A configuration file management tool and method

Abstract

This invention provides a configuration file management tool and method. The method includes: when the configuration file management tool receives a configuration file change request input by a user, it determines whether the user is online; if online, it sends the configuration file change request and user information to the approval end, which responds based on the configuration file change request and user information; if approval is received within a preset time limit, the configuration file is updated; if offline, the configuration file is updated when the user-provided temporary password is verified. This invention constructs a "secure sandbox" for configuration changes. All access to and modification of configuration files must be done through this tool. The tool enforces management policies through technical means while providing convenient interfaces to meet flexibility requirements.

Description

Technical Field

[0001] This invention belongs to the field of software engineering and operation and maintenance technology, and specifically relates to a configuration file management tool and method. Background Technology

[0002] Configuration files are a commonly used part of software systems, offering the advantage of allowing program behavior to be adjusted without modifying the code. However, in fields with extremely high stability and security requirements, such as finance and industrial control, arbitrary changes to configurations can lead to serious malfunctions or security incidents. Therefore, two common tendencies exist in the industry: 1) Over-control: Strictly prohibiting on-site modifications and requiring all changes to go through a rigorous and lengthy deployment process leads to sluggish configuration response and the loss of its inherent flexibility advantage.

[0003] 2) Lack of control: Direct modification is allowed, but there is a lack of effective version tracking, verification and authorization mechanisms, which makes configuration changes untraceable, prone to errors and difficult to roll back.

[0004] Existing configuration management tools (such as Ansible and Chef) focus more on batch deployment and state consistency, and do not adequately support the "controlled flexibility" of configuring individual instances at runtime. Meanwhile, pure version control tools (such as Git) lack tight integration with running applications and automatic verification capabilities. Therefore, there is an urgent need for a new type of tool that can strike a balance between control and flexibility. Summary of the Invention

[0005] This invention provides a configuration file management tool and method, aiming to solve the technical challenge of how to simultaneously retain the flexible and rapid response capability of configuration files in environments that require strict auditing and control of configuration changes.

[0006] The first aspect of this invention provides a configuration file management method, executed by a configuration file management tool; the method includes: When the configuration file management tool receives a configuration file change request from a user, it determines whether the user is online. If online, a configuration file change request and user information are sent to the approval end, which responds based on the request and information. If approval is received within a preset time limit, the configuration file is updated. If offline, the configuration file will be updated when the user-provided temporary password is verified. The configuration file update includes: storing configuration file change information in the incremental mapping processing module, storing the updated configuration file and its version information in the configuration file module, and generating a corresponding verification code for the updated configuration file and storing it in the configuration file verification code list.

[0007] Optionally, configuration file management methods also include: S101. When the application software corresponding to the configuration file runs independently or is invoked, read the corresponding configuration file according to the preset list of files to be verified; determine whether the configuration file is missing; if yes, proceed to S102; if no, proceed to S103. S102: Record the log and prompt the user. When a recovery command is received from the user, restore the missing configuration file from the incremental mapping processing module and proceed to S103. If no recovery command is received from the user, proceed directly to S103. S103. For each configuration file, generate a checksum and compare it with the stored corresponding checksum. If they match, the process ends. If they do not match, log the inconsistent configuration file and prompt the user. When a recovery command is received from the user, recover the corresponding configuration file from the incremental mapping processing module and generate the checksum again. If no recovery command is received, directly generate a checksum for the next configuration file. Continue until all configuration files have been traversed.

[0008] Optionally, the old configuration file is compressed and stored in the incremental mapping processing module, including: The old configuration file is encrypted using an encryption algorithm and then stored in binary format in the incremental mapping processing module. The key is provided by system environment variables or hardware security modules.

[0009] Optionally, configuration file management methods also include: A background monitoring thread continuously tracks changes in the attributes of managed files in the configuration file. When an attribute change occurs, a log is recorded and a notification is sent to the user.

[0010] Optionally, the configuration file change request may include the changed configuration file and a description of the change; The message agreeing to the change includes the approved configuration file and key synthesis. After passing the rule verification, the corresponding configuration file is stored in the incremental mapping processing module.

[0011] Optionally, updating the configuration file when the configuration file management tool is offline includes: Update the configuration file according to the changed configuration file in the configuration file change request, and store the changed configuration file in the configuration file change request into the incremental mapping processing module.

[0012] Optionally, when the method detects that the temporary password provided by the user has passed verification, it further includes: The approval process module records this transaction and marks it as not yet approved online. It will automatically initiate online approval once the transaction is online.

[0013] A second aspect of the present invention provides a configuration file management tool, characterized in that it is used to execute the method as described in any one of the first aspects.

[0014] This invention provides a configuration file management tool and method, which has the following beneficial effects: 1) Achieving a balance between contradictions: By using technical means, strict change management and convenient change operations are integrated, which satisfies compliance requirements while preserving operational efficiency.

[0015] 2) Improved system reliability: Automated verification, version management and recovery capabilities greatly reduce the risk of system failures caused by configuration errors or data loss.

[0016] 3) Enhanced security and auditability: All operations are authorized, logged, and traceable, further providing security guarantees for version files that are not stored in plaintext.

[0017] 4) Flexible deployment and strong adaptability: The pure C++ implementation and cross-platform design enable it to be widely deployed from embedded devices to cloud servers, and its support for offline and online modes allows it to adapt to complex network environments. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is an architecture diagram of the configuration file management tool of the present invention; Figure 2 This is a flowchart of the configuration change and approval process; Figure 3 This is a sequence diagram for configuration verification and exception handling. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] The features and illustrative embodiments of various aspects of the present invention will now be described in detail. Numerous specific details are set forth in the following detailed description to provide a thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention may be practiced without requiring some of these specific details. The following description of embodiments is merely intended to provide a better understanding of the invention by illustrating examples of the invention. The invention is by no means limited to any specific setups and methods set forth below, but covers any improvements, substitutions, and modifications to structures, methods, and devices without departing from the spirit of the invention. Well-known structures and techniques are not shown in the drawings and the following description to avoid unnecessarily obscuring the invention.

[0022] In the description of this invention, it should be noted that the directions or positional relationships indicated by terms such as "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer" are based on the directions or positional relationships shown in the accompanying drawings and are only for the convenience of describing and simplifying the invention, and should not be construed as limiting the invention. Furthermore, the use of ordinal numbers (e.g., "first and second," etc.) is for distinguishing objects and is not limited to this order, and should not be construed as indicating or implying relative importance.

[0023] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly, encompassing both direct connection and indirect connection via an intermediate medium. Those skilled in the art can understand the specific meaning of these terms in this invention based on the specific circumstances.

[0024] It should be noted that, unless otherwise specified, the embodiments of the present invention and the features thereof can be combined with each other, and the various embodiments can be referenced and cited in each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0025] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0026] Specifically, such as Figure 1-3 As shown, this invention proposes a configuration file management tool and method, aiming to resolve the inherent contradiction between the "strict control requirements" and "rapid modification convenience" of configuration files in the prior art. Specifically, it aims to solve the following problems: How can we ensure that every configuration change is recorded, traceable, and linked to the software upgrade process?

[0027] How to prevent unauthorized or accidental configuration modifications and ensure that any changes are explicitly detected by the system.

[0028] How can we provide authorized users with the ability to quickly and conveniently change configurations under the aforementioned strict controls, especially in scenarios requiring emergency response?

[0029] This invention provides a cross-platform configuration file management tool based on C++. Its core idea is to build a "secure sandbox" for configuration changes. All access to and modification of configuration files must be done through this tool. The tool enforces management policies through technical means while providing convenient interfaces to meet flexibility requirements. Figure 1 As shown, the system architecture of this tool mainly includes three modules: interaction interface, storage engine and management core.

[0030] The interaction interface consists of three parts.

[0031] 1) Human-computer interaction interface: Human-computer interaction for editing and managing configuration files, managing logins, and approving applications; 2) Application calls to the interface: Provide applications with programming interface services or functions for reading, writing, creating, and deleting configuration files; 3) Module interaction interface: It is used to transmit task requests and data feedback between the human-computer interaction interface, storage engine, and management core module.

[0032] The storage engine consists of four parts.

[0033] 1) Incremental mapping processing module: Used to provide version control capabilities for configuration files; 2) In the monitoring configuration file list: Used to store information such as the storage path and file name of configuration files currently used by the specified software and requiring control; not stored in plaintext. 3) List of configuration file verification codes: This is used to store the checksums of monitored configuration files from different historical versions. The checksums are not stored in plaintext. The checksums and their corresponding files are associated and managed through an incremental mapping module.

[0034] 4) Configuration file: Currently, configuration files in monitoring systems can be stored in either plaintext or invisible.

[0035] The core control system consists of two parts.

[0036] 1) Configuration file verification processing module: Based on the verification mode parameters and configuration file transmitted through the human-computer interaction interface, the corresponding verification method is called to generate a verification code for the configuration file; 2) Approval Processing Module: It provides an online approval interaction interface for communication with the approval system; and an offline approval identity and permission verification mechanism (such as generating a password consistent with the approver for offline confirmation). It can automatically switch the corresponding mode based on the current online status and notify the interaction interface to update the status.

[0037] The innovation of this invention lies in: 1) "Verification-Alarm-Recovery" Closed-Loop Control Mechanism: The tool not only records the version, but also actively monitors the status of the configuration file through verification codes (such as MD5). When an unauthorized modification or file loss is detected, an alarm can be triggered immediately and one-click recovery capability can be provided, changing the control from "post-event traceability" to "a combination of in-process intervention and post-event traceability".

[0038] 2) Scalable and Flexible Authorization and Approval Workflow: The tool has built-in basic login authorization functions and reserves an interface for an online approval module. In normal operations, changes require approval; in emergency scenarios, a fast-track approval channel or offline authorization mode can be activated, achieving flexibility in the control rules themselves.

[0039] 3) Application-oriented live API interface: The tool is deeply integrated with the calling application through rich APIs (such as providing configuration content and receiving parameters to write to the configuration), enabling the application to obtain or modify the configuration securely and in real time, ensuring the liveness of the configuration as an external data source.

[0040] In a specific embodiment, the configuration file management method includes the following: 1. Cross-platform adaptation and building The tool is written in standard C++ and uses CMake as its build system. Platform-dependent code is isolated using pre-compiled macros (such as `#ifdef _WIN32`). For example, file monitoring on Windows uses `ReadDirectoryChangesW`, and on Linux, it uses `inotify`. The core logic is platform-independent, ensuring consistent behavior on both x86 / ARM architecture Windows and Linux systems.

[0041] 2. Configuration file management and version control 1) When a user adds a configuration file to the management list via the GUI, the tool will immediately create an initial version for it and calculate the MD5 checksum.

[0042] 2) Every modification (addition, deletion, or modification) requires a mandatory change description, which is stored together with the version number (e.g., semantic version v1.2.3), timestamp, and operator.

[0043] 3) The version file is encrypted using an encryption algorithm (such as AES-256) and stored in binary format. The key is provided by system environment variables or hardware security module (HSM) to ensure that the file cannot be read directly even if it is illegally obtained.

[0044] like Figure 2 As shown, Figure 2 It is a configuration change and approval flowchart, showing the entire process from change initiation, approval (online / offline) to version recording.

[0045] 3. Verification, monitoring, and anomaly recovery 1) The tool has a built-in background monitoring thread that continuously tracks changes in the attributes of the managed files.

[0046] 2) When initiated by an application or launched independently, the tool automatically verifies the specified configuration file. If it does not match the latest record, the GUI will pop up a warning window, highlighting the inconsistent files and providing options such as "View Differences" and "Restore to a Specific Version".

[0047] 3) When launched by an application or started independently, it will scan all managed files. If a file is found to be missing and has no deletion record, the interface will prompt the user and the file can be recovered from the most recent version.

[0048] like Figure 3 As shown, Figure 3 It is a sequence diagram of configuration verification and exception handling, showing the interactive process of automatic verification, detection of inconsistencies and prompts after the tool is launched by the application.

[0049] 4. Security and Flexible Approval 1) The tool integrates a role-based access control module, which can configure different users' read, write, and approval permissions for various configuration files.

[0050] 2) Online Mode: Changes to critical configurations can be configured to require an online approval process. The tool calls external approval systems (such as WeChat Work or OA systems) through reserved interfaces, and can only execute the changes after approval is obtained.

[0051] 3) Offline Mode: To address emergency scenarios involving network outages, it supports rapid "self-approval" via pre-set offline authorization codes (such as time-based dynamic tokens TOTP), with logs subsequently synchronized to the approval system for future reference. This balances security and emergency response needs.

[0052] 4) In online mode, when sending a change request, the information sent includes the automatically identified changed configuration file and a description of the change. After approval, the returned information must include the approved configuration file and key combination. After passing the rule verification, the corresponding configuration file is stored in the storage engine module.

[0053] 5) In offline mode, the initiated change information includes the automatically identified changed configuration file and change description. After the entered temporary password is verified, the initiated changed configuration file enters the storage engine module.

[0054] 6) In offline mode, after the modified configuration file is verified by a temporary password and enters the storage engine module, the approval process module records the transaction and marks it as not having been approved online. Online approval will be automatically initiated after the system goes online.

[0055] 5. API integration with the main application software 1) Data supply: The main program can obtain configurations in various forms through API.

[0056] Key-value pair lookup, for example: `std::string get_config_value(const std::string&key);` Full text retrieval, for example: std::map<std::string, std::string> load_entire_config(); (Returns a data structure in memory) File handle: In scenarios where a file path is required, the tool can generate a temporary, decrypted copy of the configuration file for the application to read, and automatically clean it up after use.

[0057] 2) Data reception The main program can request to modify the configuration via an interface such as `int update_config(const std::string&key, const std::string&value);`. This request triggers the tool's complete workflow: permission verification → (if required) approval → modification of content → generation of a new version → logging. This ensures that even modifications made via the API are under strict control.

[0058] The above detailed embodiments are a description of the present invention. It should not be considered that the specific embodiments of the present invention are limited to these descriptions. For those skilled in the art, several simple deductions and substitutions can be made without departing from the concept of the present invention, and all of these should be considered to fall within the protection scope of the present invention.

Claims

1. A profile management method characterized by comprising: Executed by a configuration file management tool; the method includes: When the configuration file management tool receives a configuration file change request from a user, it determines whether the user is online. If online, a configuration file change request and user information are sent to the approval end, which responds based on the request and information. If approval is received within a preset time limit, the configuration file is updated. If offline, the configuration file will be updated when the user-provided temporary password is verified. The configuration file update includes: storing configuration file change information in the incremental mapping processing module, storing the updated configuration file and its version information in the configuration file module, and generating a corresponding verification code for the updated configuration file and storing it in the configuration file verification code list.

2. The configuration file management method according to claim 1, characterized in that, Also includes: S101. When the application software corresponding to the configuration file runs independently or is invoked, the corresponding configuration file is read according to the preset list of files to be verified. Determine if a configuration file is missing; if yes, proceed to S102; otherwise, proceed to S103. S102: Record the log and prompt the user. When a recovery command is received from the user, restore the missing configuration file from the incremental mapping processing module and proceed to S103. If no recovery command is received from the user, proceed directly to S103. S103. For each configuration file, generate a verification code and compare it with the stored corresponding verification code to see if they match. If all configuration files are consistent, the process ends; if they are inconsistent, logs are recorded for the inconsistent configuration files and a prompt is sent to the user. When a recovery command is received from the user, the corresponding configuration file is recovered from the incremental mapping processing module, and a checksum is generated again. If no recovery command is received, a checksum is generated directly for the next configuration file. This process continues until all configuration files have been traversed.

3. The configuration file management method according to claim 1, characterized in that, The old configuration files are compressed and stored in the incremental mapping processing module, including: The old configuration file is encrypted using an encryption algorithm and then stored in binary format in the incremental mapping processing module. The key is provided by system environment variables or hardware security modules.

4. The configuration file management method according to claim 1, characterized in that, The method further includes: A background monitoring thread continuously tracks changes in the attributes of managed files in the configuration file. When an attribute change occurs, a log is recorded and a notification is sent to the user.

5. The configuration file management method according to claim 1, characterized in that, The configuration file change request includes the changed configuration file and a description of the change; The message agreeing to the change includes the approved configuration file and key synthesis. After passing the rule verification, the corresponding configuration file is stored in the incremental mapping processing module.

6. The configuration file management method according to claim 5, characterized in that, Updating configuration files when the configuration file management tool is offline includes: Update the configuration file according to the changed configuration file in the configuration file change request, and store the changed configuration file in the configuration file change request into the incremental mapping processing module.

7. The configuration file management method according to claim 1, characterized in that, When the method detects that the temporary password provided by the user has been verified, it further includes: The approval process module records this transaction and marks it as not yet approved online. It will automatically initiate online approval once the transaction is online.

8. A configuration file management tool, characterized in that, Used to perform the method as described in any one of claims 1-7.

Images