Application information configuration method and device

Abstract

The present invention provides an application information configuration method and device, the method comprising: a framework program locates a corresponding confidential configuration file according to a user type, wherein the user type includes one of the following: a production user, a common user; the framework program obtains a sensitive information identifier of the application configuration from an application configuration file of a target application to be started; the framework program obtains a configuration item corresponding to the sensitive information identifier from the confidential configuration file, and exports the configuration item as an environment variable of the target application; the framework program starts the target application according to the application configuration file, and passes the environment variable to the target application. Through the present invention, the framework program locates different confidential configuration files to pass sensitive information to the application, thereby achieving the effect of improving the security of application information.

Description

Technical Field

[0001] The present invention relates to the field of application configuration, and in particular to an application information configuration method and device. Background Art

[0002] Many applications need to configure some sensitive information, such as database link address and port, user name, password, etc. The practice in the prior art is to write this information into the program's configuration file. However, this method has great problems in terms of security and ease of use. First of all, everyone who has access to the program and code can see this sensitive information, which is very unsafe. Secondly, when the development environment and the production environment are running, if this information is different, the program or configuration needs to be modified when the program goes online. Thirdly, when multiple applications use the same account information, if the account information changes, the programs or configurations of all related applications need to be modified, which is a lot of work and prone to errors. Summary of the invention

[0003] The embodiment of the present invention provides an application information configuration method and device, so as to at least solve the problem of insecurity caused by easy leakage of sensitive information in the configuration file of the application program in the related art.

[0004] According to an embodiment of the present invention, there is provided an application information configuration method, comprising: a framework program locates a corresponding confidential configuration file according to a user type, wherein the user type comprises one of the following: a production user, a common user; the framework program obtains a sensitive information identifier of the application configuration from an application configuration file of a target application to be started; the framework program obtains a configuration item corresponding to the sensitive information identifier from the confidential configuration file, and exports the configuration item as an environment variable of the target application; the framework program starts the target application according to the application configuration file, and passes the environment variable to the target application.

[0005] Optionally, before the framework program locates the corresponding confidential configuration file according to the user type, the process further includes: configuring the corresponding confidential configuration file according to different user types, wherein the configuration formats of the confidential configuration files of different user types are the same.

[0006] Optionally, configuring corresponding confidential configuration files according to different user types includes: the system administrator configures the confidential configuration file of the production user, the confidential configuration files of all production users are centrally managed, and the permissions are set to be readable only by production users; the ordinary user configures the confidential configuration file of the current user, the configuration file is stored in the user directory of the current user, and the permissions are set to be visible only to the current user.

[0007] Furthermore, the framework program starts the target application according to the application configuration file and passes the environment variables to the target application, including: the framework program starts the target application according to the application type and path configured in the application configuration file, and sets the permissions of the environment variables to be visible to the target application.

[0008] Optionally, after the framework program starts the target application according to the application configuration file and passes the environment variable to the target application, the target application references the corresponding environment variable during operation.

[0009] Optionally, the sensitive information identifier is identified as globally unique.

[0010] Optionally, the sensitive information includes at least one of the following: account number, password, data type, data address.

[0011] According to another embodiment of the present invention, there is provided an application information configuration device, comprising: a positioning module, used to locate a corresponding confidential configuration file according to a user type, wherein the user type comprises one of the following: a production user, a common user; a first acquisition module, used to obtain a sensitive information identifier of the application configuration from an application configuration file of a target application to be started; a second acquisition module, used to obtain a configuration item corresponding to the sensitive information identifier from the confidential configuration file, and export the configuration item as an environment variable of the target application; a startup module, used to start the target application according to the application configuration file, and pass the environment variable to the target application.

[0012] According to yet another embodiment of the present invention, a storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when running.

[0013] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0014] Through the above-mentioned embodiments of the present invention, since the framework program locates the corresponding confidential configuration file according to different user types, thereby passing the sensitive information in the application configuration to the application, it is possible to solve the insecurity problem caused by the easy leakage of sensitive information in the configuration file of the application in the related technology, thereby achieving the effect of improving the security of application information. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0016] Figure 1 is a flow chart of an application information configuration method according to an embodiment of the present invention;

[0017] Figure 2 is a flowchart of an application information configuration method according to an optional embodiment of the present invention;

[0018] Figure 3 is a structural block diagram of an application information configuration device according to an optional embodiment of the present invention;

[0019] Figure 4 is a configuration format diagram of a confidential configuration file according to an embodiment of the present invention;

[0020] Figure 5 is a flow chart of a method for configuring an application account according to an optional embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] In order to better understand the technical solutions of the embodiments and optional embodiments of the present invention, the following describes possible application scenarios of the embodiments and optional embodiments of the present invention, but is not intended to limit the application of the following scenarios.

[0024] Example 1

[0025] In this embodiment, a method for configuring application information is provided. Figure 1 is a flow chart of an application information configuration method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0026] Step S102, the framework program locates the corresponding confidential configuration file according to the user type, wherein the user type includes one of the following: production user, ordinary user;

[0027] Step S104, the framework program obtains the sensitive information identifier of the application configuration from the application configuration file of the target application to be started;

[0028] Step S106, the framework program obtains the configuration item corresponding to the sensitive information identifier from the confidential configuration file, and exports the configuration item as an environment variable of the target application program;

[0029] Step S108: the framework program starts the target application according to the application configuration file and passes the environment variables to the target application.

[0030] Before step S102 of this embodiment, the method may further include: configuring corresponding confidentiality configuration files according to different user types, wherein the configuration formats of the confidentiality configuration files of different user types are the same.

[0031] In this embodiment, step S102 may include: the system administrator configures the confidential configuration file of the production user, the confidential configuration files of all production users are centrally managed, and the permissions are set to be readable only by the production users; the ordinary user configures the confidential configuration file of the user, the configuration file is stored in the user directory of the user, and the permissions are set to be visible only to the user.

[0032] In this embodiment, the sensitive information identifier may be globally unique.

[0033] In this embodiment, the sensitive information may include at least one of the following: account number, password, data type, and data address.

[0034] Through the above steps, since the framework program locates the corresponding confidential configuration files according to different user types, it can solve the problem in related technologies that the method of using a centralized configuration server to manage configurations requires the application to call the API of the central configuration server, which is too invasive to the application, thereby achieving the effect of improving the security of application information.

[0035] Figure 2 is a flow chart of an application information configuration method according to an optional embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0036] Step S201, configuring corresponding confidentiality configuration files according to different user types, wherein the configuration formats of the confidentiality configuration files of different user types are the same;

[0037] Step S202, the framework program locates the corresponding confidential configuration file according to the user type, wherein the user type includes one of the following: production user, ordinary user;

[0038] Step S203, the framework program obtains the sensitive information identifier of the application configuration from the application configuration file of the target application to be started;

[0039] Step S204, the framework program obtains the configuration item corresponding to the sensitive information identifier from the confidential configuration file, and exports the configuration item as an environment variable of the target application program;

[0040] Step S205, the framework program starts the target application according to the application type and path configured in the application configuration file, and sets the permission of the environment variable to be visible to the target application;

[0041] Step S206: the target application references the corresponding environment variable during operation.

[0042] Through the above steps, since the configuration formats of confidential configuration files of different user types are the same, the problem that a single central configuration server cannot be connected when multiple environments are physically isolated from each other using a centralized configuration server to manage configuration in related technologies can be solved, thereby achieving the effect of improving the usability and efficiency of application information.

[0043] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0044] Example 2

[0045] In this embodiment, an application information configuration device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0046] Figure 3 is a structural block diagram of an application information configuration device according to an optional embodiment of the present invention, such as Figure 3 As shown, the device includes a positioning module 10 , a first acquisition module 20 , a second acquisition module 30 and a start module 40 .

[0047] A positioning module 10, configured to locate a corresponding confidential configuration file according to a user type, wherein the user type includes one of the following: a production user, a common user;

[0048] A first acquisition module 20, configured to acquire a sensitive information identifier of an application configuration from an application configuration file of a target application to be started;

[0049] A second acquisition module 30, configured to acquire a configuration item corresponding to the sensitive information identifier from the confidential configuration file, and export the configuration item as an environment variable of the target application;

[0050] The startup module 40 is used to start the target application according to the application configuration file and pass the environment variables to the target application.

[0051] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0052] Example 3

[0053] In order to facilitate the understanding of the technical solution provided by the present invention, it will be described in detail below in combination with embodiments of specific scenarios.

[0054] The same application that needs to configure sensitive information (such as account and password) may run in different environments, such as development environment and production environment. In different environments, the account information of external services used by the application is different. Even in the development environment, the account and password information of external services used by different users are different.

[0055] Related technical solutions mostly use centralized configuration servers, such as Apollo. All account passwords and other information are stored on the central server. The application uses configurations of different environments by passing different startup parameters.

[0056] The method of using a centralized configuration server to manage configuration has the following disadvantages: First, the application needs to call the API of the central configuration server, which is too invasive to the application; second, some applications such as shell, hive sql, etc. are very inconvenient or simply cannot be used; finally, when multiple environments are physically isolated from each other, a single central configuration server cannot be connected.

[0057] This solution includes a framework program and a secret configuration file. The framework program reads the application configuration and starts the actual application. The secret configuration file varies from user to user, but the format is the same.

[0058] The information used by production users is configured by the system administrator. Ordinary users configure their own configuration. For production users (groups), confidential configuration files are centrally managed and permissions are set. Only production users (groups) can read them, and other users cannot read or write them. For other users, confidential configuration files are placed in the user directory and configured by the user according to the established format. The permissions are visible only to the user.

[0059] Provide an application configuration file for each application. The configuration file contains the sensitive information code required by the application to be run, such as (my_usr_db_rw). The sensitive information code is uniformly assigned by the system management to ensure global uniqueness.

[0060] The application uses agreed environment variables to obtain sensitive information, such as username, password, dburl, etc.

[0061] When the framework program starts, it determines which confidential configuration file to use based on the current user (group), analyzes the sensitive information codes used in the application configuration, finds the configuration items corresponding to these sensitive information codes from the confidential configuration file, and exports these configuration items to environment variables. The environment variables exported here are only visible in this session (including applications started subsequently).

[0062] The framework program can start the application program.

[0063] The technologies involved in this solution include users (groups), environment variables, and file read and write permissions under Linux. This solution has been successfully implemented on Linux.

[0064] Figure 4 is a configuration format diagram of a confidential configuration file according to an embodiment of the present invention. Figure 4The format of the confidential configuration file shown in the figure is that the first line contains the code for sensitive information in square brackets. The second line contains the type of confidential data, which can be a database type, etc. The third, fourth, and fifth lines contain the sensitive data address, account number, and password, respectively. This example does not list all the lines that may be included. In addition, this example uses the configuration of the MySQL database as a demonstration.

[0065] Figure 5 is a flow chart of a method for configuring an application account according to an optional embodiment of the present invention. Figure 5 As shown, the process includes the following steps:

[0066] Step S501: The framework program is used as the entry point of the program. The user starts the framework program with the application configuration as a parameter.

[0067] Step S502, the framework program determines which confidential configuration file to use based on the current user (group). If it is a production user, the confidential configuration file is located. If it is another user, the confidential configuration file of the user is found in the user ($home) directory.

[0068] Step S503: The framework program analyzes which sensitive information codes are used in the application configuration. Sensitive information codes are uniformly assigned by the system administrator. If the application does not need to be online, the developer can assign it by himself and add or modify the confidential configuration file according to the agreed format under home.

[0069] Step S504, the framework program finds the corresponding item, namely the account information, from the confidential configuration file located in step S502 according to the sensitive information code, and then sets (exports) the environment variable, such as: export username = username 1, etc.

[0070] Step S505, start the application. Start the application according to the application type and path configured in the application configuration. In this way, the environment variables set in step S504 are visible to the application.

[0071] Step S506: The application uses the account information. The application can use the account password and other information by referring to the relevant environment variables set in step S505.

[0072] The key point of the embodiment of the present invention is that the framework program uses different confidentiality configuration files according to different users or user groups. Different environment variables are set (exported) according to different users or user groups and different applications. Sensitive information is transmitted by setting different environment variables for applications of different users or user groups.

[0073] Therefore, the advantages of the embodiments of the present invention are:

[0074] First, improve data security. Different users only see the confidential information (account number, password, etc.) that they configure, which improves security;

[0075] Second, improve configuration security. Confidential information is no longer hard-coded by developers in application code or configuration files, which can effectively prevent confidential information leakage;

[0076] Secondly, it improves usability. The same code and configuration can be run in different environments without modification, thus improving usability;

[0077] Finally, improve efficiency. If the production account information changes, the system administrator can simply adjust the production confidentiality configuration file, and the application does not need to make any changes, thus greatly improving efficiency.

[0078] Example 4

[0079] An embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0080] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0081] S1, the framework program locates the corresponding confidential configuration file according to the user type, wherein the user type includes one of the following: production user, ordinary user;

[0082] S2, the framework program obtains the sensitive information identifier of the application configuration from the application configuration file of the target application to be started;

[0083] S3, the framework program obtains the configuration item corresponding to the sensitive information identifier from the confidential configuration file, and exports the configuration item as an environment variable of the target application program;

[0084] S4, the framework program starts the target application according to the application configuration file and passes the environment variables to the target application.

[0085] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0086] Example 5

[0087] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0088] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0089] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0090] S1, the framework program locates the corresponding confidential configuration file according to the user type, wherein the user type includes one of the following: production user, ordinary user;

[0091] S2, the framework program obtains the sensitive information identifier of the application configuration from the application configuration file of the target application to be started;

[0092] S3, the framework program obtains the configuration item corresponding to the sensitive information identifier from the confidential configuration file, and exports the configuration item as an environment variable of the target application program;

[0093] S4, the framework program starts the target application according to the application configuration file and passes the environment variables to the target application.

[0094] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0095] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0096] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for configuring application information, characterized in that: include: The framework program locates the corresponding confidential configuration file according to the user type, wherein the user type includes one of the following: production user, ordinary user; the framework program provides an application configuration file for each application; The framework program obtains the sensitive information identifier of the application configuration from the application configuration file of the target application to be started; The framework program obtains the configuration item corresponding to the sensitive information identifier from the confidential configuration file, and exports the configuration item as an environment variable of the target application program; The framework program starts the target application according to the application configuration file and passes the environment variable to the target application; Wherein, before the framework program locates the corresponding confidential configuration file according to the user type, it also includes: Configure corresponding confidentiality configuration files according to different user types, wherein the configuration formats of the confidentiality configuration files of different user types are the same, and the configuration formats include: sensitive information identification, confidentiality data type, sensitive data address, account number, and password; The corresponding confidentiality profiles configured according to different user types include: The system administrator configures the confidential configuration files of the production users, and the confidential configuration files of all production users are centrally managed, and the permissions are set to be readable only by production users; A common user configures a confidential configuration file of the user, which is stored in the user directory of the user and has permissions set to be visible only to the user.

2. The method according to claim 1, characterized in that The framework program starts the target application according to the application configuration file and passes the environment variable to the target application, including: The framework program starts the target application according to the application type and path configured in the application configuration file, and sets the permission of the environment variable to be visible to the target application.

3. The method according to claim 1, characterized in that The framework program starts the target application according to the application configuration file and passes the environment variable to the target application, including: The target application references the corresponding environment variable during operation.

4. The method according to claim 1, characterized in that: in, The sensitive information identifier is configured to be globally unique.

5. An application information configuration device, characterized in that: include: A positioning module, used for the framework program to locate the corresponding confidential configuration file according to the user type, wherein the user type includes one of the following: production user, ordinary user; the framework program provides an application configuration file for each application; A first acquisition module, used to acquire the sensitive information identifier of the application configuration from the application configuration file of the target application to be started; A second acquisition module, configured to acquire a configuration item corresponding to the sensitive information identifier from the confidential configuration file, and export the configuration item as an environment variable of the target application; A startup module, used for starting the target application according to the application configuration file and passing the environment variable to the target application; The positioning module is further used to configure the corresponding confidential configuration file according to different user types before locating the corresponding confidential configuration file according to the user type, wherein the configuration format of the confidential configuration files of different user types is the same, and the configuration format includes: sensitive information identification, confidential data type, sensitive data address, account number, and password; The positioning module is also used for the system administrator to configure the confidential configuration files of the production users. The confidential configuration files of all production users are centrally managed, and the permissions are set to be readable only by production users; the ordinary user configures the confidential configuration files of the user, and the configuration files are stored in the user directory of the user, and the permissions are set to be visible only to the user.

6. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 4 when executed.

7. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 4.

Images