Automatic scheduling process control system and method for bastion host based on CMDB

Abstract

The invention provides a bastion host automatic scheduling process control system and method based on a CMDB. The system comprises a CMDB management module, a cloud platform docking module, an authority management module and an auditing module. The method comprises the following steps: creating a new service in a configuration management database, and planning a server address; the cloud platform automatically creates a server through the newly distributed address; after configuration of the server is completed, the operation authority of the server is initialized, and production, online and daily maintenance of the business are carried out; comprising the following steps: when a routine version is changed, automatically performing permission upgrading and degrading management through process triggering; recording all operations of the maintenance personnel on the server when the server operates and audits; and when the service life cycle is ended, executing service offline operation, recycling the server which is not used any more, and archiving the offline service in the configuration management database. According to the method, reasonable distribution of the operation authority, transparent server operation and automatic authority distribution are realized, and the method has the advantages of high operation safety and high efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of bank bastion host authority management and control, and in particular to a bastion host automated scheduling process control system and method based on CMDB. Background Art

[0002] In financial institutions such as banks, the control of operating permissions is extremely demanding. Traditional permission control methods usually rely on manual operations, which have security and controllability issues and make it difficult to fully track operation traces. In addition, manual permission control methods are inefficient and difficult to meet the needs of the rapid development of modern financial services. Therefore, there is an urgent need for safe, controllable, transparent, and automated permission control methods and devices to improve the efficiency and security of permission management.

[0003] The traditional bank bastion host permission management model has the following problems:

[0004] Low efficiency of manual operation: Permission control requires manual application, review, and approval, which is inefficient and prone to human errors.

[0005] Lack of audit traceability: There is a lack of detailed records of permission changes, making it difficult to trace responsibilities and posing a security risk.

[0006] Non-standardized process: The authority change process is not standardized, which can easily lead to omissions or unauthorized operations.

[0007] Low degree of automation: The degree of automation of permission management is low, which makes it difficult to meet increasingly complex business needs. Summary of the invention

[0008] In view of the technical problems existing in the prior art, the present invention provides a bastion host automated scheduling process control system and method based on CMDB, which is used to solve the problems of low security and low efficiency of authority control in the prior art, and to achieve reasonable allocation of operating permissions, transparency of server operations and automation of authority allocation.

[0009] According to a first aspect of the present invention, a bastion host automated scheduling process control system based on CMDB is provided, comprising:

[0010] The interface layer includes a CMDB management module and a cloud platform docking module; wherein,

[0011] The CMDB management module is used to create and manage business items, plan server addresses, business offline, and business archiving operations;

[0012] The cloud platform docking module is connected to the cloud platform interface and is used to automatically create and recycle server operations;

[0013] The control layer includes a rights management module and an audit module; wherein:

[0014] The authority management module is used to manage the allocation of daily operation and maintenance authority, authority upgrades during changes, and recovery operations;

[0015] The audit module is used for archiving server operation records;

[0016] and an execution layer, wherein the execution layer includes an executor and a memory.

[0017] Preferably, the cloud platform docking module includes an automation tool module, which is connected to the cloud platform interface and is used to realize automatic creation of servers and automatic recovery of servers after the service goes offline.

[0018] According to a second aspect of the present invention, the present invention provides a CMDB-based bastion host automated scheduling process control method, which is used in the above-mentioned CMDB-based bastion host automated scheduling process control system, and the method comprises the following steps:

[0019] The CMDB management module creates new services and plans new server addresses;

[0020] The cloud platform docking module automatically creates a server through the newly assigned address;

[0021] After the server configuration is completed, the server operation permissions are initialized to carry out business commissioning and daily maintenance. This includes: when making routine version changes, the permission management module automatically performs permission upgrade and downgrade management through process triggers; when auditing server operations, the audit module records all operations performed by maintenance personnel on the server;

[0022] At the end of the service life cycle, the cloud platform docking module executes the service offline operation, automatically recycles the unused servers, and completes the archiving of the offline services in the configuration management database.

[0023] Based on the above technical solution, the present invention can also make the following improvements.

[0024] Preferably, the CMDB management module creates a new business including: business name, business description, project manager, operation and maintenance manager, business contact person and associated server address information.

[0025] Preferably, during the server creation process, relevant parameters are automatically configured according to a preset image model, including: operating system, memory, storage and network configuration; after the server is created, the system automatically performs initialization configuration, including security policies and user permissions.

[0026] Preferably, after the server configuration is completed, the server operation authority is initialized, and the business commissioning and daily maintenance include:

[0027] After the server configuration is completed, the business is put into production. The authority management module automatically allocates operating permissions based on the division of responsibilities in the configuration management database. The operation and maintenance personnel obtain the corresponding operating permissions according to the authority allocation strategy and perform daily operation and maintenance work.

[0028] Preferably, during routine operation and maintenance work, the authority allocation strategy can be configured based on multiple factors such as business role, operation frequency, and operation type.

[0029] Preferably, when performing routine version changes, the permission management module automatically performs permission upgrade and downgrade management through process triggering, including:

[0030] The authority management module automatically allocates operation and maintenance permissions and performs authority upgrade and recovery according to preset rules, including: the authority management module automatically upgrades the operation permissions of relevant personnel according to change requirements, allowing them to perform high-authority operations. After the change is completed, the system will automatically recover temporary permissions and restore to the original authority configuration.

[0031] Preferably, during the server operation audit, the audit module records all operations performed by the maintenance personnel on the server, including:

[0032] The audit module records all operations on the server in detail, including operation time, operator and operation content information. Audit records are archived regularly and stored in a secure audit database. When necessary, users can query and analyze operation records through the audit module to trace operation traces and locate the root cause of the problem.

[0033] Preferably, when the service life cycle ends, the cloud platform docking module performs the service offline operation including:

[0034] After the business goes offline, the cloud platform docking module will automatically recycle the server. During the server recycling process, the system clears business data and releases resources to ensure that the server can be reallocated to other businesses. After the recycling is completed, the corresponding business entries and server records in the configuration management database are archived and historical records are retained to facilitate subsequent query and analysis.

[0035] Technical effects and advantages of the present invention:

[0036] The CMDB-based bastion host automated scheduling process control system and method provided by the present invention realizes the full process automated management from business creation, server configuration, authority allocation, change management to business offline and server recovery through the organic combination of CMDB management module, cloud platform docking module, authority management module and audit module. Through automated process control, the security and efficiency of authority management are greatly improved, the errors and safety hazards of manual operations are reduced, and the operation and maintenance management level of banks and other financial institutions is improved.

[0037] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a block diagram of the structure of the bastion host automated scheduling process control system provided by an embodiment of the present invention;

[0039] Figure 2 It is a step flow chart of the bastion host automated scheduling process control method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] It should be noted that CMDB stands for Configuration Management Database, which is a term used in the information technology infrastructure library. It is a database used by organizations to store information about software and hardware assets. By acquiring, maintaining, and checking the IT resources of an enterprise, it can efficiently control and manage the ever-changing IT infrastructure and IT services, and provide accurate configuration information for other systems, such as task scheduling, operation and maintenance work orders, and release management systems.

[0042] It is understandable that based on the defects in the background technology, the embodiment of the present invention proposes a bastion host automated scheduling process control system based on CMDB, specifically Figure 1 As shown, the system comprises:

[0043] The interface layer includes a CMDB management module and a cloud platform docking module; wherein,

[0044] The CMDB management module is used to create and manage business items, plan server addresses, business offline, and business archiving operations;

[0045] The cloud platform docking module is connected to the cloud platform interface and is used to automatically create and recycle server operations;

[0046] The control layer includes a rights management module and an audit module; wherein:

[0047] The authority management module is used to manage the allocation of daily operation and maintenance authority, authority upgrades during changes, and recovery operations;

[0048] The audit module is used for archiving server operation records;

[0049] And an execution layer, the execution layer includes an executor and a memory. The executor and the memory communicate with each other through a communication bus. The executor can call the logic instructions in the memory to execute the subsequent CMDB-based bastion machine automatic scheduling process control method.

[0050] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0051] In this embodiment, the cloud platform docking module includes an automation tool module, which is connected to the cloud platform interface and is used to realize automatic creation of servers and automatic recovery of servers after the service goes offline.

[0052] The embodiment of the present invention also provides a CMDB-based bastion host automated scheduling process control method, which is used for the above-mentioned CMDB-based bastion host automated scheduling process control system, specifically as follows Figure 2 As shown, the method comprises the following steps:

[0053] 1. The CMDB management module creates new services and plans new server addresses;

[0054] First, create a new business in the CMDB management module, including business name, business description, project manager, operation and maintenance manager, business contact person, associated server address, etc. Through the pre-set process, in the distribution of existing business addresses, the CMDB management module will automatically allocate the address of the new server according to the network address planning.

[0055] 2. The cloud platform docking module automatically creates a server through the newly assigned address;

[0056] When a new business item is created, the cloud platform docking module will connect to the cloud platform interface and automatically create a server using the API interface provided by the cloud platform. During the server creation process, the system automatically configures relevant parameters such as operating system, memory, storage, network configuration, etc. according to the preset image model to ensure that the server can meet business needs. After the server is created, the system will automatically perform initialization configuration, including security policies and user permissions.

[0057] 3. After the server configuration is completed, initialize the server operation permissions, and carry out business commissioning and daily maintenance;

[0058] After the server configuration is completed, the business can be put into production. The authority management module automatically allocates operation permissions based on the division of responsibilities in the CMDB. Operation and maintenance personnel obtain corresponding operation permissions according to the authority allocation strategy and perform daily operation and maintenance work. The authority allocation strategy can be configured based on various factors such as business roles, operation frequency, and operation type to ensure the rationality and security of authority allocation.

[0059] Including: When making routine version changes, the permission management module automatically performs permission upgrade and downgrade management through process triggering;

[0060] During business changes, the authority management module automatically upgrades and reclaims authority through process triggers. The authority management module automatically upgrades the operating authority of relevant personnel according to the change requirements, allowing them to perform high-authority operations. After the change is completed, the system automatically reclaims temporary authority and restores to the original authority configuration. This process is fully recorded by the audit module to ensure that the operation traces can be traced.

[0061] It also includes: during server operation audit, the audit module records all operations performed by the maintenance personnel on the server;

[0062] Server operation audit is an important part of the embodiment of the present invention. The audit module records all operations on the server in detail, including operation time, operator, operation content and other information. Audit records are archived regularly and stored in a secure audit database to ensure the integrity and security of audit data. When necessary, users can query and analyze operation records through the audit module to trace operation traces and locate the root cause of problems.

[0063] 4. At the end of the service life cycle, the cloud platform docking module executes the service offline operation, automatically recycles the unused servers, and completes the archiving of the offline services in the configuration management database.

[0064] When the service lifecycle ends, the service is taken offline. After the service is taken offline, the cloud platform docking module automatically recycles the server. During the server recycling process, the system clears the service data and releases resources to ensure that the server can be reallocated to other services. After the recycling is completed, the corresponding service entries and server records in the CMDB are archived and the historical records are retained to facilitate subsequent query and analysis.

[0065] In summary, the CMDB-based bastion host automated scheduling process control method provided by the embodiment of the present invention realizes the full process automated management from business creation, server configuration, authority allocation, change management to business offline and server recovery through the organic combination of CMDB management module, cloud platform docking module, authority management module and audit module. Through automated process control, the security and efficiency of authority management are greatly improved, the errors and safety hazards of manual operations are reduced, and the operation and maintenance management level of banks and other financial institutions is improved.

[0066] Next, we will provide further detailed description based on specific application examples:

[0067] Suppose a bank needs to start a new business, which requires the allocation of three servers and permission management. In the CMDB management module, the project manager submits a new business application and fills in the relevant information. After the review is passed, the system automatically allocates the addresses of the three servers according to the preset network address planning rules. Subsequently, the cloud platform docking module calls the cloud platform's API interface to automatically create three servers and configure the operating system, memory, storage, network and other parameters according to the preset image model. After the server is created, the system automatically performs initialization configuration, including security policies and user permissions.

[0068] After the server configuration is completed, the business is put into production. The authority management module automatically allocates operation permissions based on the role division of project managers and operation and maintenance managers. Operation and maintenance personnel obtain corresponding operation permissions according to the authority allocation strategy and carry out daily operation and maintenance work.

[0069] During the business change period, since the server needs to be upgraded significantly, the authority management module automatically upgrades the operation authority of the relevant operation and maintenance personnel, allowing them to perform high-authority operations. After the change is completed, the system automatically reclaims the temporary authority and restores it to the original authority configuration. During the entire process, the audit module records all operations in detail and stores them in the audit database.

[0070] When the life cycle of the business ends, the project manager initiates the business offline operation in the CMDB management module. The cloud platform docking module automatically recycles the three servers, clears the business data and releases resources. After the server is recycled, the corresponding business items and server records in the CMDB are archived.

[0071] The CMDB-based bastion host automated scheduling process control method described in the embodiment of the present invention is suitable for financial institutions such as banks that have high requirements for authority control, and can also be promoted and applied to other fields that require efficient and secure authority management. Through the method and device of the present invention, users can perform authority management, server management, and operation auditing on a unified platform, achieving transparency, automation, and efficiency in operation and maintenance management.

[0072] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0073] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. The CMDB-based bastion host automated scheduling process control system is characterized by: include: The interface layer includes a CMDB management module and a cloud platform docking module; wherein, The CMDB management module is used to create and manage business items, plan server addresses, business offline, and business archiving operations; The cloud platform docking module is connected to the cloud platform interface and is used to automatically create and recycle server operations; The control layer includes a rights management module and an audit module; wherein: The authority management module is used to manage the allocation of daily operation and maintenance authority, authority upgrades during changes, and recovery operations; The audit module is used for archiving server operation records; and an execution layer, wherein the execution layer includes an executor and a memory.

2. According to the CMDB-based bastion host automated scheduling process control system of claim 1, it is characterized in that: The cloud platform docking module includes an automation tool module, which is connected to the cloud platform interface and is used to realize automatic creation of servers and automatic recovery of servers after the service goes offline.

3. A CMDB-based bastion host automated scheduling process control method, used for the CMDB-based bastion host automated scheduling process control system according to claim 1, characterized in that: The method comprises the following steps: The CMDB management module creates new services and plans new server addresses; The cloud platform docking module automatically creates a server through the newly assigned address; After the server configuration is completed, the server operation permissions are initialized to carry out business commissioning and daily maintenance. This includes: when making routine version changes, the permission management module automatically performs permission upgrade and downgrade management through process triggers; when auditing server operations, the audit module records all operations performed by maintenance personnel on the server; At the end of the service life cycle, the cloud platform docking module executes the service offline operation, automatically recycles the unused servers, and completes the archiving of the offline services in the configuration management database.

4. According to claim 3, the CMDB-based bastion host automated scheduling process control method is characterized in that: The CMDB management module creates a new business including: business name, business description, project manager, operation and maintenance manager, business contact person and associated server address information.

5. According to the CMDB-based bastion host automated scheduling process control method of claim 3, it is characterized in that: During the server creation process, relevant parameters are automatically configured according to the preset image model, including: operating system, memory, storage and network configuration; after the server is created, the system automatically initializes the configuration, including security policies and user permissions.

6. The CMDB-based bastion host automated scheduling process control method according to claim 3 is characterized in that: After the server configuration is completed, the server operation permissions are initialized, and the business is put into production and daily maintenance includes: After the server configuration is completed, the business is put into production. The authority management module automatically allocates operating permissions based on the division of responsibilities in the configuration management database. The operation and maintenance personnel obtain the corresponding operating permissions according to the authority allocation strategy and perform daily operation and maintenance work.

7. The CMDB-based bastion host automated scheduling process control method according to claim 6 is characterized in that: In daily operation and maintenance work, permission allocation strategies can be configured based on a variety of factors such as business roles, operation frequency, and operation type.

8. The CMDB-based bastion host automated scheduling process control method according to claim 3 is characterized in that: When performing routine version changes, the permission management module automatically performs permission upgrade and downgrade management through process triggering, including: The authority management module automatically allocates operation and maintenance permissions and performs authority upgrade and recovery according to preset rules, including: the authority management module automatically upgrades the operation permissions of relevant personnel according to change requirements, allowing them to perform high-authority operations. After the change is completed, the system will automatically recover temporary permissions and restore to the original authority configuration.

9. The CMDB-based bastion host automated scheduling process control method according to claim 3 is characterized in that: During the server operation audit, the audit module records all operations performed by the maintenance personnel on the server, including: The audit module records all operations on the server in detail, including operation time, operator and operation content information. Audit records are archived regularly and stored in a secure audit database. When necessary, users can query and analyze operation records through the audit module to trace operation traces and locate the root cause of the problem.

10. The CMDB-based bastion host automated scheduling process control method according to claim 3 is characterized in that: When the service life cycle ends, the cloud platform docking module performs the service offline operation including: After the business goes offline, the cloud platform docking module will automatically recycle the server. During the server recycling process, the system clears business data and releases resources to ensure that the server can be reallocated to other businesses. After the recycling is completed, the corresponding business entries and server records in the configuration management database are archived and historical records are retained to facilitate subsequent query and analysis.

Images