Authority management system and method for unmanned aerial vehicle ground station servitization architecture

Abstract

The invention relates to the field of authority management, in particular to an authority management system and method for an unmanned aerial vehicle ground station servitization architecture. The authority management system is located in a servitization framework and specifically comprises a user management center module, a server authority management module and a service calling side authority management module. The user management center module is located in a service registration center of the servitization framework and is responsible for establishing and maintaining an address book linked list of a management end, managing the life cycle of a user token and performing user authentication and service discovery verification; and the server authority management module is located at the server of the servitization framework and is responsible for establishing and maintaining a server user token chain table and verifying service calling initiated by the service calling end. And the service calling end authority management module is located at the service calling end of the servitization framework and is responsible for performing instruction interaction with the user management center and completing user authentication application and user heartbeat reporting operation.

Description

Technical Field

[0001] The present invention relates to the field of authority management, and in particular to an authority management system and method for a service-oriented architecture of an unmanned aerial vehicle ground station. Background Art

[0002] With the rapid development of avionics technology, the number of peripheral resources and network calls that the UAV ground station system needs to handle has increased significantly, and the scale and development difficulty of avionics software have also increased. In order to solve the problems of portability and reusability of ground station software, improve the development and integration efficiency of ground station software, and interoperability with other systems in heterogeneous distributed environments, service-oriented technology suitable for the ground station software operating environment has emerged. The traditional service-oriented architecture consists of at least three roles: server, service caller, and service registration center. They can be deployed independently on any node in the network or on the same node at the same time. As a service provider, the server is responsible for defining and publishing service information, and receiving and processing call requests from the service caller; the service caller integrates service interface description information, initiates service discovery requests to the service registration center, and initiates service calls to the server; the service registration center is responsible for processing the service registration information published by the server, providing service discovery functions, and supporting the service caller to quickly and effectively locate the target service. Service-oriented technology provides a solution for the efficient integration and operation of software in the UAV ground station environment.

[0003] For UAV ground station systems with high complexity and integration, while using service-oriented operation, maintenance and management, it is necessary to consider the high security requirements of the system. In service-oriented technology, permission management is a key component to ensure system security. In order to run the service-oriented framework safely and efficiently in a ground station system with high real-time, high reliability and resource-constrained embedded devices, it is necessary to design a safe, reliable and relatively lightweight permission management system and method. Existing service-oriented permission management technology is mainly aimed at Internet and enterprise-level systems, relying on a relatively complex service-oriented system that occupies more computing resources, and is not feasible in UAV ground station systems. Summary of the invention

[0004] Purpose of the invention: To solve this problem, the present invention provides a permission management system and method for the service-oriented architecture of UAV ground stations. The permission management system provided by the present invention includes a user management center module, a server-side permission management module and a service call-side permission management module. The system is relatively lightweight and has the feasibility of running on embedded devices of ground stations. It occupies less resources and has a low degree of coupling with the service-oriented framework. The permission management method provided by the present invention adds a user management and permission classification mechanism on the basis of the traditional ground station service-oriented architecture to meet the system's requirements for security and reliability.

[0005] Technical solution:

[0006] In the first aspect, a permission management system for a service-oriented architecture of a UAV ground station is provided. The permission management system is located within the service-oriented framework and specifically includes: a user management center module, a server-side permission management module, and a service call-side permission management module;

[0007] The user management center module is located in the service registration center of the service-oriented framework. It is responsible for establishing and maintaining the management end address book list, managing the user token life cycle, and performing user authentication and service discovery verification.

[0008] The server-side permission management module is located on the server side of the service-oriented framework. It is responsible for establishing and maintaining the server-side user token list and verifying the service calls initiated by the service caller.

[0009] The service call end authority management module is located at the service call end of the service-oriented framework. It is responsible for interacting with the user management center to complete user authentication applications and user heartbeat reporting operations.

[0010] Furthermore, the address book linked list is used to store basic user information, including user name, user token and user access rights to various services, and at the same time establish a mapping relationship table between user token and user-accessible services.

[0011] Furthermore, the user management center module includes: user token lifecycle management module, user authentication module, and service discovery verification module:

[0012] The user token lifecycle management module is used to: generate a user token and save it in the address book when the user authentication succeeds; filter the services accessible to the user according to the user's authority level and service level, establish a mapping table between user tokens and services, and send instructions to add the user token to the server-side authority management module deployed on the corresponding server; when the user is offline or the token expires, the user token becomes invalid, the user's token information is deleted from the address book, and an instruction to delete the user token is sent to the corresponding server-side authority management module;

[0013] The user authentication module is used to: receive the user identity information submitted by the service caller authority management module for verification, and return the authentication result and user token;

[0014] The service discovery verification module is used for: the service caller sends the service discovery request instruction carrying the service token to the service registration center to verify the authority of the token, and the service registration center performs subsequent service routing and service discovery result feedback.

[0015] Furthermore, the server-side rights management module is specifically used to:

[0016] Receive the user token synchronization instruction sent by the user management center, establish and update the local user token chain list; the server-side permission management module deployed on different servers only maintains the user tokens held by users who have the permission to access this service;

[0017] After receiving the service call request containing the user token sent by the service caller, the token is searched in the local user token list; if the token is included in the list, the server returns the requested service information to the service caller; if the token is not included in the list, the call failure result is returned to the service caller.

[0018] Furthermore, it is characterized in that the service call end rights management module is specifically used for:

[0019] Provide users with a user authentication request interface to initiate an authentication application to the user management center module and obtain a user token;

[0020] After authentication, the service caller carries the user token to initiate a service discovery request to the service registration center to obtain the service address information, then carries the user token to initiate a service call request to the server to obtain the required service information, and periodically reports the user's online status to the user management center module.

[0021] In the second aspect, a permission management method for a service-oriented architecture of a UAV ground station is provided, including:

[0022] Build a rights management system based on the ground station service framework;

[0023] The user management center module reads the local user information configuration file and initializes the address book link list; the address book link list includes the user's username, user password MD5 code and the user's access rights to the service;

[0024] After the service is registered, the user management center module sends the token information of all users of all permission levels in the current address book to the permission management module of the server;

[0025] The service call end authority management module initiates a user authentication request to the user management center module, carrying the user name, user password and user address unique identifier;

[0026] After receiving the user authentication request, the user management center module searches for the user name in the address book list and performs an MD5 check on the user password. If the check succeeds, a user token is generated and saved in the address book. A mapping between the token and the service is established. At the same time, the user token is synchronized with the server-side user token management unit, and the token and the authentication success result are sent to the calling-side permission management module.

[0027] After receiving the user token, the service caller authority management module provides the token to the service caller, and the service caller sends a service discovery request to the service registration center with the token and service identification information;

[0028] When the service registration center receives a service discovery request, the user management center module verifies the user's authority based on the user token. After the verification is passed, the service registration center performs service routing operations and returns a service discovery response to the caller, providing the location information of the service.

[0029] After receiving the service discovery response, the service caller initiates a service call request to the server with the user token.

[0030] After the server receives the service call request, the server's authority management module verifies the user token carried in the call request; if the local user token list contains the token, the server provides service information to the caller.

[0031] Furthermore, the life cycle of the user token is maintained by the user management center module.

[0032] Furthermore, the method further comprises:

[0033] After the user authentication is successful, the service call end authority management module periodically sends heartbeat information to the user management center.

[0034] Furthermore, the method further comprises:

[0035] After the service registration is successful, the user management center will send the tokens of all users in the current address book that meet the access rights to the server;

[0036] When the user's remote authentication is successful, the user management center issues the currently generated token for the user;

[0037] When the heartbeats reported by the user from all locations have timed out or the token refresh time has been reached, the user's token will be deactivated, and the user management center will push the deactivation information of the token to all services that contain the token;

[0038] When the user successfully authenticates again, the user token will be regenerated by the user management center.

[0039] Beneficial effects: Aiming at the software operation scenario of the UAV ground station, the present invention designs a permission management system and method for the service-oriented architecture of the UAV ground station. On the basis of the traditional ground station service-oriented framework, a user management and permission classification mechanism is added, involving various aspects of service-oriented communication such as service discovery and service call, providing a safe, reliable and lightweight permission management solution for the ground station using service-oriented technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a structural diagram of the rights management system of the present invention;

[0041] Figure 2 A cross-link relationship diagram of the rights management system of the present invention;

[0042] Figure 3 The figure is a flow chart of the rights management method of the present invention. DETAILED DESCRIPTION

[0043] In order to better understand the present invention, the present invention is further described in detail below based on the accompanying drawings and embodiments.

[0044] The present invention mainly relates to a rights management system for a service-oriented architecture of a UAV ground station. The system includes the following modules:

[0045] (1) User Management Center Module: This module is located in the service registration center of the service-oriented framework and is responsible for establishing and maintaining the management-side address book list and for communicating with the server-side and service-calling-side authority management modules.

[0046] (2) Server-side permission management module: This module is located on the server side of the service-oriented framework and is responsible for establishing and maintaining the server-side user token list and for performing command interaction with the user management center module and the service call end.

[0047] (3) Service call end authority management module: This module is located at the service call end of the service-oriented framework and is responsible for interacting with the user management center to complete operations such as user authentication application and user heartbeat reporting.

[0048] The present invention mainly relates to a permission management method for a service-oriented architecture of a UAV ground station, and the method mainly includes the following contents:

[0049] (1) User authentication and lifecycle management: The service caller authority management module initiates a user authentication request, and the user management center performs user authentication, generates and provides user tokens, and synchronizes token information with the server authority management module.

[0050] (2) Service discovery including authority authentication: The service caller carries the user token to initiate a service discovery request to the service management center. The user management center first performs token and authority verification. If the verification is successful, the service registration center performs subsequent service routing and service distribution operations.

[0051] (3) Service call including authority authentication: The service caller carries the user token to initiate a service call request to the server. After the server receives the request, the server's authority management module authenticates the user token. After the authentication is successful, the server provides the requested service information to the caller.

[0052] (4) Permission classification: The administrator divides the user's permission level into authenticated user, authorized user and privileged user levels, and stores them in the local user information configuration file. The user management center reads this information when initializing the address book list. Each service has different requirements for user permission levels. If the service requires an authenticated user level, users of all levels can access it; if it requires an authorized user level, authorized and privileged users can access it; if it requires a privileged user level, only privileged users can access it. When the caller initiates a service discovery request, the user management center verifies the user token and verifies whether the user matches the permission level required by the service.

[0053] 1. Permission management system for drone ground station service architecture

[0054] The system includes a user management center module, a server-side authority management module, and a service caller-side authority management module. Figure 1 shown.

[0055] (1) User Management Center Module

[0056] This module is located in the service registration center of the service-oriented framework and is responsible for establishing and maintaining the management-side address book list, managing the user token lifecycle, and performing user authentication and service discovery verification.

[0057] The address book linked list is used to store basic user information, including user name, user token, and user access rights to various services, and at the same time establish a mapping relationship table between user tokens and user-accessible services.

[0058] User token lifecycle management mainly includes token generation, synchronization and destruction. When user authentication succeeds, this module generates a user token and saves it in the address book. When service registration succeeds or user authentication succeeds, the user management center module screens the services accessible to the user according to the user's authority level and service level, establishes a mapping table between user tokens and services, and sends instructions to add the user token to the server-side authority management module deployed on the corresponding server; when the user is offline or the token expires, the user token becomes invalid, the user's token information is deleted from the address book, and this module sends instructions to delete the user token to the corresponding server-side authority management module.

[0059] User authentication refers to the user management center module receiving the user identity information submitted by the service call end permission management module for verification, and returning the authentication result and user token; service discovery verification refers to the service call end sending the service discovery request instruction carrying the service token to the service registration center, the user management center module verifies the token permissions, and the service registration center performs subsequent service routing and service discovery result feedback.

[0060] (2) Server-side permission management module

[0061] This module is located on the server side of the service-oriented framework and is responsible for establishing and maintaining the server-side user token list and verifying the service calls initiated by the service caller.

[0062] This module receives the user token synchronization instruction sent by the user management center, establishes and updates the local user token chain list, and the server-side permission management module deployed on different servers only maintains the user tokens held by users who have the permission to access this service.

[0063] After receiving the service call request containing the user token sent by the service caller, this module searches for the token in the local user token list; if the token is included in the list, the server returns the requested service information to the service caller; if the token is not included in the list, the call failure result is returned to the service caller.

[0064] (3) Service caller rights management module

[0065] This module is located at the service call end of the service-oriented framework and is responsible for user authentication application and user heartbeat reporting.

[0066] This module provides users with a user authentication request interface to initiate an authentication application to the user management center module and obtain a user token. After authentication, the service caller can carry the user token to initiate a service discovery request to the service registration center to obtain service address information, and then carry the user token to initiate a service call request to the server to obtain the required service information, and periodically report the user's online status to the user management center module.

[0067] The cross-link relationship diagram of each module in this system is as follows Figure 2 shown.

[0068] 2. Permission management method for UAV ground station service-oriented architecture

[0069] The present invention provides a permission management method for a service-oriented architecture of a UAV ground station, the process is as follows: Figure 3 As shown, the following steps are included:

[0070] Step 1: Based on the ground station service framework (service registration center, server and service call end), build a permission management system (user management center module, server permission management module and service call end permission management module).

[0071] Step 2: The user management center module reads the local user information configuration file and initializes the address book list, including the user's username, user password MD5 code and the user's access rights to the service.

[0072] Step 3: The server initiates a service registration request to the service registration center, which returns the service registration result, and the user management center module sends the token information of all users with different permission levels in the current address book to the permission management module of the server.

[0073] Step 4: The service call end authority management module initiates a user authentication request to the user management center module, carrying the user name, user password and user address unique identifier.

[0074] Step 5: After receiving the user authentication request, the user management center module searches for the user name in the address book list and performs an MD5 check on the user password. If the check succeeds, a user token is generated and saved in the address book, and a mapping between the token and the service is established. At the same time, the user token is synchronized with the server-side user token management unit, and the token and the authentication success result are sent to the calling-side permission management module; if the check fails, an error code is returned to the calling-side permission management module based on the failure reason (invalid user name or wrong password).

[0075] Step 6: After receiving the user token, the service caller authority management module provides the token to the service caller, and the service caller sends a service discovery request to the service registration center with the token and service identification information.

[0076] Step 7: The service registration center receives the service discovery request, and the user management center module verifies the user's rights based on the user token. If the requested service requires an authenticated user level, users of all levels can be verified; if an authorized user level is required, authorized and privileged users can be verified; if a privileged user level is required, only privileged users can be verified. After passing, the service registration center performs service routing operations and returns a service discovery response to the caller, providing the location information of the service; if the verification fails, an error code is returned to the caller's rights management module based on the failure reason (user token error or user rights not matching).

[0077] Step 8: After receiving the service discovery response, the service caller initiates a service call request to the server with the user token.

[0078] Step 9: After receiving the service call request, the server-side authority management module verifies the user token carried in the call request. If the local user token list contains the token, the server provides service information to the caller; if not, an error code is returned to the caller based on the failure reason (user token does not exist).

[0079] Among them, the life cycle of the user token is maintained by the user management center module. After the user authentication is successful, the service call end permission management module periodically sends heartbeat information to the user management center. After the service registration is successful, the user management center will send all user tokens in the current address book that meet the access rights to the server. When the user successfully authenticates remotely, the user management center issues the currently generated token for the user. When the heartbeats reported by the user from all locations have timed out or the token refresh time has been reached, the user's token is deactivated, and the user management center pushes the deactivation information of the token to all services containing the token; when the user successfully authenticates again, the user token is regenerated by the user management center.

Claims

1. A permission management system for the service-oriented architecture of UAV ground stations, characterized in that: The permission management system is located in the service-oriented framework, and specifically includes: user management center module, server-side permission management module, and service call-side permission management module; The user management center module is located in the service registration center of the service-oriented framework. It is responsible for establishing and maintaining the management end address book list, managing the user token life cycle, and performing user authentication and service discovery verification. The server-side permission management module is located on the server side of the service-oriented framework and is responsible for establishing and maintaining the server-side user token chain list and verifying the service calls initiated by the service caller. The service call end authority management module is located at the service call end of the service-oriented framework. It is responsible for interacting with the user management center to complete user authentication applications and user heartbeat reporting operations.

2. The rights management system according to claim 1, characterized in that: The address book linked list is used to store basic user information, including user name, user token, and user access rights to various services, and at the same time establish a mapping relationship table between user tokens and user-accessible services.

3. The rights management system according to claim 2, characterized in that: The user management center module includes: user token lifecycle management module, user authentication module, and service discovery verification module: The user token lifecycle management module is used to: generate a user token and save it in the address book when the user authentication succeeds; filter the services accessible to the user according to the user's authority level and service level, establish a mapping table between user tokens and services, and send instructions to add the user token to the server-side authority management module deployed on the corresponding server; when the user is offline or the token expires, the user token becomes invalid, the user's token information is deleted from the address book, and an instruction to delete the user token is sent to the corresponding server-side authority management module; The user authentication module is used to: receive the user identity information submitted by the service caller authority management module for verification, and return the authentication result and user token; The service discovery verification module is used for: the service caller sends the service discovery request instruction carrying the service token to the service registration center to verify the authority of the token, and the service registration center performs subsequent service routing and service discovery result feedback.

4. The rights management system according to claim 3, characterized in that: The server-side permission management module is specifically used for: Receive the user token synchronization instruction sent by the user management center, establish and update the local user token chain list; the server-side permission management module deployed on different servers only maintains the user tokens held by users who have the permission to access this service; After receiving the service call request containing the user token sent by the service caller, the token is searched in the local user token chain list; If the token is included in the linked list, the server returns the requested service information to the service caller; if the token is not included in the linked list, a call failure result is returned to the service caller.

5. The rights management system according to claim 4, characterized in that: The service caller rights management module is specifically used for: Provide users with a user authentication request interface to initiate an authentication application to the user management center module and obtain a user token; After authentication, the service caller carries the user token to initiate a service discovery request to the service registration center to obtain the service address information, then carries the user token to initiate a service call request to the server to obtain the required service information, and periodically reports the user's online status to the user management center module.

6. A permission management method for a service-oriented architecture of a UAV ground station, characterized in that: include: On the basis of the ground station service framework, construct the authority management system described in any one of claims 1 to 5; The user management center module reads the local user information configuration file and initializes the address book list; The record list includes the user's username, user password MD5 code and the user's access rights to the service; After the service is registered, the user management center module sends the token information of all users of all permission levels in the current address book to the permission management module of the server; The service call end authority management module initiates a user authentication request to the user management center module, carrying the user name, user password and user address unique identifier; After receiving the user authentication request, the user management center module searches for the user name in the address book list and performs MD5 verification on the user password; If the verification is successful, a user token is generated and saved in the address book, and a mapping between the token and the service is established. At the same time, the user token is synchronized with the server-side user token management unit, and then the token and the authentication success result are sent to the calling-side permission management module; After receiving the user token, the service caller authority management module provides the token to the service caller, and the service caller sends a service discovery request to the service registration center with the token and service identification information; When the service registration center receives a service discovery request, the user management center module verifies the user's authority based on the user token; After verification, the service registration center performs service routing operations and returns a service discovery response to the caller, providing the location information of the service. After receiving the service discovery response, the service caller initiates a service call request to the server with the user token. After the server receives the service call request, the server-side authority management module verifies the user token carried in the call request; If the local user token list contains the token, the server will provide service information to the calling end.

7. The method according to claim 6, characterized in that The life cycle of the user token is maintained by the user management center module.

8. The method according to claim 7, characterized in that The method further comprises: After the user authentication is successful, the service call end authority management module sends heartbeat information to the user management center periodically.

9. The method according to claim 8, characterized in that The method further comprises: After the service registration is successful, the user management center will send the tokens of all users in the current address book that meet the access rights to the server; When the user's remote authentication is successful, the user management center issues the currently generated token for the user; When the heartbeats reported by the user from all locations have timed out or the token refresh time has been reached, the user's token is deactivated, and the user management center pushes the deactivation information of the token to all services that contain the token; When the user successfully authenticates again, the user token will be regenerated by the user management center.

Images