Configuration file acquisition method and device and electronic equipment

Abstract

The invention provides a configuration file acquisition method and device and electronic equipment, and the method comprises the steps: sending user identity information to a management and control server, so that the management and control server generates and returns temporary authentication information according to the user identity information after the authentication of the user identity information is passed, and the temporary authentication information comprises a temporary token; obtaining a temporary token, and sending the temporary token to a configuration server, so that the configuration server generates a warehouse configuration file according to the temporary token after the temporary token passes verification; and obtaining a warehouse configuration file generated by the configuration server, wherein the warehouse configuration file is used for obtaining the dependent plug-ins from the plug-in warehouse. In the implementation process of the scheme, the operation of each user can be accurately recorded and audited by introducing a temporary token mechanism, dynamic verification control and single user fine-grained access control, so that the auditing performance of the configuration file is remarkably improved.

Description

Technical Field

[0001] This application relates to the technical field of software development and deployment automation. Specifically, it relates to a method, device, and electronic device for obtaining configuration files. Background Art

[0002] Maven is an open-source Java service construction project tool. When working, Maven depends on a specific Maven configuration file. When building a Java project, the Maven configuration file can be used to obtain dependent plugins from the plugin repository. Usually, the Maven configuration file is relatively complex, and the personal maintenance cost is relatively high. This configuration file stores sensitive information such as repository accounts and passwords.

[0003] Currently, the Maven configuration file is widely used in the Java service development scenario. However, during the development process, developers may copy the Maven client configuration files to each other. This copying operation allows multiple clients to use the same account and password. When multiple clients use the same account and password, it not only increases the security risk but also makes it extremely difficult to track and audit the activities of specific users, posing a serious challenge to the enterprise's security policy. Therefore, the current Maven configuration file has low security and auditability. Summary of the Invention

[0004] The purpose of the embodiments of this application is to provide a method, device, and electronic device for obtaining configuration files to improve the problem of low security and auditability of the Maven configuration file.

[0005] An embodiment of the present application provides a method for obtaining a configuration file, which is applied to a terminal device and includes: sending user identity information to a management and control server, so that after the user identity information is authenticated, the management and control server generates and returns temporary authentication information according to the user identity information, and the temporary authentication information includes a temporary token; obtaining the temporary token and sending the temporary token to a configuration server, so that after the configuration server verifies the temporary token, it generates a repository configuration file according to the temporary token; obtaining the repository configuration file generated by the configuration server, and the repository configuration file is used to obtain dependent plugins from a plugin repository. In the implementation process of the above solution, by sending user identity information to the management and control server, the management and control server generates and returns temporary authentication information including a temporary token, making subsequent operations depend on the generated temporary token rather than directly transmitting sensitive information such as user identity information, reducing the risk of sensitive information being intercepted in the network, thereby improving the security of the configuration file. Further, since each temporary token is generated for a specific user, each user who initiates an operation can be accurately traced. Even if multiple users use the same terminal device, the operations of each user can be accurately recorded and audited, thus significantly improving the auditability of the configuration file.

[0006] Optionally, in an embodiment of the present application, the temporary authentication information further includes: a temporary key; obtaining the repository configuration file generated by the configuration server includes: sending the temporary key to the configuration server, so that after the configuration server verifies the temporary key, it generates an executable script according to the repository configuration file; obtaining the executable script and downloading the repository configuration file from the configuration server through the executable script. In the implementation process of the above solution, by introducing a temporary key (Temporary Key) and using it in the verification process of the configuration server, a dual authentication mechanism is formed. That is to say, in addition to the temporary token (Token), the system also introduces a temporary key as a second layer of authentication means, forming a dual authentication mechanism. Even if a certain temporary token Token is leaked, an attacker still needs to obtain the corresponding temporary key to successfully obtain the executable script. Without being able to obtain the executable script, it is difficult to download the repository configuration file from the configuration server, thereby improving the security of the system.

[0007] Optionally, in the embodiments of the present application, after downloading the repository configuration file from the configuration server through an executable script, the following steps are further included: If the original configuration file is stored locally, the original configuration file is copied and backed up through the executable script, and the original configuration file is replaced with the repository configuration file. In the implementation process of the above solution, by adding the steps of automatically backing up and automatically replacing the original configuration file after downloading the repository configuration file, the automatic backup operation reduces the risk of data loss caused by misoperation or unexpected events, and improves the fault tolerance of the system. Further, all backup and replacement operations are automatically completed by the executable script, and users do not need to intervene manually, which simplifies the user operation process, reduces the possibility of errors caused by manual processing, and makes the whole process smoother and more efficient.

[0008] The embodiments of the present application further provide a method for obtaining a configuration file, which is applied to a configuration server and includes: receiving temporary authentication information sent by a terminal device, where the temporary authentication information includes a temporary token; using verification reference information to verify the temporary token to obtain a verification result, and the verification reference information is obtained from a management server; if the verification result passes, a repository configuration file is generated according to the temporary token and the verification reference information. In the implementation process of the above solution, through dynamic verification based on the latest user identity information and permission scope for each request, and fine-grained access control for individual users, it is ensured that each operation is newly authorized, preventing security risks caused by long-term holding, and significantly improving the security and auditability of the configuration file.

[0009] Optionally, in the embodiments of the present application, the verification reference information is the user identity information of the terminal device synchronized from the management server; using the verification reference information to verify the temporary token includes: generating a reference token according to the user identity information of the terminal device; determining whether the reference token is the same as the temporary token; if so, determining that the verification result passes, otherwise, determining that the verification result fails. In the implementation process of the above solution, by synchronizing the user identity information of the terminal device from the management server and generating a reference token based on this for verifying the temporary token, since the generated reference token is based on real-time user identity information each time, even if an attacker intercepts a certain temporary token, it cannot be reused, significantly reducing the risk of replay attacks and improving the security of the system.

[0010] Optionally, in the embodiments of the present application, the verification reference information is a reference token synchronized from the management and control server, and the reference token is a valid token generated according to the user identity information of the terminal device; using the verification reference information to verify the temporary token includes: determining whether the reference token is the same as the temporary token; if so, determining that the verification result passes, otherwise, determining that the verification result fails. In the implementation process of the above solution, by strictly comparing the reference token and the temporary token, it is ensured that the two are exactly the same to pass the verification, reducing the possibility of forging tokens, further strengthening the identity authentication mechanism, and improving the matching accuracy of the token verification of the identity information.

[0011] Optionally, in the embodiments of the present application, the temporary authentication information further includes: a temporary key; after generating the repository configuration file according to the temporary token and the verification reference information, it further includes: if the verification of the temporary key passes, generating an executable script according to the repository configuration file, and the executable script is used to be obtained by the terminal device and download the repository configuration file from the configuration server. In the implementation process of the above solution, by introducing the temporary key and further verifying the temporary key after generating the repository configuration file, and then generating an executable script according to the repository configuration file, a temporary key is introduced as a second-layer authentication means, forming a dual authentication mechanism. Even if a certain temporary token is leaked, the attacker still needs to obtain the corresponding temporary key to successfully obtain the executable script. In the case where the executable script cannot be obtained, it is very difficult to download the repository configuration file from the configuration server, thereby improving the security of the system.

[0012] The embodiments of the present application further provide a configuration file acquisition device, which is applied to a terminal device and includes: an identity information sending module, configured to send user identity information to the management and control server, so that after the user identity information is authenticated, the management and control server generates and returns temporary authentication information according to the user identity information, and the temporary authentication information includes a temporary token; an information receiving and sending module, configured to obtain the temporary token and send the temporary token to the configuration server, so that after the configuration server verifies the temporary token, it generates a repository configuration file according to the temporary token; a configuration file acquisition module, configured to obtain the repository configuration file generated by the configuration server, and the repository configuration file is used to obtain dependent plugins from the plugin repository.

[0013] Optionally, in the embodiments of the present application, the temporary authentication information further includes: a temporary key; the configuration file acquisition module includes: a temporary key sending sub-module, configured to send the temporary key to the configuration server, so that after the configuration server verifies the temporary key, it generates an executable script according to the repository configuration file; a configuration file download sub-module, configured to obtain the executable script and download the repository configuration file from the configuration server through the executable script.

[0014] Optionally, in the embodiments of the present application, the configuration file download sub-module includes: a file backup replacement unit, which is configured to, if the original configuration file is stored locally, copy and back up the original configuration file through an executable script, and replace the original configuration file with the repository configuration file.

[0015] The embodiments of the present application further provide a configuration file acquisition device, which is applied to a configuration server and includes: an authentication information receiving module, configured to receive temporary authentication information sent by a terminal device, where the temporary authentication information includes a temporary token; a verification result obtaining module, configured to verify the temporary token using verification reference information to obtain a verification result, and the verification reference information is obtained from a management and control server; a configuration file generation module, configured to, if the verification result passes, generate a repository configuration file according to the temporary token and the verification reference information.

[0016] Optionally, in the embodiments of the present application, the verification reference information is the user identity information of the terminal device synchronized from the management and control server; the verification result obtaining module includes: a reference token generation sub-module, configured to generate a reference token according to the user identity information of the terminal device; a first token judgment sub-module, configured to judge whether the reference token is the same as the temporary token; a first result determination sub-module, configured to, if the reference token is the same as the temporary token, determine that the verification result passes, and if the reference token is not the same as the temporary token, determine that the verification result fails.

[0017] Optionally, in the embodiments of the present application, the verification reference information is a reference token synchronized from the management and control server, and the reference token is a valid token generated according to the user identity information of the terminal device; the verification result obtaining module includes: a second token judgment sub-module, configured to judge whether the reference token is the same as the temporary token; a second result determination sub-module, configured to, if the reference token is the same as the temporary token, determine that the verification result passes, and if the reference token is not the same as the temporary token, determine that the verification result fails.

[0018] Optionally, in the embodiments of the present application, the temporary authentication information further includes: a temporary key; the configuration file acquisition device further includes: an execution script generation module, configured to, if the verification of the temporary key passes, generate an executable script according to the repository configuration file, and the executable script is used to be acquired by the terminal device and download the repository configuration file from the configuration server.

[0019] The embodiments of the present application further provide an electronic device, including: a processor and a memory, where the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are run by the processor, the methods described above are executed.

[0020] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a processor, the method described above is executed.

[0021] An embodiment of the present application also provides a computer program product, including: a computer program or computer instructions. When the computer program or computer instructions are run by a processor, the method described above is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings required to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the embodiments of the present application, and therefore should not be regarded as a limitation of the scope. For those of ordinary skill in the art, without creative efforts, other related drawings can also be obtained based on these drawings.

[0023] Figure 1 A flowchart showing the method for obtaining a configuration file applied to a terminal device provided by an embodiment of the present application;

[0024] Figure 2 An interaction timing diagram showing the interaction among a terminal device, a management and control server, and a configuration server provided by an embodiment of the present application;

[0025] Figure 3 A flowchart showing the method for obtaining a configuration file applied to a configuration server provided by an embodiment of the present application;

[0026] Figure 4 A structural diagram showing the configuration file acquisition device provided by an embodiment of the present application;

[0027] Figure 5 A structural diagram showing the electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0028] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the following will clearly and completely describe the technical solutions in the embodiments of this application with reference to the accompanying drawings in the embodiments of this application. It should be understood that the accompanying drawings in the embodiments of this application are only for the purposes of illustration and description, and are not used to limit the protection scope of the embodiments of this application. Additionally, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in the embodiments of this application illustrate the operations implemented according to some embodiments of the embodiments of this application. It should be understood that the operations in the flowchart may not be implemented in sequence, and steps without a logical context relationship may be reversed or implemented simultaneously. Furthermore, those skilled in the art may add one or more other operations to the flowchart or remove one or more operations from the flowchart under the guidance of the content of the embodiments of this application.

[0029] In addition, the described embodiments are only a part of the embodiments of this application, rather than all of the embodiments. The components of the embodiments of this application generally described and illustrated in the accompanying drawings here may be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed embodiments of this application, but merely represents the selected embodiments of this application.

[0030] It can be understood that the "first" and "second" in the embodiments of this application are used to distinguish similar objects. Those skilled in the art can understand that the words such as "first" and "second" do not limit the quantity and execution order, and the words such as "first" and "second" do not necessarily mean different. In the description of the embodiments of this application, the term "and / or" is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this text generally represents an "or" relationship between the associated objects before and after. The term "plural" refers to two or more (including two). Similarly, "multiple groups" refers to two or more groups (including two groups).

[0031] It should be noted that the configuration file acquisition method provided by the embodiments of this application can be executed by an electronic device. Here, the electronic device refers to a device terminal or a server with the function of executing a computer program. Examples of the device terminal include: a smart phone, a personal computer, a tablet computer, a personal digital assistant, or a mobile Internet device, etc. A server refers to a device that provides computing services through a network. Examples of the server include: an x86 server and a non-x86 server. The non-x86 server includes: a mainframe, a minicomputer, and a UNIX server.

[0032] In the current Java service development scenario, Maven, as a widely used build tool, has greatly improved R&D efficiency. Through Maven, developers can quickly integrate the capabilities of the open source community and simplify dependency management and project building processes. However, the maintenance and management of Maven client configuration files (such as settings.xml) are relatively complex. Maven configuration items include sensitive information such as warehouse addresses, accounts, and passwords. Therefore, in order to avoid the leakage of sensitive information such as accounts and passwords, developers usually do not upload Maven configuration files to the version management server for version control, but store Maven configuration files in the local environment for management. However, since the local environment of each developer may be different, Maven configuration files are scattered across various clients, making unified management and upgrade maintenance difficult. For example: developers need to manually add various configurations, such as warehouse addresses, accounts, passwords and other Maven configuration item information. This method is not only time-consuming and labor-intensive, but also prone to errors. For another example: if the configurations are not added manually, developers are likely to directly copy Maven client configuration files from other places to complete the local file replacement. This copying operation will cause multiple clients to use the same account and password. When multiple clients use the same account and password, it not only increases security risks, but also makes it extremely difficult to track and audit the activities of specific users. Due to the lack of effective logging and operation tracking mechanisms, it is difficult for enterprises to ensure that every change in the configuration file can be accurately recorded, which in turn affects the effectiveness of security audits. Therefore, the current Maven configuration files have low security and auditability.

[0033] For the above questions, please see Figure 1 The flowchart of the configuration file acquisition method applied to the terminal device provided by the embodiment of the present application is shown; the main idea of ​​the configuration file acquisition method is to generate temporary authentication information including a temporary token according to the user identity information through the control server, so that subsequent operations are dependent on the generated temporary token, thereby improving the security of the configuration file. In addition, the user who initiated each operation can be accurately tracked according to the temporary token, so that each user's independent configuration file and account information are independently maintained, ensuring that each user's operation can be accurately recorded and audited. This single user fine-grained access control effectively improves the auditability of the configuration file. The implementation method of the configuration file acquisition method applied to the terminal device may include:

[0034] Step S110: The terminal device sends the user identity information to the management and control server, so that the management and control server generates and returns temporary authentication information according to the user identity information after the user identity information is authenticated, and the temporary authentication information includes a temporary token.

[0035] The above-mentioned terminal device is any computer or mobile device that can communicate with the management server and the configuration server when obtaining user identity information, such as the developer's personal computer, laptop, virtual machine, etc. If a developer uses their own laptop for Java project development work, this laptop can be considered a terminal device.

[0036] The management server is a central server responsible for user authentication and configuration file management. It can receive requests from terminal devices and perform corresponding operations based on the user identity information in the requests. This management server can also be called the company's internal authentication server, mainly for authenticating user identity information and verifying the user's login credentials, and generating a temporary token after successful verification.

[0037] The above-mentioned user identity information is data or information used to confirm the user's identity, which can be a username and password, an OAuth token, or other forms of identity identifiers (such as a secret key, etc.).

[0038] The temporary authentication information is a set of authentication data generated by the management server and valid within a limited time. Among them, this temporary authentication information can include a temporary token, or it can include a temporary key. Since each temporary token has a limited validity period and automatically expires after expiration, it reduces the security risk brought by long-term holding.

[0039] Step S120: The terminal device obtains the temporary token and sends the temporary token to the configuration server, so that after the configuration server verifies the temporary token, it generates a repository configuration file according to the temporary token.

[0040] The configuration server is a server used to generate and distribute the Maven repository configuration file. It can receive requests from terminal devices, verify the temporary token, and generate configuration files as needed. For example, the Maven repository management server within an enterprise can generate a personalized settings.xml file according to different project requirements. This settings.xml file can contain the Uniform Resource Locator (URL) and access credentials of a private Maven repository, enabling Maven to download the required dependency libraries from this repository.

[0041] Step S130: The terminal device obtains the repository configuration file generated by the configuration server, and the repository configuration file is used to obtain dependency plugins from the plugin repository.

[0042] A plugin repository is a repository that stores Maven plugins and other dependency libraries. Developers can specify in a configuration file which repository Maven should download the required dependency plugins from. Dependency plugins refer to various external libraries and toolkits required during the project build process, such as the JUnit testing framework, Spring framework, etc. These are common dependency plugins in Java projects, and these dependency plugins are usually automatically downloaded by Maven from the specified plugin repository.

[0043] In the implementation process of the above solution, by sending user identity information to the management and control server, the management and control server generates and returns temporary authentication information including a temporary token based on the user identity information, making subsequent operations depend on the generated temporary token instead of directly transmitting sensitive information such as user identity information, reducing the risk of sensitive information being intercepted in the network. Moreover, the validity period of the temporary token is limited and it automatically expires after expiration, reducing the security risk brought by long-term holding. Further, since each temporary token is generated for a specific user, the user who initiates each operation can be accurately traced. Even if multiple users use the same terminal device, each user obtains independent configuration files and account information, avoiding the situation where multiple clients share the same set of credentials, ensuring that each user's account information is independently maintained, and ensuring that each user's operations can be accurately recorded and audited. Therefore, the above solution significantly improves the security and auditability of the configuration file by introducing a temporary token mechanism, dynamic verification control, and fine-grained access control for individual users.

[0044] Please refer to Figure 2 The interaction sequence diagram among the three parties of the terminal device, management and control server, and configuration server provided by the embodiment of the present application shown; Optionally, as an alternative implementation manner of the above step S110, for example: after obtaining the user identity information, the terminal device can directly send the user identity information to the management and control server. The management and control server first receives the user identity information, and then, can authenticate the user identity information according to the information docked with the company's internal identity authentication system. It can be understood that since the management and control server is docked with the company's internal identity authentication system, it can use the information docked with the company's internal identity authentication system to ensure obtaining the correct identity information, and then authenticate the received user identity information according to the correct identity information. If the user identity information is authenticated, generate temporary authentication information according to the user identity information, and finally send the temporary authentication information to the terminal device. Among them, the temporary authentication information may include a temporary token for accessing the configuration server, and the terminal device can access the Application Programming Interface (API) of the configuration server according to the temporary token.

[0045] Optionally, as an alternative implementation of the above step S120, for example: after receiving the temporary authentication information generated by the management server, the terminal device can also parse out a temporary token from the temporary authentication information, and then send the temporary authentication information including the temporary token to the configuration server. After receiving the temporary authentication information sent by the terminal device, the configuration server can parse out the temporary token from the temporary authentication information, and can also verify the temporary token. If the verification of the temporary token passes, a warehouse configuration file can be generated based on the temporary token and the verification reference information. Specifically, the configuration server can use a template engine to generate a configuration template, and then fill the temporary token and the verification reference information into the configuration template to obtain the above-mentioned warehouse configuration file. The above authentication and configuration generation are both performed on the server side. The management server is responsible for authenticating the user identity information, and the configuration server is responsible for generating the warehouse configuration file. Both can be uniformly managed and updated by different administrators to ensure the consistency and synchronization of all clients, simplify the workload of administrators, and improve the overall management efficiency.

[0046] Optionally, the above management server can also provide a white-label interface. Here, the white-label interface is a highly customizable user interface that allows users to complete complex operations through an intuitive and friendly graphical interface without having to delve into the underlying technical details, enabling users to complete complex configuration tasks without writing code or directly interacting with the command line, but rather through simple operations such as clicking buttons and selecting menu items. Through the above white-label operation, users do not need to manually manage and maintain complex authentication information or configuration files, and all processes are automatically completed by the system, reducing the operation threshold and technical requirements for users, so that new team members can obtain the correct configuration file through simple steps and thus participate in project development faster, shortening the preparation time. The characteristics of the above white-label interface include: brand neutrality, ease of use, functional integrity, and automated guidance; among them, brand neutrality means that the interface itself does not carry a specific brand logo or style and can be customized according to the needs of different enterprises; ease of use refers to a simple and clear design that allows users to easily get started, reducing the learning cost and technical threshold; functional integrity means that although the interface is simple, it provides all the options and tools required to implement the functions; automated guidance simplifies the user operation process and improves efficiency through wizard-style steps or automatic processing.

[0047] As an alternative implementation of the above step S130, the above temporary authentication information can also include: a temporary key; the implementation method of obtaining the warehouse configuration file generated by the configuration server can include:

[0048] Step S131: Send temporary authentication information including a temporary key to the configuration server, so that after verifying the temporary key, the configuration server generates an executable script according to the repository configuration file.

[0049] It can be understood that when generating the temporary token in the temporary authentication information, the above control console server can also generate the temporary key in the temporary authentication information, so that the terminal device can access the API interface of the configuration server according to the temporary key in the temporary authentication information.

[0050] An implementation manner of the above step S131 is, for example: The terminal device sends temporary authentication information including a temporary key to the configuration server, so that after verifying the temporary key in the temporary authentication information, the configuration server can generate an executable script according to the repository configuration file. It can be understood that the executable script can carry the above temporary token (Token), so that when the executable script is executed, it sends the temporary token to the configuration server, so that after the configuration server passes the verification result of the temporary token, it generates a repository configuration file according to the temporary token and the verification reference information. Among them, the verification reference information can be obtained from the management server. The user obtains and executes the executable script on the terminal device, thereby executing a series of automated steps, without manually processing complex authentication information or script writing, simplifying the user's operation process. This automated script realizes the download and application of the configuration file, speeds up the deployment speed of the configuration file, and improves the development and operation and maintenance efficiency.

[0051] Optionally, the temporary key can be used to encrypt the data in the transmission (such as the temporary token Token), ensuring that sensitive information will not be eavesdropped or tampered with during the transmission, so that the data transmission of the temporary token Token, which involves sensitive information, has been protected at a higher level, further reducing the risk of information leakage.

[0052] Step S132: Obtain the executable script, and download the repository configuration file from the configuration server through the executable script.

[0053] For example, the implementation of the above step S132 may be as follows: After the terminal device sends the temporary key to the configuration server, it can download the executable script from the configuration server, and then execute the executable script to enable the executable script to send the temporary token to the configuration server. After receiving the temporary authentication information, the configuration server may first parse the temporary token from the temporary authentication information, and then determine whether the verification of the temporary token passes. If the verification result of the temporary token passes, a repository configuration file is generated according to the temporary token and the verification reference information. The verification reference information may be the user identity information or the reference token synchronized from the management server. After the configuration server generates the repository configuration file according to the temporary token and the verification reference information, the terminal device may download the repository configuration file from the configuration server through the executable script. Optionally, the Token may be limited to specific operations (such as downloading the executable script or the repository configuration file), preventing the Token from being used for other unauthorized operations and improving the overall security of the system.

[0054] As an alternative implementation of the above step S130, after downloading the repository configuration file from the configuration server through the executable script, the repository configuration file may also be backed up and replaced. This implementation may include:

[0055] Step S133: If the original configuration file is locally stored, copy and back up the original configuration file through the executable script, and replace the original configuration file with the repository configuration file.

[0056] For example, the implementation of the above step S133 may be as follows: If the terminal device locally stores the original configuration file, it can first copy and back up the original configuration file through the executable script (assuming the original configuration file is settings.xml, it can be copied and backed up as settings_backup01.xml), and replace the content in the original configuration file (such as settings.xml) with the content of the above-downloaded repository configuration file (such as settings_new.xml). The generation, download, backup, and replacement of the above repository configuration file can all be automatically executed through the script, reducing manual intervention, improving the deployment speed and accuracy. If there is a problem with the new configuration file, the user can quickly restore to the previous backup version, improving the reliability of the system and the user's confidence. Especially in the production environment, it can quickly respond to emergencies, reduce downtime, and improve the high availability of the system.

[0057] Please refer to Figure 3 the flowchart showing the method for obtaining a configuration file applied to a configuration server provided by the embodiment of the present application; The embodiment of the present application provides a method for obtaining a configuration file applied to a configuration server, including:

[0058] Step S210: The configuration server receives the temporary authentication information sent by the terminal device, and the temporary authentication information includes a temporary token.

[0059] Step S220: The configuration server uses the verification reference information to verify the temporary token to obtain a verification result, and the verification reference information is obtained from the management server.

[0060] For example, in the implementation of the above steps S210 to S220: After receiving the temporary authentication information, the configuration server can first parse the temporary token from the temporary authentication information, and then verify the temporary token according to the verification reference information. There are many specific verification processes here. Therefore, the specific verification process will be described in detail below. Among them, the verification reference information can be the user identity information or the reference token synchronized from the management server.

[0061] Step S230: If the verification result passes, the configuration server generates a warehouse configuration file according to the temporary token and the verification reference information.

[0062] For example, in the implementation of the above step S230: The configuration server determines whether the verification result of the temporary token passes. If the verification result of the temporary token passes, it generates a warehouse configuration file according to the temporary token and the verification reference information. Among them, the verification reference information can be the user identity information or the reference token synchronized from the management server. Specifically, the configuration server can use a template engine to generate a configuration template, and then fill the temporary token and the verification reference information into the configuration template to obtain the above-mentioned warehouse configuration file. After the configuration server generates the warehouse configuration file according to the temporary token and the verification reference information, the terminal device can download the warehouse configuration file from the configuration server through an executable script.

[0063] In the implementation process of the above solution, through dynamic verification based on the latest user identity information and permission scope for each request, and fine-grained access control for individual users, it is ensured that each operation is newly authorized, preventing security risks brought by long-term holding, and significantly improving the security and auditability of the configuration file. Further, by performing all authentication, verification, and configuration file generation on the configuration server side, it is convenient for administrators to manage and monitor uniformly, ensuring the consistency and synchronization of all clients, simplifying the administrative workload, and improving the overall management efficiency.

[0064] As an alternative implementation of the above step S220, the above verification reference information can be the user identity information of the terminal device synchronized from the management server; the implementation of using the verification reference information to verify the temporary token can include:

[0065] Step S221: Generate a reference token based on the user identity information of the terminal device.

[0066] An implementation manner of the above step S221 is as follows: To ensure that only legitimate terminal devices can obtain and use the warehouse configuration file, the configuration server synchronizes the user identity information sent by the terminal device from the management server or directly extracts it from the request, such as the username and role. Based on the extracted user identity information, a reference data structure containing specific information is constructed so that these user identity information will be encoded into the reference data structure, which may include information such as the user's unique identifier, permission scope, and validity period. In the specific practice process, symmetric or asymmetric encryption algorithms can also be used to encrypt the constructed content and add a digital signature to ensure integrity. For example, the JSON WebToken (JWT) standard is adopted, and the HMAC SHA-256 algorithm is used to encrypt and sign the data to obtain an encrypted and signed string. Finally, the encrypted and signed string is used as the reference token, and this encrypted and signed string can be used for comparison and verification of the temporary token in subsequent steps.

[0067] Step S222: Verify the temporary token according to the reference token to obtain the verification result of the temporary token.

[0068] An implementation manner of the above step S222 is as follows: After receiving the temporary token from the terminal device, the configuration server can determine whether the reference token is the same as the temporary token; if the reference token is the same as the temporary token, the verification result of the temporary token is determined to pass; if the reference token is different from the temporary token, the verification result of the temporary token is determined to fail. In the implementation process of the above solution, by synchronizing the user identity information of the terminal device from the management server and generating a reference token based on this for verification of the temporary token, since the reference token generated each time is based on real-time user identity information, even if an attacker intercepts a certain temporary token, it cannot be reused, significantly reducing the risk of replay attacks and improving the security of the system.

[0069] As an alternative implementation of the above step S220, the above verification reference information may be a reference token synchronized from the control server, and the reference token is a valid token generated according to the user identity information of the terminal device; the implementation of using the verification reference information to verify the temporary token may include: determining whether the reference token is the same as the temporary token; if the reference token is the same as the temporary token, determining that the verification result passes; if the reference token is different from the temporary token, determining that the verification result fails. In the implementation process of the above solution, by strictly comparing the reference token and the temporary token, it is ensured that the two are exactly the same to pass the verification, reducing the possibility of forging tokens, further strengthening the identity authentication mechanism, and improving the matching accuracy of the token verification of the identity information.

[0070] As an alternative implementation of the above configuration file acquisition method, the above temporary authentication information may further include: a temporary key, which can be used to encrypt data in transmission (such as the temporary token Token) to ensure that sensitive information will not be eavesdropped or tampered with during transmission; after generating the repository configuration file according to the temporary token and the verification reference information, it may further include:

[0071] Step S240: If the verification of the temporary key passes, generate an executable script according to the repository configuration file, and the executable script is used to be obtained by the terminal device and download the repository configuration file from the configuration server.

[0072] The implementation of the above step S240 is as follows: for example, the terminal device may send temporary authentication information including the temporary key to the configuration server to enable the configuration server to verify the temporary key in the temporary authentication information. After receiving the temporary authentication information sent by the terminal device, the configuration server may first verify the temporary key in the temporary authentication information. If the verification result of the temporary key passes, it may generate an executable script according to the repository configuration file, and then keep the service port open to wait for the terminal device to download the executable script. The terminal device may download the executable script from the configuration server, and then execute the executable script to enable the executable script to send the temporary token to the configuration server. After receiving the temporary authentication information, the configuration server may first parse the temporary token from the temporary authentication information, and then determine whether the verification of the temporary token passes. If the verification result of the temporary token passes, generate the repository configuration file according to the temporary token and the verification reference information. After the configuration server generates the repository configuration file according to the temporary token and the verification reference information, the terminal device may download the repository configuration file from the configuration server through the executable script.

[0073] Please refer to Figure 4Schematic structural diagram of the configuration file acquisition device provided by the embodiment of the present application; An embodiment of the present application provides a configuration file acquisition device 300, including:

[0074] An identity information sending module 310, configured to send user identity information to a management and control server, so that after the user identity information is authenticated, the management and control server generates and returns temporary authentication information according to the user identity information, and the temporary authentication information includes a temporary token.

[0075] An information receiving and sending module 320, configured to obtain the temporary token and send the temporary token to a configuration server, so that after the configuration server verifies the temporary token, it generates a warehouse configuration file according to the temporary token.

[0076] A configuration file acquisition module 330, configured to obtain the warehouse configuration file generated by the configuration server, and the warehouse configuration file is used to obtain dependent plugins from a plugin warehouse.

[0077] As an optional implementation manner of the above device, the temporary authentication information further includes: a temporary key; the configuration file acquisition module includes:

[0078] A temporary key sending sub-module, configured to send the temporary key to the configuration server, so that after the configuration server verifies the temporary key, it generates an executable script according to the warehouse configuration file.

[0079] A configuration file download sub-module, configured to obtain the executable script and download the warehouse configuration file from the configuration server through the executable script.

[0080] As an optional implementation manner of the above device, the configuration file download sub-module includes:

[0081] A file backup and replacement unit, configured to, if an original configuration file is stored locally, copy and back up the original configuration file through the executable script and replace the original configuration file with the warehouse configuration file.

[0082] An embodiment of the present application provides a configuration file acquisition device, including:

[0083] An authentication information receiving module, configured to receive temporary authentication information sent by a terminal device, and the temporary authentication information includes a temporary token.

[0084] A verification result obtaining module, configured to verify the temporary token using verification reference information to obtain a verification result, and the verification reference information is obtained from a management and control server.

[0085] A configuration file generation module, configured to, if the verification result passes, generate a warehouse configuration file according to the temporary token and the verification reference information.

[0086] As an alternative embodiment of the above device, the verification reference information is the user identity information of the terminal device synchronized from the management and control server; the verification result obtaining module includes:

[0087] A reference token generation sub-module, configured to generate a reference token according to the user identity information of the terminal device.

[0088] A first token judgment sub-module, configured to judge whether the reference token is the same as the temporary token.

[0089] A first result determination sub-module, configured to, if the reference token is the same as the temporary token, determine that the verification result is passed; if the reference token is not the same as the temporary token, determine that the verification result is not passed.

[0090] As an alternative embodiment of the above device, the verification reference information is a reference token synchronized from the management and control server, and the reference token is a valid token generated according to the user identity information of the terminal device; the verification result obtaining module includes:

[0091] A second token judgment sub-module, configured to judge whether the reference token is the same as the temporary token.

[0092] A second result determination sub-module, configured to, if the reference token is the same as the temporary token, determine that the verification result is passed; if the reference token is not the same as the temporary token, determine that the verification result is not passed.

[0093] As an alternative embodiment of the above device, the temporary authentication information further includes: a temporary key; the configuration file acquisition device further includes:

[0094] An execution script generation module, configured to, if the verification of the temporary key is passed, generate an executable script according to the repository configuration file, and the executable script is used to be acquired by the terminal device and download the repository configuration file from the configuration server.

[0095] It should be understood that this device corresponds to the above-described configuration file acquisition method embodiment, and can execute each step involved in the above method embodiment. The specific functions of this device can be referred to the description above, and the detailed description is appropriately omitted here. This device includes at least one software function module that can be stored in the memory in the form of software or firmware or solidified in the operating system (OS) of the device.

[0096] Please refer to Figure 5Schematic structural diagram of the electronic device provided by the embodiment of the present application. An electronic device 400 provided by the embodiment of the present application includes: a processor 410 and a memory 420. The memory 420 stores machine-readable instructions executable by the processor 410. When the machine-readable instructions are executed by the processor 410, the above method is executed.

[0097] The embodiment of the present application also provides a computer-readable storage medium 430. A computer program is stored on the computer-readable storage medium 430. When the computer program is run by the processor 410, the above method is executed. Among them, the computer-readable storage medium 430 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (abbreviation: SRAM), electrically erasable programmable read-only memory (abbreviation: EEPROM), erasable programmable read-only memory (abbreviation: EPROM), programmable read-only memory (abbreviation: PROM), read-only memory (abbreviation: ROM), magnetic memory, flash memory, magnetic disk or optical disc.

[0098] The embodiment of the present application also provides a computer program product, including: a computer program or computer instructions. When the computer program or computer instructions are run by the processor, the method described above is executed.

[0099] It should be noted that the various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts among the various embodiments can be referred to each other. For the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple. For the relevant parts, refer to the partial description of the method embodiments.

[0100] In several embodiments provided by the embodiments of the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are only illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of devices, methods, and computer program products according to multiple embodiments of the embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and a module, a program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order from that marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, mainly depending on the functions involved.

[0101] In addition, the various functional modules in the embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part. Moreover, in the description of this specification, the descriptions with reference to the terms "one embodiment", "some embodiments", "example", "specific example", "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the embodiments of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0102] The above description is only an optional implementation manner of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the embodiments of the present application, and all of them should be covered by the protection scope of the embodiments of the present application.

Claims

1. A method for obtaining a configuration file, characterized in that: Applied to terminal equipment, including: Sending the user identity information to the control server, so that the control server generates and returns temporary authentication information according to the user identity information after the user identity information is authenticated, wherein the temporary authentication information includes a temporary token; Obtain the temporary token, and send the temporary token to the configuration server, so that the configuration server generates a warehouse configuration file according to the temporary token after verifying the temporary token; The warehouse configuration file generated by the configuration server is obtained, where the warehouse configuration file is used to obtain dependent plug-ins from a plug-in warehouse.

2. The method according to claim 1, characterized in that The temporary authentication information also includes: a temporary key; the obtaining of the warehouse configuration file generated by the configuration server includes: Sending the temporary key to the configuration server, so that the configuration server generates an executable script according to the warehouse configuration file after verifying the temporary key; The executable script is obtained, and the warehouse configuration file is downloaded from the configuration server through the executable script.

3. The method according to claim 2, characterized in that After downloading the warehouse configuration file from the configuration server through the executable script, the method further includes: If the original configuration file is stored locally, the original configuration file is copied and backed up by the executable script, and the original configuration file is replaced by the warehouse configuration file.

4. A method for obtaining a configuration file, characterized in that: Applicable to the configuration server, including: Receiving temporary authentication information sent by a terminal device, wherein the temporary authentication information includes a temporary token; Verifying the temporary token using verification reference information to obtain a verification result, wherein the verification reference information is obtained from the management and control server; If the verification result passes, a warehouse configuration file is generated according to the temporary token and the verification reference information.

5. The method according to claim 4, characterized in that The verification reference information is the user identity information of the terminal device synchronized from the management and control server; The using verification reference information to verify the temporary token includes: generating a reference token according to the user identity information of the terminal device; Determining whether the reference token is identical to the temporary token; If so, the verification result is determined as passed; otherwise, the verification result is determined as failed.

6. The method according to claim 4, characterized in that The verification reference information is a reference token synchronized from the management and control server, and the reference token is a valid token generated according to the user identity information of the terminal device; The using verification reference information to verify the temporary token includes: Determining whether the reference token is identical to the temporary token; If so, the verification result is determined as passed; otherwise, the verification result is determined as failed.

7. The method according to claim 4, characterized in that The temporary authentication information further includes: a temporary key; after generating a warehouse configuration file according to the temporary token and the verification reference information, further includes: If the temporary key passes the verification, an executable script is generated according to the warehouse configuration file, and the executable script is used to be acquired by the terminal device and download the warehouse configuration file from the configuration server.

8. A configuration file acquisition device, characterized in that: Applied to terminal equipment, including: An identity information sending module, used to send user identity information to a control server, so that the control server generates and returns temporary authentication information according to the user identity information after the user identity information is authenticated, wherein the temporary authentication information includes a temporary token; An information receiving and sending module, used for obtaining the temporary token and sending the temporary token to a configuration server, so that the configuration server generates a warehouse configuration file according to the temporary token after verifying the temporary token; The configuration file acquisition module is used to obtain the warehouse configuration file generated by the configuration server, and the warehouse configuration file is used to obtain dependent plug-ins from the plug-in warehouse.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the machine-readable instructions are executed by the processor to perform any method according to claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is executed.

11. A computer program product, characterized in that include: A computer program or a computer instruction, wherein when the computer program or the computer instruction is executed by a processor, the method according to any one of claims 1 to 7 is executed.

Images