A software system security element domain management method and device

Abstract

The present invention discloses a domain-based management method and device for software system security elements, which relate to the field of computer network technology. The method and device comprise the following steps: 1: dividing the network function domains of the software system; 2: configuring business menus and system roles according to the network function domains; 3: adding a request header identifier to a load balancer at the software system access portal, and distinguishing the network function domains that match the request by the request header identifier; and 4: matching the corresponding network function domains according to the request header identifier, and loading the permissions and business menus of the system roles according to the network function domains. The present invention simplifies the deployment and implementation difficulty of the software system, does not require database synchronization, has higher consistency of business data, is highly scalable, can adapt to scenarios of more network function domains, and only requires the deployment of one set of software systems, making the software system more convenient to use.

Description

Technical Field

[0001] The present invention discloses a method and a device, and relates to the technical field of computer networks, in particular to a method and a device for domain management of software system security elements. Background Art

[0002] The widespread adoption and promotion of "Internet + Services," along with improvements in the level and operational quality of cloud services, has provided a secure and reliable operating environment for software systems. However, software operation involves complex network functional domain divisions, increasing the complexity of software system development and implementation. In particular, customers have different security requirements for the Internet domain and the public service domain, and the same account may require different functional menus in the Internet domain and the public service domain. Existing solutions typically deploy software systems independently on the public service extranet and the Internet, then synchronize data at the database level. While this ensures secure system access, it can easily lead to data inconsistencies, overwrites, primary key conflicts, and other hidden dangers. Furthermore, the immediacy of data synchronization is subject to various constraints, hindering the optimization of software deployment and implementation, and hindering the convenient application of software systems. Summary of the Invention

[0003] The present invention addresses the problems of the prior art and provides a method and device for managing software system security elements in different domains. The specific solution proposed by the present invention is:

[0004] The present invention provides a method for managing software system security elements by domain, comprising the following steps:

[0005] Step 1: Divide the network functional domains of the software system: According to different software system access portals, associate the network functional domains corresponding to the software system access portal information with the corresponding business menus and system roles;

[0006] Step 2: Configure service menus and system roles according to network function domains: Configure the personalized menu tree of the service menu according to the network function domain, configure the system role according to the network function domain, and add network function domain attributes to the system role to maintain the system role information;

[0007] Step 3: Add a request header identifier to the load balancer at the software system access entrance, and use the request header identifier to distinguish the network function domain that matches the request;

[0008] Step 4: Match the corresponding network function domain according to the request header identifier, and load the system role's permissions and business menu according to the network function domain.

[0009] Furthermore, in step 1 of the method for domain management of software system security elements, a table structure is used to represent the network function domain, wherein the table structure includes a serial number field, a function domain code field, a function domain name field and an enable status field, the serial number field represents the order of the network function domain, the function domain code field is a component of the request header identifier, the function domain name field is the name of the network function domain, and the enable status field displays whether the network function domain is turned on or off.

[0010] Furthermore, when configuring the system role according to the network function domain in step 2 of the domain management method for software system security elements, the system role data table model is used to add network function domain attributes to the system role, wherein the system role data table model includes a role_code field, a role_name field, and a role_domain field, the role_code field represents the role code, the role_name field represents the role name, and the role_domain field represents the network function domain to which the role applies.

[0011] Furthermore, in the method for managing security elements of a software system by domain, if the load balancer of the software system access entrance in step 3 is Nginx, then a request header identifier is added to the nginx configuration file nginx.conf;

[0012] Or if the load balancer for the software system access entrance is Apache, add a request header identifier in the Apache configuration file httpd.conf.

[0013] Furthermore, step 4 of the software system security element domain management method includes:

[0014] According to the login request, read the value of the request header identifier, match the network function domain to which the current login request belongs, verify the legitimacy of the identity, and load the permissions of the system role according to the network function domain to which the login request belongs;

[0015] According to the menu request, read the value of the request header identifier, match the network function domain to which the current menu request belongs, and load the menu tree according to the menu tree of the current network function domain and the permissions of the system role of the currently logged-in user.

[0016] The present invention also provides a software system security element domain management device, including a division module, a configuration module, an identification module and a matching loading module.

[0017] The network functional domain of the software system is divided into modules: according to different software system access entrances, the network functional domain corresponding to the software system access entrance information is associated with the corresponding business menu and system role;

[0018] The configuration module configures service menus and system roles according to network function domains: configures personalized menu trees for service menus according to network function domains, configures system roles according to network function domains, and adds network function domain attributes to system roles to maintain system role information;

[0019] The identification module adds a request header identifier to the load balancer at the software system access entrance, and distinguishes the network function domain that matches the request through the request header identifier;

[0020] The matching loading module matches the corresponding network function domain according to the request header identifier, and loads the permissions and business menu of the system role according to the network function domain.

[0021] Furthermore, in the division module of the software system security element domain management device, a table structure is used to represent the network function domain, wherein the table structure includes a serial number field, a function domain code field, a function domain name field and an enable status field, the serial number field represents the order of the network function domain, the function domain code field is a component of the request header identifier, the function domain name field is the name of the network function domain, and the enable status field displays whether the network function domain is turned on or off.

[0022] Furthermore, when the system role is configured according to the network function domain in the configuration module of the software system security element domain management device, the system role data table model is used to add network function domain attributes to the system role, wherein the system role data table model includes a role_code field, a role_name field and a role_domain field, the role_code field represents the role code, the role_name field represents the role name, and the role_domain field represents the network function domain to which the role applies.

[0023] Furthermore, in the software system security element domain management device, the identification module selects the load balancer of the software system access entrance as Nginx, and then adds a request header identifier in the nginx configuration file nginx.conf;

[0024] Or if the identification module selects Apache as the load balancer for the software system access entrance, then add a request header identifier in the Apache configuration file httpd.conf.

[0025] Furthermore, the matching loading module in the software system security element domain management device reads the value of the request header identifier according to the login request, matches the network function domain to which the current login request belongs, verifies the legitimacy of the identity, and loads the permissions of the system role according to the network function domain to which the login request belongs;

[0026] According to the menu request, read the value of the request header identifier, match the network function domain to which the current menu request belongs, and load the menu tree according to the menu tree of the current network function domain and the permissions of the system role of the currently logged-in user.

[0027] The benefits of the present invention are:

[0028] The present invention provides a domain management method for software system security elements, which divides network functional domains according to software system access entrances, simplifies the deployment and implementation difficulty of the software system, eliminates the need for database synchronization, improves business data consistency, and has strong scalability. It can adapt to scenarios in more network functional domains and only requires the deployment of one set of software systems, making the software system more convenient to use. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a schematic flow chart of the method of the present invention.

[0030] Figure 2 It is a schematic diagram of the application scenario of domain management of software system security elements in the method of the present invention.

[0031] Figure 3 It is a schematic diagram of an application scenario of security factor management of a software system in the prior art.

[0032] Figure 4 It is a schematic diagram comparing the function menu settings of the network function domain of the present invention and the prior art.

[0033] Figure 5 This is a schematic diagram of the system role configuration interface involved in the present invention. DETAILED DESCRIPTION

[0034] The present invention will be further described below with reference to the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention.

[0035] The present invention provides a method for managing software system security elements by domain, comprising the following steps:

[0036] Step 1: Divide the network functional domains of the software system: According to different software system access portals, associate the network functional domains corresponding to the software system access portal information with the corresponding business menus and system roles;

[0037] Step 2: Configure service menus and system roles according to network function domains: Configure the personalized menu tree of the service menu according to the network function domain, configure the system role according to the network function domain, and add network function domain attributes to the system role to maintain the system role information;

[0038] Step 3: Add a request header identifier to the load balancer at the software system access entrance, and use the request header identifier to distinguish the network function domain that matches the request;

[0039] Step 4: Match the corresponding network function domain according to the request header identifier, and load the system role's permissions and business menu according to the network function domain.

[0040] The security elements involved in the present invention mainly refer to system roles and service menus. The method of the present invention can utilize network functional domains and, based on role-based access control, perform domain-based management of the software system's service menus and system roles. Compared with the existing "domain-based deployment + database synchronization" approach based on external network functional domains, the method of the present invention allows the software system to automatically adapt to application scenarios in multiple network functional domains, simplifying the deployment and implementation of software, avoiding database synchronization, achieving higher consistency in service data, strong scalability, and adaptability to scenarios in more network functional domains. Since there is only one system, system management and control are more convenient.

[0041] In specific applications, in some embodiments of the method of the present invention, when performing domain management of software system security elements, the following process can be referred to:

[0042] Step 1: Divide the network functional domain of the software system: According to different software system access portals, associate the network functional domain corresponding to the software system access portal information with the corresponding business menu and system role.

[0043] Furthermore, in step 1, a table structure is used to represent the network function domain, wherein the table structure includes a sequence number field, a function domain code field, a function domain name field, and an enable status field. The sequence number field represents the order of the network function domain, the function domain code field is a component of the request header identifier, the function domain name field is the name of the network function domain, and the enable status field indicates whether the network function domain is on or off. By dividing the network function domain, the group management of security elements such as business menus and system roles according to the system access entrance is realized, and the needs of system access control are met. For example, at the beginning of the system launch, if the customer does not want to open the Internet entrance for the time being, the Internet function domain can be disabled within the software system.

[0044] Step 2: Configure business menus and system roles according to network functional domains: Configure a personalized menu tree for business menus according to network functional domains. Compared with the menu tree with only one root node in the existing menu management, this configuration method has the following advantages: safer menu display. Since the menus are divided according to functional domains, it can ensure that users with the same authority load different menus when accessing the system from different entrances; the menus can be customized according to the entrances to improve user experience. The method of the present invention is compared with the existing menu configuration method. Figure 4 .

[0045] Configure system roles according to network function domains, add network function domain attributes to system roles, and use them to maintain system role information.

[0046] Furthermore, when configuring the system role according to the network function domain in step 2, the system role data table model is used to add the network function domain attribute to the system role, wherein the system role data table model includes the role_code field, the role_name field and the role_domain field, the role_code field indicates the role code, the role_name field indicates the role name, and the role_domain field indicates the network function domain applicable to the role. Figure 5 In the system role configuration page, you can enter the role code and role name, select the network function domain, etc.

[0047] The method of the present invention utilizes network function domains to configure system roles, which can avoid users using the same role when accessing the software system from different network domains, such as the Internet domain and the public service domain, and avoid user sessions having the same system access rights. It can prevent users from directly accessing the software system using the API interface, will not cause information leakage, and will not bring security risks to the software system platform.

[0048] Step 3: Add a request header identifier to the load balancer at the software system access entrance, and use the request header identifier to distinguish the network function domain that matches the request.

[0049] Furthermore, if the load balancer of the software system access entrance in step 3 is Nginx, a request header identifier is added to the nginx configuration file nginx.conf.

[0050] For example, the request header identifier is X-REQUEST-DOMAIN, which matches the network function domain defined by the software system. For example, the identifiers of the Internet domain and the public service domain are 0 and 1 respectively, so the values of the request header identifier X-REQUEST-DOMAIN are 0 and 1 respectively.

[0051] In the nginx configuration file nginx.conf, the request header X-REQUEST-DOMAIN that identifies the network function domain is added. The code reference is:

[0052] location / {

[0053] #Internet Domain

[0054] proxy_set_header X-REQUEST O;

[0055] }

[0056] location / {

[0057] #Public Service Domain

[0058] proxy_set_header X-REQUEST I;

[0059] }

[0060] Or if the load balancer for the software system access entrance is Apache, add a request header identifier to the Apache configuration file httpd.conf. If the request header identifier is X-REQUEST-DOMAIN, and the identifiers for the Internet domain and public service domain are 0 and 1 respectively, then the values of the request header identifier X-REQUEST-DOMAIN are 0 and 1 respectively. The code reference is:

[0061] #Internet Domain Name

[0062] LoadModule headers_module modules / mod_headers.so

[0063] Header set X-REQUEST-DOMAIN"O"

[0064] #Public Service Domain

[0065] LoadModule headers_module modules / mod_headers.so

[0066] Header set X-REQUEST-DOMAIN"I"

[0067] Step 4: Match the corresponding network function domain according to the request header identifier, and load the system role's permissions and business menu according to the network function domain.

[0068] Furthermore, the step 4 includes:

[0069] According to the login request, read the value of the request header identifier, such as the value of the request header identifier X-REQUEST-DOMAIN, match the network function domain to which the current login request belongs, verify the legitimacy of the identity, and then load the permissions of the system role according to the network function domain to which the login request belongs;

[0070] According to the menu request, read the value of the request header identifier, such as the value of the request header identifier X-REQUEST-DOMAIN, match the network function domain to which the current menu request belongs, and load the menu tree according to the menu tree of the current network function domain and the permissions of the system role of the currently logged-in user. Figure 2 and 3 , the comparison shows that Figure 2It is shown in the figure that by using the method of the present invention, software system A loads the service menu and system role corresponding to the corresponding network function domain according to the custom request header identifier X-REQUEST-DOMAIN. When the value of the request header identifier X-REQUEST-DOMAIN is 1, the service menu and system role corresponding to the public service domain are loaded. When the value of the request header identifier X-REQUEST-DOMAIN is 0, the service menu and system role corresponding to the Internet domain are loaded.

[0071] The present invention also provides a software system security element domain management device, including a division module, a configuration module, an identification module and a matching loading module.

[0072] The network functional domain of the software system is divided into modules: according to different software system access entrances, the software system access entrance information is associated with the corresponding business menu and system role, and the corresponding business menu and system role are loaded according to the software system access entrance;

[0073] The configuration module configures service menus and system roles according to network function domains: configures personalized menu trees for service menus according to network function domains, configures system roles according to network function domains, and adds network function domain attributes to system roles to maintain system role information;

[0074] The identification module adds a request header identifier to the load balancer at the software system access entrance, and distinguishes the network function domain that matches the request through the request header identifier;

[0075] The matching loading module matches the corresponding network function domain according to the request header identifier, and loads the permissions and business menu of the system role according to the network function domain.

[0076] The information interaction, execution process, etc. between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention and will not be repeated here.

[0077] Similarly, the device of the present invention divides the network functional domain according to the software system access entrance, simplifies the deployment and implementation difficulty of the software system, does not require database synchronization, has higher business data consistency, strong scalability, and can adapt to more network functional domain scenarios. Only one set of software system needs to be deployed, and the software system is more convenient to use.

[0078] It should be noted that not all steps and modules in the above-mentioned processes and device structures are required, and certain steps or modules can be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or may be implemented by certain components in multiple independent devices.

[0079] The above embodiments are merely preferred embodiments for the purpose of fully illustrating the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are within the scope of protection of the present invention. The scope of protection of the present invention shall be subject to the claims.

Claims

1. A method for managing software system security elements by domain, characterized by: The following steps are involved: Step 1: Divide the network function domains of the software system: According to different software system access portals, associate the network function domains corresponding to the software system access portal information with the corresponding business menus and system roles, and use a table structure to represent the network function domains, wherein the table structure includes a sequence number field, a function domain code field, a function domain name field, and an enable status field. The sequence number field indicates the order of the network function domains, the function domain code field is a component of the request header identifier, the function domain name field is the name of the network function domain, and the enable status field indicates whether the network function domain is turned on or off. The network function domains include the Internet domain, the public service domain, and the unit intranet; Step 2: Configure service menus and system roles according to network function domains: Configure the personalized menu tree of the service menu according to the network function domain, configure the system role according to the network function domain, and add network function domain attributes to the system role to maintain the system role information; Step 3: Add a request header identifier to the load balancer at the software system access entrance, and use the request header identifier to distinguish the network function domain that matches the request; Step 4: Match the corresponding network function domain according to the request header identifier, and load the system role's permissions and business menu according to the network function domain.

2. A software system security element domain management method according to claim 1, characterized in that When configuring the system role according to the network function domain in step 2, the system role data table model is used to add network function domain attributes to the system role, wherein the system role data table model includes the role_code field, the role_name field and the role_domain field, the role_code field represents the role code, the role_name field represents the role name, and the role_domain field represents the network function domain to which the role applies.

3. A software system security element domain management method according to claim 1, characterized in that In step 3, if the load balancer of the software system access entrance is Nginx, then add a request header identifier in the nginx configuration file nginx.conf; Or if the load balancer for the software system access entrance is Apache, add a request header identifier in the Apache configuration file httpd.conf.

4. A software system security element domain management method according to claim 1, characterized in that The step 4 includes: According to the login request, read the value of the request header identifier, match the network function domain to which the current login request belongs, verify the legitimacy of the identity, and load the permissions of the system role according to the network function domain to which the login request belongs; According to the menu request, read the value of the request header identifier, match the network function domain to which the current menu request belongs, and load the menu tree according to the menu tree of the current network function domain and the permissions of the system role of the currently logged-in user.

5. A software system security element domain management device, characterized by Including division module, configuration module, identification module and matching loading module, The division module divides the network functional domain of the software system: according to different software system access entrances, the network functional domain corresponding to the software system access entrance information is associated with the corresponding business menu and system role; The partitioning module uses a table structure to represent network function domains, wherein the table structure includes a sequence number field, a function domain code field, a function domain name field, and an enablement status field. The sequence number field indicates the order of the network function domains, the function domain code field is a component of the request header identifier, the function domain name field is the name of the network function domain, and the enablement status field indicates whether the network function domain is on or off. The network function domains include the Internet domain, the public service domain, and the unit intranet. The configuration module configures service menus and system roles according to network function domains: configures personalized menu trees for service menus according to network function domains, configures system roles according to network function domains, and adds network function domain attributes to system roles to maintain system role information; The identification module adds a request header identifier to the load balancer at the software system access entrance, and distinguishes the network function domain that matches the request through the request header identifier; The matching loading module matches the corresponding network function domain according to the request header identifier, and loads the permissions and business menu of the system role according to the network function domain.

6. A software system security element domain management device according to claim 5, characterized in that When configuring the system role according to the network function domain in the configuration module, the system role data table model is used to add network function domain attributes to the system role, wherein the system role data table model includes the role_code field, the role_name field and the role_domain field, the role_code field represents the role code, the role_name field represents the role name, and the role_domain field represents the network function domain to which the role applies.

7. A software system security element domain management device according to claim 5, characterized in that The identification module selects Nginx as the load balancer of the software system access entrance, and then adds a request header identifier in the nginx configuration file nginx.conf; Or if the identification module selects Apache as the load balancer for the software system access entrance, then add a request header identifier in the Apache configuration file httpd.conf.

8. A software system security element domain management device according to claim 5, characterized in that The matching loading module reads the value of the request header identifier according to the login request, matches the network function domain to which the current login request belongs, verifies the legitimacy of the identity, and loads the authority of the system role according to the network function domain to which the login request belongs; According to the menu request, read the value of the request header identifier, match the network function domain to which the current menu request belongs, and load the menu tree according to the menu tree of the current network function domain and the permissions of the system role of the currently logged-in user.

Images