An access control system and method for a service-oriented architecture of UAV ground stations

Abstract

This invention relates to the field of access control, and particularly to an access control system and method for a service-oriented architecture of UAV ground stations. The access control system is located within a service-oriented framework and specifically includes: a user management center module, a server-side access control module, and a service caller-side access control module. The user management center module is located in the service registry of the service-oriented framework and is responsible for establishing and maintaining the management-side address book linked list, managing the user token lifecycle, and performing user authentication and service discovery verification. The server-side access control module is located on the server side of the service-oriented framework and is responsible for establishing and maintaining the server-side user token linked list and verifying service calls initiated by the service caller. The service caller-side access control module is located on the service caller side of the service-oriented framework and is responsible for interacting with the user management center to complete user authentication applications and user heartbeat reporting operations.

Description

Technical Field

[0001] This invention relates to the field of access control, and in particular to an access control system and method for a service-oriented architecture for UAV ground stations. Background Technology

[0002] With the rapid development of avionics technology, the peripheral resources and network calls that UAV ground station systems need to handle have increased significantly, leading to a rise in the scale and development complexity of avionics software. To address the issues of portability and reusability of ground station software, improve its development and integration efficiency, and enhance its interoperability with other systems in heterogeneous distributed environments, service-oriented architecture (SOA) has emerged, suitable for the operating environment of ground station software. Traditional SOA architectures consist of at least three roles: server, service caller, and service registry. They can be deployed independently on any node in the network or simultaneously on the same node. The server, as the service provider, is responsible for defining and publishing service information and receiving and processing call requests from service callers. The service caller integrates service interface description information, initiates service discovery requests to the service registry, and initiates service calls to the server. The service registry is responsible for processing the service registration information published by the server, providing service discovery functionality, and supporting service callers in quickly and effectively locating target services. SOA technology provides a solution for the efficient integration and operation of software in UAV ground station environments.

[0003] For highly complex and integrated UAV ground station systems, while using service-based architecture for operation and management, it is crucial to consider the system's stringent security requirements. In service-based technologies, access control is a key component for ensuring system security. To ensure the secure and efficient operation of service-based frameworks in ground station systems with high real-time requirements, high reliability, and resource-constrained embedded devices, a secure, reliable, and relatively lightweight access control system and methodology need to be designed. Existing service-based access control technologies are primarily geared towards internet and enterprise-level systems, relying on complex service-based systems that consume significant computing resources, and are not well-suited for UAV ground station systems. Summary of the Invention

[0004] Purpose of the Invention: To address this problem, this invention provides a permission management system and method for a service-oriented architecture of UAV ground stations. The permission management system includes a user management center module, a server-side permission management module, and a service-invoking terminal permission management module. This system is lightweight, feasible for operation on embedded devices at ground stations, consumes few resources, and has low coupling with the service-oriented framework. The permission management method provided by this invention adds user management and permission hierarchy mechanisms to the traditional ground station service-oriented architecture to meet the system's security and reliability requirements.

[0005] Technical solution:

[0006] Firstly, an access control system for a service-oriented architecture of UAV ground stations is provided. This access control system is located within the service framework and specifically includes: a user management center module, a server-side access control module, and a service caller-side access control module.

[0007] The user management center module is located in the service registry of the service framework. It is responsible for establishing and maintaining the management address book chain, managing the lifecycle of user tokens, and performing user authentication and service discovery verification.

[0008] The server-side permission management module is located on the server side of the service-oriented framework. It is responsible for establishing and maintaining the server-side user token chain list and verifying service calls initiated by the service caller.

[0009] The service call terminal permission management module is located at the service call terminal of the service framework. It is responsible for interacting with the user management center to complete user authentication applications and user heartbeat reporting operations.

[0010] Furthermore, the address book linked list is used to store basic user information, including username, user token, and user access permissions for various services, while also establishing a mapping table between user tokens and services that users can access.

[0011] Furthermore, the user management center module includes: a user token lifecycle management module, a user authentication module, and a service discovery and verification module.

[0012] The user token lifecycle management module is used for: generating a user token and saving it in the address book when user authentication is successful; filtering services that the user can access based on the user's permission level and the service level when service registration or user authentication is successful, establishing a mapping table between user tokens and services, and sending instructions to add the user token to the corresponding server-side permission management module; and deleting the user token when the user is offline or the token expires, deleting the user's token information from the address book, and sending instructions to delete the user token to the corresponding server-side permission management module.

[0013] The user authentication module is used to: receive user identity information submitted by the service caller's permission management module, verify it, and return the authentication result and user token;

[0014] The service discovery verification module is used for: the service caller to send a service discovery request command carrying a service token to the service registry center, to verify the token's permissions, and the service registry center to perform subsequent service routing and service discovery result feedback.

[0015] Furthermore, the server-side permission management module is specifically used for:

[0016] Receive user token synchronization instructions sent by the user management center, establish and update the local user token chain list; the server-side permission management module deployed on different servers only maintains user tokens held by users who have access to this service.

[0017] Upon receiving a service call request containing a user token from the service caller, the server searches for the token in the local user token list. If the token is found in the list, the server returns the requested service information to the service caller. If the token is not found in the list, the server returns a call failure result to the service caller.

[0018] Furthermore, the feature is that the service caller permission management module is specifically used for:

[0019] Provide users with a user authentication request interface to initiate authentication requests to the user management center module and obtain user tokens;

[0020] After successful authentication, the service caller sends a service discovery request to the service registry center with the user token to obtain service address information, and then sends a service call request to the server with the user token to obtain the required service information. The service caller also periodically reports the user's online status to the user management center module.

[0021] Secondly, a permission management method for a service-oriented architecture of UAV ground stations is provided, including:

[0022] Based on the ground station service framework, a permission management system is built;

[0023] The user management center module reads the local user information configuration file and initializes the address book linked list; the address book linked list includes the user's username, the user's password MD5 code, and the user's access permissions to the service.

[0024] After service registration, the user management center module sends the token information of all users with permission levels in the current address book to the permission management module of the server.

[0025] The service caller permission management module sends a user authentication request to the user management center module, carrying the username, password and unique identifier of the user address;

[0026] After receiving a user authentication request, the user management center module searches for the username in the address book chain and performs MD5 verification on the user password. If the verification is successful, a user token is generated, stored in the address book, and a mapping between the token and the service is established. At the same time, the user token is synchronized to the server-side user token management unit, and then the token and authentication success result are sent to the calling end permission management module.

[0027] After receiving the user token, the service caller permission management module provides the token to the service caller, which then sends a service discovery request to the service registry center along with the token and service identification information.

[0028] When the service registry receives a service discovery request, the user management center module verifies the user's permissions based on the user token. After successful verification, the service registry performs service routing operations and returns a service discovery response to the calling client, providing the service location information.

[0029] After receiving the service discovery response, the service caller sends a service call request to the server, carrying the user token.

[0030] After receiving a service call request, the server's permission management module verifies the user token carried in the call request. If the token is contained in the local user token chain, the server provides service information to the caller.

[0031] Furthermore, the lifecycle of the user token is maintained by the user management center module.

[0032] Furthermore, the method also includes:

[0033] After successful user authentication, the service caller's permission management module periodically sends heartbeat information to the user management center.

[0034] Furthermore, the method also includes:

[0035] After successful service registration, the user management center will send tokens to the server for all users in the current address book who meet the access permissions.

[0036] When a user successfully authenticates remotely, the user management center issues the token that has already been generated for that user.

[0037] If a user's heartbeat reports from various locations all time out or the token refresh time is reached, the user's token will be deactivated, and the user management center will push the deactivation information of the token to all services that contain the token.

[0038] When a user successfully authenticates again, the user token is regenerated by the user management center.

[0039] Beneficial effects: This invention designs an access control system and method for UAV ground station software operation scenarios, which is oriented towards the service-oriented architecture of UAV ground stations. It adds user management and access control mechanisms to the traditional ground station service-oriented framework, covering all aspects of service-oriented communication such as service discovery and service invocation. It provides a safe, reliable and lightweight access control solution for ground stations to use service-oriented technologies. Attached Figure Description

[0040] Figure 1 This is a structural diagram of the access control system of the present invention;

[0041] Figure 2 This is a diagram showing the interconnected relationships of the access control system of this invention;

[0042] Figure 3 This is a flowchart of the permission management method of the present invention. Detailed Implementation

[0043] To better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0044] This invention mainly relates to an access control system for a service-oriented architecture of UAV ground stations. The system includes the following modules:

[0045] (1) User Management Center Module: This module is located in the service registry of the service framework. It is responsible for establishing and maintaining the management address book linked list and interacting with the service and service caller permission management modules.

[0046] (2) Server-side permission management module: This module is located on the server side of the service framework. It is responsible for establishing and maintaining the server-side user token chain list and interacting with the user management center module and the service caller.

[0047] (3) Service call terminal permission management module: This module is located at the service call terminal of the service framework and is responsible for interacting with the user management center to complete user authentication application and user heartbeat reporting.

[0048] This invention mainly relates to a permission management method for a service-oriented architecture of UAV ground stations. This method mainly includes the following:

[0049] (1) User authentication and lifecycle management: The service caller permission management module initiates a user authentication request, and the user management center performs user authentication, generates and provides a user token, and synchronizes the token information with the server permission management module.

[0050] (2) Service discovery with authorization authentication: The service caller sends a service discovery request to the service management center with the user token. The user management center first verifies the token and authorization. After the verification is successful, the service registration center performs subsequent service routing and service distribution operations.

[0051] (3) Service call with authorization authentication: The service caller sends a service call request to the server with the user token. After receiving the request, the server authorization management module authenticates the user token. After successful authentication, the server provides the requested service information to the caller.

[0052] (4) Hierarchical Access Control: Administrators classify user access levels into authenticated, authorized, and privileged levels, storing this information in a local user information configuration file. The user management center reads this information when initializing the address book list. Different services have different access requirements. If a service requires an authenticated user level, all levels of users can access it; if it requires an authorized user level, authorized and privileged users can access it; if it requires a privileged user level, only privileged users can access it. When a client initiates a service discovery request, the user management center verifies the user token and checks whether the user's access level matches the service's requirements.

[0053] 1. Access control system for UAV ground station service-oriented architecture

[0054] The system includes a user management center module, a server-side permission management module, and a service caller-side permission management module, such as... Figure 1 As shown.

[0055] (1) User Management Center Module

[0056] This module is located in the service registry of the service framework and is responsible for establishing and maintaining the management address book chain, managing the lifecycle of user tokens, and performing user authentication and service discovery verification.

[0057] The address book linked list is used to store basic user information, including username, user token, and user access permissions for various services. It also establishes a mapping table between user tokens and services that users can access.

[0058] User token lifecycle management mainly includes token generation, synchronization, and destruction. When user authentication is successful, this module generates a user token and saves it in the address book. When service registration or user authentication is successful, the user management center module filters the services that the user can access based on the user's permission level and the service level, establishes a mapping table between user tokens and services, and sends an instruction to add the user token to the corresponding server-side permission management module. When the user goes offline or the token expires, the user token becomes invalid, the user's token information is deleted from the address book, and this module sends an instruction to delete the user token to the corresponding server-side permission management module.

[0059] User authentication refers to the user management center module receiving and verifying the user identity information submitted by the service caller's permission management module, and returning the authentication result and user token; service discovery verification refers to the service caller sending a service discovery request instruction carrying a service token to the service registry center, the user management center module verifying the token's permissions, and the service registry center performing subsequent service routing and service discovery result feedback.

[0060] (2) Server-side permission management module

[0061] This module is located on the server side of the service-oriented framework and is responsible for establishing and maintaining the server-side user token chain list and verifying service calls initiated by the service caller.

[0062] This module receives user token synchronization instructions sent by the user management center, establishes and updates the local user token chain list, and the server-side permission management module deployed on different servers only maintains the user tokens held by users who have the right to access this service.

[0063] After receiving a service call request containing a user token from the service caller, this module searches for the token in the local user token list. If the token is found in the list, the server returns the requested service information to the service caller. If the token is not found in the list, the server returns a call failure result to the service caller.

[0064] (3) Service caller permission management module

[0065] This module is located at the service call end of the service framework and is responsible for user authentication requests and user heartbeat reporting.

[0066] This module provides users with a user authentication request interface to initiate authentication applications to the user management center module and obtain user tokens. After successful authentication, the service caller can send a service discovery request to the service registry center with the user token to obtain service address information, and then send a service call request to the server with the user token to obtain the required service information, and periodically report the user's online status to the user management center module.

[0067] The interconnection relationship diagram of each module in this system is as follows: Figure 2 As shown.

[0068] 2. Access Control Methods for UAV Ground Station Service-Oriented Architecture

[0069] This invention provides a permission management method for a service-oriented architecture of UAV ground stations, the process of which is as follows: Figure 3 As shown, it includes the following steps:

[0070] Step 1: Based on the ground station service framework (service registration center, server and service call terminal), build an access control system (user management center module, server access control module and service call terminal access control module).

[0071] Step 2: The user management center module reads the local user information configuration file and initializes the address book linked list, including the user's username, the user's password MD5 code, and the user's access permissions to the service.

[0072] Step 3: The server initiates a service registration request to the service registry, the service registry returns the service registration result, and the user management center module sends the token information of all users with permission levels in the current address book to the server's permission management module.

[0073] Step 4: The service caller's permission management module sends a user authentication request to the user management center module, carrying the username, password, and unique identifier of the user's address.

[0074] Step 5: After receiving a user authentication request, the user management center module searches for the username in the address book chain and performs MD5 verification on the user's password. If the verification is successful, a user token is generated, stored in the address book, and a mapping between the token and the service is established. Simultaneously, the user token is synchronized with the server-side user token management unit, and then the token and authentication success result are sent to the calling end permission management module. If the verification fails, an error code is returned to the calling end permission management module based on the reason for the failure (invalid username or incorrect password).

[0075] Step Six: After receiving the user token, the service caller permission management module provides the token to the service caller, who then sends a service discovery request to the service registry center, carrying the token and service identification information.

[0076] Step 7: Upon receiving the service discovery request, the service registry module verifies the user's permissions based on the user token. If the requested service requires authentication at a certain level, all users at all levels can pass verification; if it requires authorization at a certain level, authorized and privileged users can pass verification; if it requires privileged users at a certain level, only privileged users can pass verification. Upon successful verification, the service registry performs service routing and returns a service discovery response to the calling client, providing the service location information. If verification fails, an error code is returned to the calling client's permission management module based on the reason for failure (incorrect user token or incompatible user permissions).

[0077] Step 8: After receiving the service discovery response, the service caller sends a service call request to the server, carrying the user token.

[0078] Step Nine: After receiving the service call request, the server's permission management module verifies the user token carried in the call request. If the token is present in the local user token chain, the server provides service information to the caller; otherwise, it returns an error code to the caller based on the failure reason (user token does not exist).

[0079] The lifecycle of user tokens is maintained by the user management center module. After successful user authentication, the service caller's permission management module periodically sends heartbeat information to the user management center. After successful service registration, the user management center sends all user tokens in the current address book that meet the access permissions to the service. When a user successfully authenticates remotely, the user management center issues the currently generated token for that user. If all heartbeats reported by the user from different locations time out or the token refresh time is reached, the user's token is deactivated, and the user management center pushes the deactivation information to all services containing that token; when the user successfully authenticates again, the user management center regenerates the user token.

Claims

1. A permission management system for a service-oriented architecture of UAV ground stations, characterized in that, This access control system is located within a service-oriented framework and specifically includes: a user management center module, a server-side access control module, and a service caller-side access control module. The user management center module is located in the service registry of the service framework. It is responsible for establishing and maintaining the management address book chain, managing the lifecycle of user tokens, and performing user authentication and service discovery verification. The server-side permission management module resides on the server side of the service-oriented framework. It is responsible for establishing and maintaining the server-side user token chain and verifying service calls initiated by service callers. Specifically, it receives user token synchronization instructions from the user management center, establishes and updates the local user token chain. Server-side permission management modules deployed on different servers only maintain user tokens held by users with access permissions to the service. Upon receiving a service call request containing a user token from a service caller, it searches for the token in the local user token chain. If the token is present in the chain, the server returns the requested service information to the service caller; if the token is not present in the chain, it returns a call failure result to the service caller. The service caller permission management module is located at the service caller end of the service framework. It is responsible for interacting with the user management center to complete user authentication applications and user heartbeat reporting operations. Specifically, it provides users with a user authentication request interface to initiate authentication applications to the user management center module and obtain user tokens. After successful authentication, the service caller carries the user token to initiate a service discovery request to the service registry center to obtain service address information, and then carries the user token to initiate a service call request to the server to obtain the required service information. It also periodically reports the user's online status to the user management center module.

2. The access control system according to claim 1, characterized in that, The address book linked list is used to store basic user information, including username, user token, and user access permissions for various services. It also establishes a mapping table between user tokens and services that users can access.

3. The access control system according to claim 2, characterized in that, The user management center module includes: a user token lifecycle management module, a user authentication module, and a service discovery and verification module. The user token lifecycle management module is used for: generating a user token and saving it in the address book when user authentication is successful; filtering services that the user can access based on the user's permission level and the service level when service registration or user authentication is successful, establishing a mapping table between user tokens and services, and sending instructions to add the user token to the corresponding server-side permission management module; and deleting the user token when the user is offline or the token expires, deleting the user's token information from the address book, and sending instructions to delete the user token to the corresponding server-side permission management module. The user authentication module is used to: receive user identity information submitted by the service caller's permission management module, verify it, and return the authentication result and user token; The service discovery verification module is used for: the service caller to send a service discovery request command carrying a service token to the service registry center, to verify the token's permissions, and the service registry center to perform subsequent service routing and service discovery result feedback.

4. A permission management method for a service-oriented architecture of UAV ground stations, characterized in that, include: Based on the ground station service framework, construct the access control system as described in any one of claims 1-3; The user management center module reads the local user information configuration file and initializes the address book linked list. The linked list includes the user's username, the user's password MD5 hash, and the user's access permissions to the service; After service registration, the user management center module sends the token information of all users with permission levels in the current address book to the permission management module of the server. The service caller permission management module sends a user authentication request to the user management center module, carrying the username, password and unique identifier of the user address; After receiving a user authentication request, the user management center module searches for the username in the address book chain and performs MD5 verification on the user's password. If the verification is successful, a user token is generated, stored in the address book, and a mapping between the token and the service is established. At the same time, the user token is synchronized to the user token management unit on the server side, and then the token and the authentication success result are sent to the permission management module on the calling side. After receiving the user token, the service caller permission management module provides the token to the service caller, which then sends a service discovery request to the service registry center along with the token and service identification information. When the service registry receives a service discovery request, the user management center module verifies the user's permissions based on the user token; After successful verification, the service registry performs service routing operations and returns a service discovery response to the calling client, providing the service location information. After receiving the service discovery response, the service caller sends a service call request to the server, carrying the user token. After receiving a service call request, the server's permission management module verifies the user token carried in the call request. If the token is contained in the local user token chain, the server will provide service information to the calling client.

5. The method according to claim 4, characterized in that, The lifecycle of user tokens is maintained by the user management center module.

6. The method according to claim 5, characterized in that, The method further includes: After successful user authentication, the service caller's permission management module periodically sends heartbeat information to the user management center.

7. The method according to claim 6, characterized in that, The method further includes: After successful service registration, the user management center will send tokens to the server for all users in the current address book who meet the access permissions. When a user successfully authenticates remotely, the user management center issues the token that has already been generated for that user. If a user's heartbeat reports from various locations all time out or the token refresh time is reached, the user's token will be deactivated, and the user management center will push the deactivation information of the token to all services that contain the token. When a user successfully authenticates again, the user token is regenerated by the user management center.

Images