 300 of policy execution of the present invention, by providing the configuration platform 150 for configuring and managing various policies, the configuration platform 150 is connected to the policy control device 200 , so that the policy administrator can use the configuration platform 150 for the terminal 110 Configure the corresponding policy rule, and request the policy control device 200 to control the corresponding terminal 110 to execute the policy rule, and obtain the execution result of the terminal 110 . In this way, by using the configuration platform for policy configuration, not only is the operation simple and the configuration efficiency high, but also it is beneficial to control each terminal to execute the corresponding policy rules more efficiently.

Further, the present invention can divide multiple terminals 110 into multiple terminal groups based on the area where each terminal 110 is located, and each terminal group includes one or more terminals 110 arranged in a corresponding area. Partition management. The various techniques described herein can be implemented in conjunction with hardware or software, or a combination thereof. Thus, the method and apparatus of the present invention, or certain aspects or portions of the method and apparatus of the present invention, may take the form of an embedded tangible medium, such as a removable hard disk, a USB stick, a floppy disk, a CD-ROM, or any other machine-readable storage medium. in the form of program code (ie, instructions) that, when the program is loaded into a machine, such as a computer, and executed by the machine, the machine becomes an apparatus for practicing the invention.

Where the program code is executed on a programmable computer, the mobile terminal generally includes a processor, a storage medium readable by the processor (including volatile and nonvolatile memory and/or storage elements), at least one input device, and at least one output device. Wherein, the memory is configured to store program codes; the processor is configured to execute the control method for policy execution of the present invention according to the instructions in the program codes stored in the memory.

By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media store information such as computer readable instructions, data structures, program modules or other data. Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. Combinations of any of the above are also included within the scope of readable media.

In the specification provided herein, the algorithms and displays are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems may also be used with examples of the present invention. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not directed to any particular programming language. It is to be understood that various programming languages may be used to implement the inventions described herein, and that the descriptions of specific languages above are intended to disclose the best mode for carrying out the invention.

In the description provided herein, numerous specific details are set forth. It will be understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or its description. This disclosure, however, should not be interpreted as reflecting an intention that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will appreciate that the modules or units or components of the apparatus in the examples disclosed herein may be arranged in the apparatus as described in this embodiment, or alternatively may be positioned differently from the apparatus in this example in one or more devices. The modules in the preceding examples may be combined into one module or further divided into sub-modules.

Those skilled in the art will understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and further they may be divided into multiple sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination unless at least some of such features and/or procedures or elements are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that although some of the embodiments described herein include certain features, but not others, included in other embodiments, that combinations of features of different embodiments are intended to be within the scope of the invention within and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

Furthermore, some of the described embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other means for performing the described functions. Thus, a processor having the necessary instructions for implementing the method or method element forms means for implementing the method or method element. Furthermore, an element of an apparatus embodiment described herein is an example of a means for carrying out the function performed by the element for the purpose of carrying out the invention.

As used herein, unless otherwise specified, the use of the ordinal numbers "first," "second," "third," etc. to describe common objects merely refers to different instances of similar objects, and is not intended to imply such The objects being described must have a given order in time, space, ordinal, or in any other way.

While the invention has been described in terms of a limited number of embodiments, those skilled in the art will appreciate, having the benefit of the above description, that other embodiments are conceivable within the scope of the invention thus described. Furthermore, it should be noted that the language used in this specification has been principally selected for readability and teaching purposes, rather than to explain or define the subject matter of the invention. Accordingly, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. This disclosure is intended to be illustrative and not restrictive with regard to the scope of the present invention, which is defined by the appended claims.

Claims

A method for controlling policy execution, executed in a policy control device, the policy control device being connected to a configuration platform and connected to one or more terminals, the method comprising:

Receive a policy execution request sent by the configuration platform, and determine a policy rule to be executed based on the policy execution request;

determining the device identity of one or more terminals that execute the policy rule;

adding the policy rule to a message queue based on the device identifiers of one or more terminals, so as to send the policy rule to the one or more terminals through the message queue;

Obtain the execution result returned by each terminal after executing the policy rule from the message queue; and

Send the execution result of each terminal to the configuration platform, so as to display the execution result on the configuration platform.
The method of claim 1, wherein before adding the policy rule to the message queue, further comprising the step of:

A subscription request for policy rules sent by one or more terminals based on the corresponding device identifier is received.
The method of claim 1, further comprising the step of:

Receive the identity authentication request sent by the terminal, and return the corresponding access permission identifier to the terminal after the authentication is passed; and

An access request sent by the terminal based on the access permission identifier is received.
The method according to claim 3, wherein before receiving the identity authentication request sent by the terminal, the method comprises the steps of:

Receive a request for registering an account sent by the terminal; and

An access account number and an access password corresponding to the terminal user identity are generated based on the registered account request, so that the terminal sends an identity authentication request based on the corresponding access account number and access password.
The method of claim 3, wherein the policy control device comprises:

a policy server, connected to the configuration platform, adapted to receive a policy execution request sent by the configuration platform;

a message queue server connected to the policy server and one or more terminals; and

An access control server, connected to the policy server and one or more terminals, adapted to receive an identity authentication request sent by the terminal, and to return a corresponding access permission identifier to the terminal after passing the authentication, and adapted to receive the terminal An access request sent based on the access permission identifier.
The method of claim 5, wherein the terminal is adapted to generate a corresponding device identification based on hardware information, the terminal comprising:

A pluggable authentication module (PAM), connected to the access control server, adapted to send an identity authentication request to the access control server, and receive an access permission identifier returned by the access control server;

a process monitoring module (Agent), the process monitoring module is connected to the message queue server, and is adapted to obtain policy rules from the message queue based on the device identification of the terminal; and

A message bus module (DBUS), connected to the process monitoring module, is adapted to execute the policy rules.
The method of claim 5 or 6, wherein,

The message queue server is an NSQ message queue server;

The access control server is OpenLDAP.
The method according to any one of claims 1-7, wherein the policy includes one or more of an application customization policy, a desktop customization policy, a password policy, and a firewall policy.
A policy enforcement system comprising:

a policy control device adapted to execute the method according to any one of claims 1-8 to control the execution of the policy;

a configuration platform, connected to the policy control device, adapted to send a policy execution request to the policy control device, and adapted to receive the execution result of each terminal returned by the policy control device, and to display the execution result; and

Multiple terminal groups, each terminal group includes one or more terminals, the terminals are adapted to obtain policy rules from the message queue based on the corresponding device identifiers, execute the policy rules, and are adapted to send the execution results to the message queue.
The system of claim 9, wherein the policy control device comprises:

a policy server, connected to the configuration platform, adapted to receive a policy execution request sent by the configuration platform;

a message queue server connected to the policy server and one or more terminals; and

An access control server, connected to the policy server and one or more terminals, adapted to receive an identity authentication request sent by the terminal, and to return a corresponding access permission identifier to the terminal after passing the authentication, and adapted to receive the terminal An access request sent based on the access permission identifier.
The system of claim 10, wherein the access control server is further adapted to:

Receive a request for registering an account sent by the terminal;

An access account number and an access password corresponding to the terminal user identity are generated based on the registered account request, so that the terminal sends an identity authentication request based on the corresponding access account number and access password.
The system according to claim 10 or 11, wherein the terminal is adapted to generate a corresponding device identification based on hardware information, and the terminal comprises:

A pluggable authentication module (PAM), connected to the access control server, adapted to send an identity authentication request to the access control server, and receive an access permission identifier returned by the access control server;

a process monitoring module (Agent), the process monitoring module is connected to the message queue server, and is adapted to obtain policy rules from the message queue based on the device identification of the terminal; and

A message bus module (DBUS), connected to the process monitoring module, is adapted to execute the policy rules.
The system of any of claims 10-12, wherein,

The message queue server is an NSQ message queue server;

The access control server is OpenLDAP.
The system of any of claims 9-13, wherein the policy comprises:

Apply one or more of Custom Policy, Desktop Custom Policy, Password Policy, and Firewall Policy.
A computing device comprising:

at least one processor; and

a memory storing program instructions, wherein the program instructions are configured to be adapted to be executed by the at least one processor, the program instructions comprising means for performing the method of any of claims 1-8 instruction.
A readable storage medium storing program instructions which, when read and executed by a computing device, cause the computing device to perform the method according to any one of claims 1-8.