On-site operation and maintenance control methods, systems, equipment and media

Abstract

The present application relates to the technical field of on-site operation and maintenance management and control, and discloses an on-site operation and maintenance management and control method, system, equipment and medium, including: a first server generates an on-site operation and maintenance request in response to an operation to set an operation and maintenance duration; the request carries the operation and maintenance duration and identification information of the first server, and the first server is deployed with an operation and maintenance plug-in; the first server sends a request to a second server; the second server generates a first on-site operation and maintenance code based on the operation and maintenance duration and the identification information of the first server in response to an approval operation for the on-site operation and maintenance request, and encrypts the first on-site operation and maintenance code to obtain a first encrypted operation and maintenance code; the first server decrypts the input first encrypted operation and maintenance code in response to an input operation of the first encrypted operation and maintenance code to obtain a second on-site operation and maintenance code; if it is recognized that the identification information is consistent, the first server is enabled to perform operation and maintenance operations within the operation and maintenance duration, thereby achieving the technical effect of managing the compliance and security of operation and maintenance access.

Description

Technical Field

[0001] The present application relates to the field of on-site operation and maintenance control technology, and in particular to an on-site operation and maintenance control method, system, equipment and medium. Background Art

[0002] A bastion host is a security mechanism commonly used to protect and manage IT infrastructure, particularly in cloud environments or multi-tier network architectures. Acting as an intermediary, it allows operations personnel to securely access internal networks or sensitive systems while monitoring and logging all access activity. However, using a bastion host for operations management and control still has limitations: for example, it only supports remote operations and is not suitable for on-site operations. Summary of the Invention

[0003] The present application provides an on-site operation and maintenance management method, system, equipment and medium, which solves the technical problems in related technologies that on-site operation and maintenance cannot be performed and the operation and maintenance security is low, and achieves the technical effect of being able to control the compliance and security of operation and maintenance access.

[0004] In order to achieve the above objectives, the main technical solutions adopted in this application include:

[0005] In a first aspect, an embodiment of the present application provides an on-site operation and maintenance management method, comprising:

[0006] The first server generates an on-site operation and maintenance request in response to the operation of setting the operation and maintenance duration; wherein the on-site operation and maintenance request carries the operation and maintenance duration and identification information of the first server, and the first server is deployed with an operation and maintenance plug-in and stores an on-site operation and maintenance key;

[0007] The first server sends the on-site operation and maintenance request to the second server; wherein the second server stores the on-site operation and maintenance key;

[0008] The second server generates, in response to the approval operation for the on-site operation and maintenance request, a first on-site operation and maintenance code based on the operation and maintenance duration and the identification information of the first server, and encrypts the first on-site operation and maintenance code using the on-site operation and maintenance key to obtain a first encrypted operation and maintenance code;

[0009] In response to the input operation of the first encrypted operation and maintenance code, the first server decrypts the input first encrypted operation and maintenance code using the on-site operation and maintenance key through the operation and maintenance plug-in to obtain a second on-site operation and maintenance code. If it is recognized that the identification information in the second on-site operation and maintenance code is consistent with the identification information of the first server, the permission of the first server to perform operation and maintenance operations within the operation and maintenance period is enabled.

[0010] This application controls the compliance of on-site operation and maintenance operations by performing verification before executing on-site operation and maintenance operations. Specifically, an on-site operation and maintenance code containing operation and maintenance duration information is generated based on an operation and maintenance request that carries the operation and maintenance duration. After the on-site operation and maintenance code is verified, the first server enables the operation and maintenance operation permission based on the operation and maintenance duration. The first server cancels the operation and maintenance operation permission after the operation and maintenance duration expires.

[0011] Compared with related technologies, this application sets up an on-site operation and maintenance code verification step, which greatly reduces the occurrence of on-site operation and maintenance errors and further ensures the designation of operation and maintenance personnel. The validity period of on-site operation and maintenance authority is increased, and the timeliness of operation and maintenance management and control is improved. It also overcomes the limitation of related technologies that require reliance on operation and maintenance bastion machines for operation and maintenance. This application only needs to deploy operation and maintenance management and control software and operation and maintenance plug-ins to achieve operation and maintenance management and control, without the need for additional hardware, reducing the cost of operation and maintenance management and control.

[0012] Optionally, the method further includes: if it is identified that the identification information in the second on-site operation and maintenance code is inconsistent with the identification information of the first server, disabling the permission of the first server to perform operation and maintenance operations, and recording the disabling information;

[0013] If the identification information in the second on-site operation and maintenance code is identified to be inconsistent with the identification information of the first server for a preset number of consecutive times, the permission of the first server to send on-site operation and maintenance requests is disabled.

[0014] It achieves the technical effect that unverified operation and maintenance is impossible, and improves the safety of operation and maintenance.

[0015] Optionally, before the first server responds to the operation of setting the operation and maintenance duration, the method further includes:

[0016] The first server receives the input operation and maintenance account number and operation and maintenance password in response to the operation and maintenance account login operation;

[0017] The first server logs in to the target operation and maintenance account based on the operation and maintenance account and the operation and maintenance password;

[0018] After obtaining the second on-site operation and maintenance code, the method further includes:

[0019] If it is identified that the identification information in the second on-site operation and maintenance code is inconsistent with the identification information of the first server, the target operation and maintenance account is logged out.

[0020] In the related technology, the first server obtains the operation and maintenance account and the operation and maintenance password, and then logs in to the operation and maintenance account, and can directly perform operation and maintenance operations, which may have security risks. In this application, when logging in to the operation and maintenance account, if the on-site operation and maintenance personnel need to perform operation and maintenance operations, the identity is verified through on-site operation and maintenance code verification. After successful verification, the operation and maintenance permissions for the preset time are opened, which improves the security of on-site operation and maintenance operations.

[0021] Optionally, the on-site operation and maintenance key includes multiple groups of serial number keys and corresponding serial numbers;

[0022] The first on-site operation and maintenance code is encrypted in the following way:

[0023] Randomly selecting any one of the plurality of groups of serial keys, and using the any one of the serial keys to encrypt the first on-site operation and maintenance code to obtain a first encrypted operation and maintenance code containing a serial number;

[0024] Decrypt the first encrypted operation code in the following way:

[0025] The operation and maintenance plug-in uses the serial number and the on-site operation and maintenance key to decrypt the input first encrypted operation and maintenance code containing the serial number to obtain the second on-site operation and maintenance code.

[0026] Optionally, the first server stores a disaster recovery code, which includes identification information of the first server; the method also includes: the first server responds to the input operation of the disaster recovery code, and if it is recognized that the identification information in the disaster recovery code is consistent with the identification information of the first server, then the first server is enabled to perform operation and maintenance operations within the operation and maintenance period.

[0027] In this way, a disaster recovery emergency method is deployed. When the second server is offline, the on-site operation and maintenance management software crashes, or the communication network cannot be connected, the first server is allowed to independently obtain the authority to perform operation and maintenance operations through disaster recovery code verification.

[0028] Optionally, after enabling the permission of the first server to perform operation and maintenance operations within the operation and maintenance duration, the method further comprises: starting a timer by the operation and maintenance plug-in, and disabling the permission of the first server to perform operation and maintenance operations after the timer reaches the operation and maintenance duration;

[0029] The operation and maintenance operation is recorded by the operation and maintenance plug-in, and after the timing reaches the operation and maintenance duration, the operation and maintenance operation record performed by the first server within the operation and maintenance duration is saved.

[0030] Among them, recording operation and maintenance operations through the operation and maintenance plug-in can achieve process supervision of on-site operation and maintenance by regularly obtaining information such as the execution account, execution time and execution results of the operation and maintenance operations.

[0031] Optionally, the operation and maintenance plug-in is deployed with a daemon, which is configured to monitor in real time whether the operation and maintenance plug-in in the first server is in working mode, and activate the operation and maintenance plug-in if the operation and maintenance plug-in is in non-working mode.

[0032] The daemon can be two services that monitor each other's status. If one of the services fails, the other service can immediately take measures to restart or notify relevant personnel. This can reduce the situation in which related technologies bypass the operation and maintenance plug-in in the same way as bypassing the operation and maintenance bastion host.

[0033] In a second aspect, an embodiment of the present application provides an on-site operation and maintenance management system, including an operation and maintenance request generation module, an operation and maintenance request sending module, an on-site operation and maintenance code generation module, and an operation authority verification module;

[0034] An operation and maintenance request generation module, applied to the first server, is configured to generate an on-site operation and maintenance request in response to an operation to set an operation and maintenance duration; wherein the on-site operation and maintenance request carries the operation and maintenance duration and identification information of the first server, and the first server is deployed with an operation and maintenance plug-in and stores an on-site operation and maintenance key;

[0035] an operation and maintenance request sending module, applied to the first server, and configured to send the on-site operation and maintenance request to the second server; wherein the second server stores the on-site operation and maintenance key;

[0036] an on-site operation and maintenance code generation module, applied to the second server, configured to, in response to an approval operation for the on-site operation and maintenance request, generate a first on-site operation and maintenance code based on the operation and maintenance duration and identification information of the first server, and encrypt the first on-site operation and maintenance code using the on-site operation and maintenance key to obtain a first encrypted operation and maintenance code;

[0037] An operation authority verification module is applied to the first server and is configured to respond to the input operation of the first encrypted operation and maintenance code, decrypt the input first encrypted operation and maintenance code using the on-site operation and maintenance key through the operation and maintenance plug-in, and obtain a second on-site operation and maintenance code; if it is recognized that the identification information in the second on-site operation and maintenance code is consistent with the identification information of the first server, then enable the first server to perform operation and maintenance operations within the operation and maintenance period.

[0038] In a third aspect, an embodiment of the present application provides a computer device comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes any one of the above-mentioned on-site operation and maintenance control methods by executing the computer instructions.

[0039] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a computer to execute any one of the above-mentioned on-site operation and maintenance management methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the specific implementation methods or the description of the prior art. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0041] Figure 1 A flowchart of an on-site operation and maintenance control method provided by an embodiment of the present invention;

[0042] Figure 2 Schematic diagram of on-site operation and maintenance control and remote operation and maintenance control provided by an embodiment of the present invention;

[0043] Figure 3a Schematic diagram of the remote operation and maintenance process provided by an embodiment of the present invention Figure 1 ;

[0044] Figure 3b Schematic diagram of the on-site operation and maintenance process provided by the embodiment of the present invention Figure 1 ;

[0045] Figure 3c A schematic diagram of an operation audit process provided by an embodiment of the present invention;

[0046] Figure 4a Schematic diagram of the remote operation and maintenance process provided by an embodiment of the present invention Figure 2 ;

[0047] Figure 4b Schematic diagram of the on-site operation and maintenance process provided by the embodiment of the present invention Figure 2 ;

[0048] Figure 4c The related technology provided for the embodiment of the present invention includes a schematic diagram of an operation and maintenance bastion machine. DETAILED DESCRIPTION

[0049] To make the purpose, technical solutions, and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of this application.

[0050] A bastion host is a security mechanism commonly used to protect and manage IT infrastructure, especially in cloud environments or multi-tier network architectures. It acts as an intermediary, allowing operations personnel to securely access internal networks or sensitive systems while monitoring and logging all access activities.

[0051] However, there are still some shortcomings in using an operation and maintenance bastion host for operation and maintenance control: for example, it can only be used for remote operation and maintenance and is not applicable to on-site operation and maintenance scenarios.

[0052] When dealing with situations where access is not normally performed through the operation and maintenance bastion host, it is impossible to control operations that bypass the operation and maintenance bastion host by directly connecting to the server in the intranet environment. This poses the risk of data leakage and server attacks, and it may be impossible to trace the source of the operation and maintenance operations.

[0053] In related technologies, the operation and maintenance bastion host can continue to operate as long as it is authorized to connect, and there is no time limit control. If the operation and maintenance personnel fail to log out in time or fail to follow the safe operation and maintenance procedures, the security will be low.

[0054] Reference Figure 1 The embodiments of the present application provide an on-site operation and maintenance management method, which solves the technical problems of the related art in that on-site operation and maintenance cannot be performed and the operation and maintenance security is low. The method can manage the compliance and security of operation and maintenance access, including:

[0055] S100. The first server generates an on-site operation and maintenance request in response to the operation of setting the operation and maintenance duration. The on-site operation and maintenance request carries the operation and maintenance duration and identification information of the first server. The first server is deployed with an operation and maintenance plug-in and stores an on-site operation and maintenance key.

[0056] The first server's response to the operation to set the operation and maintenance duration may be in response to the operation and maintenance duration input by the operation and maintenance personnel. The operation and maintenance duration may be expressed in a unified time format, such as hours and minutes, to avoid confusion. The server's identification information may be a series of information that can uniquely identify and describe the server, including host name, IP address, operating system, hardware information, MAC address, and security certificate.

[0057] Operations and maintenance plug-ins can be used to enhance server management and monitoring capabilities. They can monitor operational performance metrics such as CPU, memory, and disk usage. Field operation and maintenance keys are encryption keys used for secure access and management of servers, performing authentication and authorization. Field operation and maintenance keys ensure that only authorized personnel can access sensitive data or perform operations, preventing unauthorized access and data leaks, thereby enhancing system security.

[0058] S200: The first server sends an on-site operation and maintenance request to the second server; wherein the second server stores an on-site operation and maintenance key. The second server is deployed with on-site operation and maintenance control software or an operation and maintenance control system. The on-site operation and maintenance key is stored in both the first server and the second server, and can be called by both the operation and maintenance plug-in deployed in the first server and the on-site operation and maintenance control software deployed in the second server.

[0059] S300: In response to the approval operation for the on-site operation and maintenance request, the second server generates a first on-site operation and maintenance code based on the operation and maintenance duration and the identification information of the first server, and encrypts the first on-site operation and maintenance code using the on-site operation and maintenance key to obtain a first encrypted operation and maintenance code.

[0060] During the transmission of the on-site operation and maintenance code, sensitive information (identification information and operation and maintenance time) must be encrypted to prevent eavesdropping or arbitrary forgery. The first and second servers can choose appropriate encryption methods, such as using asymmetric RSA encryption to encrypt the key and symmetric AES encryption to protect the data.

[0061] Reference Figure 2 , the first server, that is, several application servers, are all connected to the internal network. During the on-site operation and maintenance process, the operation and maintenance personnel access the operation and maintenance control system through the management computer. Any computer in the intranet can be used as a management computer. In this case, the management computer acts as the second server. On-site operation and maintenance is to perform operation and maintenance operations on the application server directly at the site where the application server is located. The management computer can be deployed with on-site operation and maintenance control software, or the management computer can also log in to the operation and maintenance control system. The approval operation can be an operation in which the approver logs into the operation and maintenance control system on the second server and approves the on-site operation and maintenance request.

[0062] Referring to Table 1, this application adopts the structure of deploying operation and maintenance management system (B / S architecture service) / on-site operation and maintenance management software and operation and maintenance plug-in, which is suitable for enterprises to achieve efficient, safe and controllable on-site operation and maintenance environment in information management.

[0063] Table 1 Schematic diagram of the effects of operation and maintenance plug-ins and operation and maintenance control systems

[0064]

[0065]

[0066] As shown in the table, the operation and maintenance control system is deployed on the second server. Its functions include responding to and approving on-site operation and maintenance requests from the first server. Upon approval, an on-site operation and maintenance code is generated based on the request. After the first server obtains operation and maintenance permissions, it records and uploads operation and maintenance operations performed during the maintenance period. The operation and maintenance control system then audits the first server's operations. If the first server is unable to connect to the operation and maintenance control system, the system cleans the operation and maintenance records.

[0067] The operation and maintenance plug-in is deployed on the server to be operated and maintained, that is, the first server. Accordingly, the following functions are implemented: only verified servers can enable operation and maintenance permissions, and remote access of unauthorized devices is prohibited. On-site operation and maintenance code verification and account logout functions are implemented. That is, if the on-site operation and maintenance code verification fails, the target operation and maintenance account is logged out. After the first server obtains operation and maintenance permissions, operation and maintenance operation monitoring, recording, and uploading functions are implemented. In the event that the first server cannot connect to the operation and maintenance control system, autonomous disaster recovery processing is implemented.

[0068] This application achieves the following through the mutual support of the operation and maintenance management system (B / S architecture service) / on-site operation and maintenance management software and operation and maintenance plug-ins: reducing the occurrence of unauthorized logins to the application server, reducing the occurrence of erroneous operation and maintenance, and having records that can be queried, recording the entire process of operation and maintenance operations, so that problems can be traced and security is improved.

[0069] The first-site maintenance code can be a string in the format of Server ID: Server ID, or Maintenance Duration: XX Minutes. The first-site maintenance code can also be a QR code. Convert the string to a QR code using a suitable encoding algorithm. This can be implemented using the Python library qrode.

[0070] S400. In response to the input operation of the first encrypted operation and maintenance code, the first server decrypts the input first encrypted operation and maintenance code using the on-site operation and maintenance key through the operation and maintenance plug-in to obtain a second on-site operation and maintenance code. If the identification information in the second on-site operation and maintenance code is recognized to be consistent with the identification information of the first server, the first server is enabled to perform operation and maintenance operations within the operation and maintenance period.

[0071] Among them, enabling the first server to perform operation and maintenance operations within the operation and maintenance period can be achieved through an operation and maintenance plug-in. After the operation and maintenance period ends, the operation permission is automatically revoked, and the operation and maintenance personnel can no longer perform related operations.

[0072] Specifically, the first server can be application server A1, and the second server can be control server B. Control server B responds to the on-site operation and maintenance request by generating and encrypting a first on-site operation and maintenance code (containing the information "Application server A1 allows eight hours of operation and maintenance"). The operation and maintenance plug-in decrypts the first encrypted operation and maintenance code and performs verification after decryption. If the second on-site operation and maintenance code entered by the current operation and maintenance personnel, containing the information "Application server A1 allows eight hours of operation and maintenance," is consistent with the actual application server A1 being operated by the operation and maintenance personnel, the operation and maintenance operation will be performed according to the "eight-hour limit" specified in the first on-site operation and maintenance code.

[0073] Furthermore, the server identifier of the first server collected by the operation and maintenance plug-in can be "aaaabbbbccccdddd", and the operation and maintenance time entered by the operation and maintenance personnel is 8 hours, that is, 28,800 seconds, generating an on-site operation and maintenance request to the second server. After the second server approves it, it generates a first on-site operation and maintenance code. The first on-site operation and maintenance code before encryption is "aaaabbbbccccdddd|28800". Using the on-site operation and maintenance key, which can be "11111111222222222, the first on-site operation and maintenance code is encrypted to obtain the first encrypted operation and maintenance code "y3DAH2W16fSKTUBLpCLwF64zKFl / rnP+cLoeACmuSfg=". The on-site operation and maintenance code is only used in the case of on-site operation and maintenance, and has sufficient length and contains sufficient information to increase the difficulty of cracking and increase security.

[0074] Application server A1 uses the on-site operation and maintenance key "1111111122222222" through the operation and maintenance plug-in to decrypt the input first encrypted operation and maintenance code, and obtains the second on-site operation and maintenance code "aaaabbbbccccdddd|28800" after decryption. It verifies whether the identification information of the application server in the second on-site operation and maintenance code is correct, that is, it verifies that the identification information of the application server in the second on-site operation and maintenance code is consistent with the identification information of application server A1, indicating that the on-site operation and maintenance code has not been tampered with. After the verification is correct, a valid countdown of 28,800 seconds is performed.

[0075] After the on-site operation and maintenance authority is enabled, the IP of the first server is set as the allowed IP of the SSH protocol. During the on-site operation and maintenance process, the operation and maintenance plug-in starts a timer to determine whether the time has expired. After the expiration, the IP of the first server is removed from the allowed IP of the SSH protocol.

[0076] Furthermore, different implementations are used depending on the server operating system. For operating systems with user interfaces, the operation and maintenance plug-in uses a pop-up window with the highest privileges, requiring the input of an on-site operation and maintenance code. After successful verification, the pop-up window closes before user operations can be performed. For operating systems without user interfaces, such as some Linux and domestic operating systems, the operation and maintenance plug-in monitors that after a user logs in, the first command must be to enter the on-site operation and maintenance code; otherwise, the user is immediately logged out.

[0077] This application controls the compliance of on-site operation and maintenance operations by performing verification before executing on-site operation and maintenance operations. Specifically, an on-site operation and maintenance code containing operation and maintenance duration information is generated based on an operation and maintenance request that carries the operation and maintenance duration. After the on-site operation and maintenance code is verified, the first server enables the operation and maintenance operation permission based on the operation and maintenance duration. The first server cancels the operation and maintenance operation permission after the operation and maintenance duration expires.

[0078] Compared with related technologies, this application sets up an on-site operation and maintenance code verification step, which greatly reduces the occurrence of on-site operation and maintenance errors and further ensures the designation of operation and maintenance personnel. The validity period of on-site operation and maintenance authority is increased, and the timeliness of operation and maintenance management and control is improved. It also overcomes the limitation of related technologies that require reliance on operation and maintenance bastion machines for operation and maintenance. This application only needs to deploy operation and maintenance management and control software and operation and maintenance plug-ins to achieve operation and maintenance management and control, without the need for additional hardware, reducing the cost of operation and maintenance management and control.

[0079] As an implementation method, please continue to refer to Figure 2 During remote operation and maintenance, maintenance personnel access the operation and maintenance control system or open on-site operation and maintenance control software through the maintenance computer. Any computer on the intranet can serve as the maintenance computer, acting as a secondary server. Remote operation and maintenance involves maintenance personnel performing maintenance operations on application servers via a remote connection. The maintenance computer is the computer the maintenance personnel actually operate during remote operation and maintenance. It logs into the primary server to be maintained through a remote network connection, performing remote maintenance operations on the primary server.

[0080] Specifically, during the remote operation and maintenance process, the SSH protocol is used for remote operation and maintenance connections, and other connection protocols, such as telnet and snmp, are disabled through the operation and maintenance plug-in. The operation and maintenance plug-in also disables other IPs from using SSH to connect to the first server. After the remote operation and maintenance is approved, the IP address of the first server is set as the allowed IP address of the SSH protocol. During the remote operation and maintenance process, the operation and maintenance plug-in starts a timer to determine whether the time has expired. After the time has expired, the IP address of the first server is removed from the allowed IP addresses of the SSH protocol.

[0081] As an implementation method, refer to Figures 3a to 3cDuring the remote operation and maintenance process, the operation and maintenance personnel apply for remote operation and maintenance on the operation and maintenance computer. After the approval personnel give the operation and maintenance validity period, the operation and maintenance personnel use the computer used at the time of application to remotely connect to the operated server for operation and maintenance within the operation and maintenance validity period.

[0082] During the on-site operation and maintenance process, the operation and maintenance personnel apply for on-site operation and maintenance, and the approval personnel generate an on-site operation and maintenance code at the same time after approval. The on-site operation and maintenance code contains the operation and maintenance validity period. The operation and maintenance personnel perform operation and maintenance after verification using the on-site operation and maintenance code on the operated server.

[0083] During the operation audit process, the management personnel search the system based on the operated server, time, applicant, remote operation computer and other information including operations, and restore the full record of operation and maintenance operations.

[0084] As an implementation method, refer to Figures 4a to 4c During on-site maintenance, maintenance personnel log in directly to application server 1 and perform maintenance operations. During remote maintenance, maintenance personnel log in to application server 2 from a maintenance computer via a remote connection on the internal network. In related technologies, when using a bastion host for maintenance, the bastion host records the entire maintenance process by recording the application server's screen.

[0085] As an embodiment, the method further includes: S410, if it is identified that the identification information in the second on-site operation and maintenance code is inconsistent with the identification information of the first server, disabling the first server's permission to perform operation and maintenance operations, and recording the disabling information.

[0086] Specifically, if the following situations occur, operation and maintenance operations are not allowed:

[0087] Case 1: The operation and maintenance plug-in in application server A2 decrypts the first encrypted operation and maintenance code, and verifies after decryption that the information contained in the second on-site operation and maintenance code entered by the current operation and maintenance personnel, "Application server A1 allows operation and maintenance for eight hours", is inconsistent with the application server A2 that the actual operation and maintenance personnel is operating.

[0088] Case 2: The operation and maintenance plug-in in application server A1 decrypts the first encrypted operation and maintenance code, and verifies after decryption that the information contained in the second on-site operation and maintenance code entered by the current operation and maintenance personnel, "Application server A2 allows operation and maintenance for eight hours", is inconsistent with the application server A1 that the actual operation and maintenance personnel is operating.

[0089] Case 3: The operation and maintenance plug-in in the application server A1 decrypts the first encrypted operation and maintenance code, but fails to decrypt it correctly and cannot obtain valid information.

[0090] S420: If the identification information in the second on-site operation and maintenance code is inconsistent with the identification information of the first server for a predetermined number of consecutive times, the first server is disabled from sending on-site operation and maintenance requests. Furthermore, if the identification information in the second on-site operation and maintenance code is inconsistent with the identification information of the first server for three consecutive times, the first server is disabled from sending on-site operation and maintenance requests, or the operation and maintenance account of the first server is directly logged out.

[0091] It achieves the technical effect that unverified operation and maintenance is impossible, and improves the safety of operation and maintenance.

[0092] As an embodiment, before the first server responds to the operation of setting the operation and maintenance time, the method also includes: the first server responds to the operation and maintenance account login operation, receives the input operation and maintenance account and operation and maintenance password; the first server logs in to the target operation and maintenance account based on the operation and maintenance account and operation and maintenance password.

[0093] After obtaining the second on-site operation and maintenance code, the method further includes: if it is recognized that the identification information in the second on-site operation and maintenance code is inconsistent with the identification information of the first server, logging out of the target operation and maintenance account.

[0094] In the related technology, the first server obtains the operation and maintenance account and the operation and maintenance password, and then logs in to the operation and maintenance account, and can directly perform operation and maintenance operations, which may have security risks. In this application, when logging in to the operation and maintenance account, if the on-site operation and maintenance personnel need to perform operation and maintenance operations, the identity is verified through on-site operation and maintenance code verification. After successful verification, the operation and maintenance permissions for the preset time are opened, which improves the security of on-site operation and maintenance operations.

[0095] As an implementation method, the on-site operation and maintenance key includes multiple sets of serial number keys and corresponding serial numbers;

[0096] The first on-site operation and maintenance code is encrypted in the following manner: any serial number key from a plurality of groups of serial number keys is randomly selected, and the first on-site operation and maintenance code is encrypted using any serial number key to obtain a first encrypted operation and maintenance code containing a serial number.

[0097] The first encrypted operation and maintenance code is decrypted in the following manner: the operation and maintenance plug-in uses the serial number and the on-site operation and maintenance key to decrypt the input first encrypted operation and maintenance code containing the serial number to obtain a second on-site operation and maintenance code.

[0098] Specifically, both application server A1 and management server B store on-site operation and maintenance keys. The on-site operation and maintenance keys include multiple groups of serial number keys and corresponding serial numbers. The randomly obtained key serial number is 3.

[0099] The serial key for key number 3 is "11111111122222222", so the first encrypted operation code is "3|y3DAH2W16fSKTUBLpCLwF64zKFl / rnP+cLoeACmuSfg=". On application server A1, the operation and maintenance personnel decrypt the input first encrypted operation code using the serial key "11111111122222222" for key number 3. After decryption, the second on-site operation code is "aaaabbbbccccdddd|28800|3".

[0100] First, verify the key serial number consistency. Specifically, verify whether serial number 3 in the second on-site operation and maintenance code matches the serial number of the on-site operation and maintenance key used by application server A1 through the operation and maintenance plug-in. Then, verify whether the application server identification information in the second on-site operation and maintenance code is correct. Specifically, verify whether the application server identification information in the second on-site operation and maintenance code matches the identification information of application server A1. If verification is correct, a 28,800-second countdown begins.

[0101] As an implementation method, the first server stores a disaster recovery code, which includes identification information of the first server and version information of the operation and maintenance plug-in; the method also includes: the first server responds to the input operation of the disaster recovery code, and if it is recognized that the identification information in the disaster recovery code is consistent with the identification information of the first server, the first server is enabled to perform operation and maintenance operations within the operation and maintenance period.

[0102] Specifically, this application deploys a disaster recovery emergency method. When the second server is offline, the on-site operation and maintenance management software crashes, or the communication network cannot be connected, the first server is allowed to independently obtain the authority to perform operation and maintenance operations through disaster recovery code verification.

[0103] Furthermore, different implementations are used depending on the server operating system. For operating systems with user interfaces, the operation and maintenance plug-in uses a pop-up window with the highest privileges, requiring the user to enter a disaster recovery code. After successful verification, the pop-up window closes before user operations can be performed. For operating systems without user interfaces, such as some Linux and domestic operating systems, the operation and maintenance plug-in monitors that after a user logs in, the first command must be to enter the disaster recovery code; otherwise, the user is immediately logged out.

[0104] In one embodiment, after enabling the first server's permission to perform operation and maintenance operations within the operation and maintenance period, the method further includes: starting a timer through the operation and maintenance plug-in, and disabling the first server's permission to perform operation and maintenance operations after the timer reaches the operation and maintenance period;

[0105] The operation and maintenance operation is recorded by the operation and maintenance plug-in, and after the timing reaches the operation and maintenance time, the operation and maintenance operation record performed by the first server within the operation and maintenance time is saved.

[0106] Among them, recording operation and maintenance operations through the operation and maintenance plug-in can be achieved by periodically obtaining information such as the execution account, execution time and execution results of the operation and maintenance operations, and sending the recorded operation and maintenance operations to the operation and maintenance management and control software in the second server, which will be sorted and stored by the operation and maintenance management and control software. The sorting and storage includes classification, and adding command type labels and other operations, thereby realizing process supervision of on-site operation and maintenance.

[0107] As an implementation method, the operation and maintenance plug-in is deployed with a daemon program. The daemon program is configured to monitor in real time whether the operation and maintenance plug-in on the first server is in working mode. If the operation and maintenance plug-in is in non-working mode, the operation and maintenance plug-in is activated. The daemon programs can be two services, both of which are set to auto-start mode at startup. The two services monitor each other's status. If one service fails, the other service can immediately take measures to restart or notify relevant personnel. This can reduce the occurrence of bypassing the operation and maintenance plug-in in the same way as bypassing the operation and maintenance bastion host in related technologies.

[0108] Furthermore, the daemon can set a scheduled startup task to ensure that the operation and maintenance plug-in is enabled after the first server is powered on. The daemon can also monitor the completion of the scheduled startup task to ensure that the operation and maintenance plug-in can be started after the first server is powered on, thereby reducing the possibility of the operation and maintenance plug-in being unable to start due to the scheduled startup task being modified.

[0109] The embodiment of the present application provides an on-site operation and maintenance management system, including an operation and maintenance request generation module, an operation and maintenance request sending module, an on-site operation and maintenance code generation module, and an operation authority verification module;

[0110] An operation and maintenance request generation module, applied to the first server, is configured to generate an on-site operation and maintenance request in response to an operation to set an operation and maintenance duration; wherein the on-site operation and maintenance request carries the operation and maintenance duration and identification information of the first server, and the first server is deployed with an operation and maintenance plug-in and stores an on-site operation and maintenance key;

[0111] An operation and maintenance request sending module, applied to the first server, is configured to send an on-site operation and maintenance request to the second server; wherein the second server stores an on-site operation and maintenance key;

[0112] an on-site operation and maintenance code generation module, applied to the second server, configured to, in response to an approval operation for the on-site operation and maintenance request, generate a first on-site operation and maintenance code based on the operation and maintenance duration and identification information of the first server, and encrypt the first on-site operation and maintenance code using the on-site operation and maintenance key to obtain a first encrypted operation and maintenance code;

[0113] The operation authority verification module is applied to the first server and is configured to respond to the input operation of the first encrypted operation and maintenance code, decrypt the input first encrypted operation and maintenance code using the on-site operation and maintenance key through the operation and maintenance plug-in, and obtain a second on-site operation and maintenance code. If the identification information in the second on-site operation and maintenance code is recognized to be consistent with the identification information of the first server, the first server is enabled to perform operation and maintenance operations within the operation and maintenance period.

[0114] As an embodiment, the operation authority verification module is further configured to disable the first server's authority to perform operation and maintenance operations if it is recognized that the identification information in the second on-site operation and maintenance code is inconsistent with the identification information of the first server, and record the disabling information;

[0115] If the identification information in the second on-site operation and maintenance code is identified to be inconsistent with the identification information of the first server for a preset number of consecutive times, the permission of the first server to send on-site operation and maintenance requests is disabled.

[0116] As an embodiment, the operation and maintenance request generation module is further configured to: after the first server responds to the operation and maintenance account login operation, receive the input operation and maintenance account and operation and maintenance password;

[0117] The first server logs in to the target operation and maintenance account based on the operation and maintenance account and password;

[0118] The operation authority verification module is further configured to: log out the target operation and maintenance account if it is recognized that the identification information in the second on-site operation and maintenance code is inconsistent with the identification information of the first server.

[0119] As an implementation method, the on-site operation and maintenance key includes multiple sets of serial number keys and corresponding serial numbers;

[0120] The on-site operation and maintenance code generation module is also configured as follows:

[0121] Randomly select any one of the multiple groups of serial keys, and use any one of the serial keys to encrypt the first on-site operation and maintenance code to obtain a first encrypted operation and maintenance code containing the serial number;

[0122] The operation permission verification module is also configured to:

[0123] The operation and maintenance plug-in uses the serial number and the on-site operation and maintenance key to decrypt the input first encrypted operation and maintenance code containing the serial number to obtain a second on-site operation and maintenance code.

[0124] As an implementation method, the first server stores a disaster recovery code, which includes identification information of the first server; an on-site operation and maintenance management system also includes a disaster recovery code response module, which is applied to the first server and is configured to respond to the input operation of the disaster recovery code. If it is recognized that the identification information in the disaster recovery code is consistent with the identification information of the first server, the first server is enabled to perform operation and maintenance operations within the operation and maintenance period.

[0125] As an embodiment, the operation authority verification module is further configured to: start a timer through the operation and maintenance plug-in, and after the timer reaches the operation and maintenance time, disable the first server's authority to perform the operation and maintenance operation;

[0126] The operation and maintenance operation is recorded by the operation and maintenance plug-in, and after the timing reaches the operation and maintenance time, the operation and maintenance operation record performed by the first server within the operation and maintenance time is saved.

[0127] As an implementation method, the operation and maintenance plug-in is deployed with a daemon, which is configured to monitor in real time whether the operation and maintenance plug-in in the first server is in working mode, and activate the operation and maintenance plug-in if the operation and maintenance plug-in is in non-working mode.

[0128] The present application provides a computer device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to execute an on-site operation and maintenance management method provided in the above embodiment.

[0129] This computer equipment comprises: one or more processors, memory, and the interface for connecting each component, including high-speed interface and low-speed interface. Each component utilizes different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer equipment, including instructions stored in the memory or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Equally, multiple computer equipment can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system).

[0130] The processor may be a central processing unit, a network processor, or a combination thereof. The processor may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0131] The memory stores instructions that can be executed by at least one processor, so that the at least one processor executes the method shown in the above embodiment.

[0132] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the computer device, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the storage may optionally include a memory remotely located relative to the processor, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0133] The memory may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid state drive; the memory may also include a combination of the above types of memory.

[0134] The computer device further includes a communication interface for the computer device to communicate with other devices or a communication network.

[0135] The present application provides a computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions are used to enable a computer to execute an on-site operation and maintenance management method as provided in the above embodiment.

[0136] The embodiments of the present application also provide a computer-readable storage medium. The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0137] An embodiment of the present application provides a computer program product, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform a method according to any embodiment of the present application.

[0138] Although the embodiments of the present application have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present application, and such modifications and variations shall fall within the scope defined by the appended claims.

[0139] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0140] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing this application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0141] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0142] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0143] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0144] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0145] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0146] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0147] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

[0148] Although the embodiments of the present application have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present application, and such modifications and variations shall fall within the scope defined by the appended claims.

Claims

1. A field operation and maintenance management method, characterized in that: include: The first server generates an on-site operation and maintenance request in response to the operation of setting the operation and maintenance duration; wherein the on-site operation and maintenance request carries the operation and maintenance duration and identification information of the first server, and the first server is deployed with an operation and maintenance plug-in and stores an on-site operation and maintenance key; The first server sends the on-site operation and maintenance request to the second server; wherein the second server stores the on-site operation and maintenance key; The second server generates, in response to the approval operation for the on-site operation and maintenance request, a first on-site operation and maintenance code based on the operation and maintenance duration and the identification information of the first server, and encrypts the first on-site operation and maintenance code using the on-site operation and maintenance key to obtain a first encrypted operation and maintenance code; In response to the input operation of the first encrypted operation and maintenance code, the first server decrypts the input first encrypted operation and maintenance code using the on-site operation and maintenance key through the operation and maintenance plug-in to obtain a second on-site operation and maintenance code. If it is recognized that the identification information in the second on-site operation and maintenance code is consistent with the identification information of the first server, the permission of the first server to perform operation and maintenance operations within the operation and maintenance period is enabled.

2. The method according to claim 1, characterized in that The method further includes: if it is recognized that the identification information in the second on-site operation and maintenance code is inconsistent with the identification information of the first server, disabling the permission of the first server to perform operation and maintenance operations, and recording the disabling information; If the identification information in the second on-site operation and maintenance code is identified to be inconsistent with the identification information of the first server for a preset number of consecutive times, the permission of the first server to send on-site operation and maintenance requests is disabled.

3. The method according to claim 1, characterized in that Before the first server responds to the operation of setting the operation and maintenance duration, the method further includes: The first server receives the input operation and maintenance account number and operation and maintenance password in response to the operation and maintenance account login operation; The first server logs in to the target operation and maintenance account based on the operation and maintenance account and the operation and maintenance password; After obtaining the second on-site operation and maintenance code, the method further includes: If it is identified that the identification information in the second on-site operation and maintenance code is inconsistent with the identification information of the first server, the target operation and maintenance account is logged out.

4. The method according to claim 1, wherein The on-site operation and maintenance key includes multiple groups of serial number keys and corresponding serial numbers; The first on-site operation and maintenance code is encrypted in the following way: Randomly selecting any one of the plurality of groups of serial keys, and using the any one of the serial keys to encrypt the first on-site operation and maintenance code to obtain a first encrypted operation and maintenance code containing a serial number; Decrypt the first encrypted operation code in the following way: The operation and maintenance plug-in uses the serial number and the on-site operation and maintenance key to decrypt the input first encrypted operation and maintenance code containing the serial number to obtain the second on-site operation and maintenance code.

5. The method according to claim 1, wherein The first server stores a disaster recovery code, which includes identification information of the first server; the method also includes: the first server responds to the input operation of the disaster recovery code, and if it is recognized that the identification information in the disaster recovery code is consistent with the identification information of the first server, the first server is enabled to perform operation and maintenance operations within the operation and maintenance period.

6. The method according to claim 1, characterized in that After enabling the permission of the first server to perform operation and maintenance operations within the operation and maintenance time period, the method further includes: starting a timer by the operation and maintenance plug-in, and disabling the permission of the first server to perform operation and maintenance operations after the timer reaches the operation and maintenance time period; The operation and maintenance operation is recorded by the operation and maintenance plug-in, and after the timing reaches the operation and maintenance duration, the operation and maintenance operation record performed by the first server within the operation and maintenance duration is saved.

7. The method according to claim 1, characterized in that The operation and maintenance plug-in is deployed with a daemon, which is configured to monitor in real time whether the operation and maintenance plug-in in the first server is in working mode, and activate the operation and maintenance plug-in if the operation and maintenance plug-in is in non-working mode.

8. A field operation and maintenance control system, characterized in that: It includes operation and maintenance request generation module, operation and maintenance request sending module, on-site operation and maintenance code generation module and operation authority verification module; An operation and maintenance request generation module, applied to the first server, is configured to generate an on-site operation and maintenance request in response to an operation to set an operation and maintenance duration; wherein the on-site operation and maintenance request carries the operation and maintenance duration and identification information of the first server, and the first server is deployed with an operation and maintenance plug-in and stores an on-site operation and maintenance key; an operation and maintenance request sending module, applied to the first server, and configured to send the on-site operation and maintenance request to the second server; wherein the second server stores the on-site operation and maintenance key; an on-site operation and maintenance code generation module, applied to the second server, configured to, in response to an approval operation for the on-site operation and maintenance request, generate a first on-site operation and maintenance code based on the operation and maintenance duration and identification information of the first server, and encrypt the first on-site operation and maintenance code using the on-site operation and maintenance key to obtain a first encrypted operation and maintenance code; An operation authority verification module is applied to the first server and is configured to respond to the input operation of the first encrypted operation and maintenance code, decrypt the input first encrypted operation and maintenance code using the on-site operation and maintenance key through the operation and maintenance plug-in, and obtain a second on-site operation and maintenance code; if it is recognized that the identification information in the second on-site operation and maintenance code is consistent with the identification information of the first server, then enable the first server to perform operation and maintenance operations within the operation and maintenance period.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the on-site operation and maintenance control method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute an on-site operation and maintenance management method according to any one of claims 1 to 7.

Images