A microservice architecture that complies with GAMP5 safety audit requirements

Abstract

The application relates to the technical field of computer networks, in particular to a micro-service architecture conforming to GAMP5 security audit requirements, which comprises a plurality of autonomous micro-services, each micro-service comprising a micro front end, a micro back end and a database, the micro back end comprising an endpoint interface for receiving a service request of the micro front end; a service end for sending or receiving a service request of a command processor or sending a database reading request, the command processor writes event table data into the database, the command processor combines audit tracking data with the database event table, and data snapshot information of a database projection table can be seen. Compared with the prior art, the application has the advantages that: the security is high: safe authentication and authorization protocols, data protection technologies and fine-grained access control strategies are used to ensure the security of the service unit; monitoring and log recording are complete: all services in the micro-service architecture are monitored and logged, and potential security problems can be found and solved in time.

Description

A microservice architecture that meets GAMP5 security audit requirements Technical Field

[0001] This invention relates to the field of computer network technology, specifically a microservice architecture that conforms to GAMP5 security audit requirements. Background Technology

[0002] With the development of the internet and cloud computing, microservice architecture has been widely adopted in enterprise applications. Microservice architecture can break down an application into a series of small, autonomous service units, making the application more flexible and scalable.

[0003] However, service units in a microservice architecture are often distributed across multiple nodes, posing certain security risks. Therefore, under the GAMP5 security audit requirements, special attention needs to be paid to the security of microservice architectures. Currently, some solutions exist to ensure the security of microservice architectures, but they still have some shortcomings, such as a lack of fine-grained access control and logging. Summary of the Invention

[0004] The technical problem to be solved by this invention is to overcome the shortcomings of the prior art and provide a microservice architecture with high service unit security, fine-grained monitoring and logging of services, master data support for auditing and release, and business data support for data auditing.

[0005] To achieve the above objectives, a microservice architecture conforming to GAMP5 security audit requirements is designed, comprising several autonomous microservices. Each microservice includes a micro-frontend, a micro-backend, and a database. The micro-backend includes an endpoint interface for receiving service requests from the micro-frontend; the server side is used to send or receive service requests from command processors or send database read requests. The command processor writes event table data into the database and combines audit trace data with the database event table to view data snapshot information from the database projection table. Audit trace data is stored in the `data` field of the event table in key-value format. In the event table, each record corresponds to an event, and the event data is stored in the `data` field, with the data defined by a key. The data is stored in the form of -value, where the key represents the attribute or field name of the data, and the value represents the specific data value. The projection table is a copy of the data extracted and transformed from the event table, used to support the system's query and reporting functions. The projection table usually only contains a portion of the data from the event table. The data field in the projection table refers to the data stored in the projection table that corresponds to the data field in the event table. The data in the data field of the projection table is the result of processing, filtering, and transforming the data based on the data in the event table. The event table is used to store the event information of the aggregate root, including the event ID, aggregate root ID, event type, and event version. The event ID serves as a unique identifier and is the primary key of the event, while the aggregate root ID serves as a foreign key to the aggregate root table.

[0006] The present invention also has the following preferred technical solutions:

[0007] 1. The audit trail data includes data on the operators, user information data on the users performing the operations, operation time data, time information data on the operation, and operation type data.

[0008] 2. The data field in the projection table typically contains some data from the event table, as well as some calculated data, including aggregate calculations and statistical data. The specific content and format of the data field in the projection table depend on the specific query requirements and business scenarios.

[0009] 3. It also includes service units, which are authenticated and authorized with OAuth2.0 and OpenID protocols.

[0010] 4. The microservices and the gateway use a transport layer security protocol to protect data transmission.

[0011] 5. The microservice uses the RBAC access control policy.

[0012] 6. It also includes monitoring tools and log analysis tools to monitor and log all services in the microservice architecture.

[0013] Compared with the prior art, the advantages of this invention are:

[0014] 1. High security: Utilizes secure authentication and authorization protocols, data protection technologies, and fine-grained access control policies to ensure the security of service units;

[0015] 2. Comprehensive monitoring and logging: Monitor and log all services in the microservice architecture to promptly identify and resolve potential security issues;

[0016] 3. Good scalability: Microservice architecture can break down an application into a series of small, autonomous service units, making the application more flexible and scalable. Attached Figure Description

[0017] Figure 1 is a diagram of the overall architecture of the present invention;

[0018] Figure 2 is a schematic diagram of the microservices of the present invention. Detailed Implementation

[0019] The invention will be further described below with reference to the accompanying drawings. The structure and principle of the invention are very clear to those skilled in the art. It should be understood that the specific embodiments described herein are only for explaining the invention and are not intended to limit the invention.

[0020] As shown in Figure 1, this invention includes several autonomous microservices, each microservice comprising a micro-frontend, a micro-backend, and a database. As shown in Figure 2, the micro-backend includes an endpoint interface for receiving service requests from the micro-frontend. It also includes a server, which sends or receives service requests from command processors or sends database read requests. The command processor writes event table data into the database.

[0021] As shown in Figure 1, this microservice architecture includes the following aspects:

[0022] 1. Data traceability

[0023] In this invention, the system supports all GAMP5 data security auditing requirements. The command processor combines audit trail data with the database event table. Specifically, data is stored in key-value pairs in the 'data' field of the events table, where the key represents the data attribute or field name, and the value represents the specific data value. This storage method of storing event data in the 'data' field is called NoSQL, which differs from traditional relational databases by storing data in document, graph, or key-value pair formats. The advantage of using key-value data is that it allows for highly flexible data organization and easy expansion and modification of the data structure. Furthermore, in some cases, using key-value data can improve data query performance.

[0024] In the event table, events are the data carriers, with each record corresponding to one event. The event table stores event information for the aggregate root, including event ID, aggregate root ID, event type, event version, and data. The event ID serves as a unique identifier and is the primary key for that event; the aggregate root ID serves as a foreign key linking to the aggregate root table.

[0025] This invention uses a command processor to link audit trail data with the database event table, allowing visualization of a snapshot of the data in the database projection table. The projection table is a copy of the data extracted and transformed from the event table, used to support the system's query and reporting functions. The projection table typically contains only a portion of the data from the event table, and this data has been transformed and processed to better support queries and analysis. The 'data' field in the projection table refers to the data stored in the projection table corresponding to the 'data' field in the event table. The data in the 'data' field of the projection table is the result of processing, filtering, and transforming the data based on the data in the event table. The 'data' field in the projection table typically contains a portion of the data from the event table, as well as some calculated data, such as aggregate calculations and statistical data. The specific content and format of the 'data' field in the projection table usually depend on the specific query requirements and business scenario. When designing the projection table, it is necessary to reasonably select the data to be stored based on the system's query and reporting requirements, and perform appropriate transformations and calculations to support the system's query and analysis functions.

[0026] This invention supports review and release of all master data, and data auditing of all business data. When querying data, it reveals when and what actions a user performed, and supports version rollback of master data. By recording information such as operator, time, and operation type, it helps administrators better understand system usage and prevent misoperation and data leakage. The audit trail records the following information: Operator: Records user information for the operation; Operation Time: Records the time information of the operation, including date and time; Operation Type: Records the type of operation performed, including addition, modification, and deletion.

[0027] Therefore, when you want to trace the source of data, you can use the event table to see when, where and what the user did.

[0028] 2. Security Authentication and Authorization

[0029] In this invention, authentication and authorization protocols based on OAuth2.0 and OpenID are used to ensure that service units can only be accessed by authenticated and authorized users or services.

[0030] 3. Data Protection

[0031] In this invention, a transport layer security protocol is used to protect data transmission, and encryption technology is used to protect data storage, so as to ensure that data is protected during transmission and storage.

[0032] 4. Access Control

[0033] In this invention, fine-grained access control is implemented for services to ensure that only authorized users or services can access the corresponding services. RBAC (Role-Based Access Control) access control policies can be used.

[0034] 5. Monitoring and logging

[0035] In this invention, it is necessary to monitor and log all services in the microservice architecture in order to promptly identify and resolve potential security issues. This can be achieved using monitoring tools and log analysis tools.

[0036] In summary, the system of this invention employs the HTTPS encryption protocol and uses OAuth 2.0 and OpenID authentication and authorization protocols. Only users with corresponding permissions can access the corresponding microservices. After a user enters the system and performs operations such as adding, modifying, deactivating, and deleting data, the user's information, operation time, and data modifications can be viewed in the audit trail. Each record is recorded in the system. It also supports the approval and publication of master data; data modifications only take effect after approval. Furthermore, it supports version rollback of master data, allowing users to revert to any previous version of the data.

[0037] The above description is merely a specific embodiment of the invention, but the scope of protection of the invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the technical scope disclosed in the invention, based on the technical solutions and novel concepts of the invention, should be covered within the scope of protection of the invention.

Claims

1. A microservice architecture system conforming to GAMP5 security audit requirements, comprising several autonomous microservices, each microservice including a micro-frontend, a micro-backend, and a database, wherein the micro-backend includes an endpoint interface for receiving service requests from the micro-frontend; and a server for sending or receiving service requests from command processors or sending database read requests, wherein the command processor writes event table data into the database, characterized in that... The command processor combines audit trail data with the database event table, allowing the view of a snapshot of the data in the database projection table. Audit trail data is stored in the `data` field of the event table in key-value pairs. Each record in the event table corresponds to an event, and the event data is stored in the `data` field in key-value pairs, where the key represents the data attribute or field name, and the value represents the specific data value. The projection table is a copy of the data extracted and transformed from the event table, used to support the system's query and reporting functions. The projection table typically contains only a portion of the data from the event table. The `data` field in the projection table refers to the data stored in the projection table that corresponds to the `data` field in the event table. The data in the `data` field of the projection table is the result of processing, filtering, and transforming the data based on the data in the event table. The event table is used to store event information for the aggregate root, including event ID, aggregate root ID, event type, and event version. The event ID serves as a unique identifier and is the primary key for the event, while the aggregate root ID serves as a foreign key to the aggregate root table.

2. A microservice architecture system conforming to GAMP5 security audit requirements as described in claim 1, characterized in that... The audit trail data includes data on operators, user information data on the operation, operation time data, time information data on the operation, and operation type data.

3. A microservice architecture system conforming to GAMP5 security audit requirements as described in claim 1, characterized in that... The data field in the projection table typically contains some data from the event table, as well as some calculated data, including aggregate calculations and statistical data. The specific content and format of the data field in the projection table depend on the specific query requirements and business scenarios.

4. A microservice architecture system conforming to GAMP5 security audit requirements as described in claim 1, characterized in that... It also includes service units, which are authenticated and authorized with OAuth2.0 and OpenID protocols.

5. A microservice architecture system conforming to GAMP5 security audit requirements as described in claim 1, characterized in that... The microservices and the gateway use a transport layer security protocol to protect data transmission.

6. A microservice architecture system conforming to GAMP5 security audit requirements as described in claim 1, characterized in that... The microservice uses the RBAC access control policy.

7. A microservice architecture system conforming to GAMP5 security audit requirements as described in claim 1, characterized in that... It also includes monitoring tools and log analysis tools to monitor and log all services in the microservice architecture.

Images