Method and apparatus for automatic deployment of a cryptographic service platform

Abstract

The embodiment of the application provides a kind of password service platform automation deployment method and device, the method includes: receiving the license request file obtained by encryption processing, generating the license file of platform, and verifying the license file, complete the deployment process of license file;Collect the deployment variable of front end page, process deployment variable, generate configuration file;The instruction of deploying each service is transmitted to target deployment node, and deployment task is executed, to complete configuration deployment process;By using encryption processing and the rule bound with hardware, the security and confidentiality of license file are ensured, in deployment and configuration process, deployment parameters are defined according to different deployment environment and demand, to improve the flexibility and adaptability of deployment.

Description

Technical Field

[0001] This application relates to the field of platform deployment technology, and more specifically, to a method and apparatus for automated deployment of a cryptographic service platform. Background Technology

[0002] The automated deployment platform for cryptographic services primarily provides automated installation and support for the deployment of domestically developed IT systems and databases. Its underlying technology utilizes the Go programming language combined with Ansible operation and maintenance components. However, existing technologies may lack customized support for specific user needs during automated deployment, leading to incompatibility when deployed across different operating system environments. Furthermore, the generation and activation of license files pose certain security risks, such as interception or tampering during transmission. Summary of the Invention

[0003] The purpose of this application is to provide an automated deployment method and apparatus for a cryptographic service platform, in order to solve the problems that existing automated deployment methods for cryptographic service platforms are incompatible when deployed in different operating system environments, and that the generation and activation process of license files poses certain security risks.

[0004] In a first aspect, embodiments of this application provide an automated deployment method for a cryptographic service platform, applied to a cryptographic service platform, comprising:

[0005] Receive the encrypted license request file, generate the platform's license file, verify the license file, and complete the license file deployment process;

[0006] Collect deployment variables from the front-end page, process the deployment variables, and generate configuration files; where deployment variables are deployment parameters defined according to different deployment environments and requirements;

[0007] The instructions for deploying each service are passed to the target deployment node to execute the deployment task and complete the configuration and deployment process.

[0008] In the above implementation process, this application embodiment receives a license request file obtained through encryption, generates a license file for the platform, verifies the license file, and completes the deployment process of the license file; collects deployment variables from the front-end page, processes the deployment variables, and generates a configuration file; transmits the instructions for deploying each service to the target deployment node, executes the deployment task, and completes the configuration deployment process; by adopting encryption processing and hardware-bound rules, the security and confidentiality of the license file are ensured; during the deployment and configuration process, deployment parameters are defined according to different deployment environments and requirements, improving the flexibility and adaptability of deployment.

[0009] Furthermore, before receiving the encrypted license request file, the process further includes:

[0010] Assemble the relevant objects for the license request and convert them into strings in a first set format; wherein the fields of the relevant objects for the license request include: license version number, product serial number, hardware information, and generation date;

[0011] The string in the first set format is symmetrically encrypted using a locally generated random number, and the random number is encrypted using the built-in asymmetric encryption public key.

[0012] The encrypted string and the encrypted random number are concatenated to obtain the concatenated data;

[0013] Write the concatenated data to a file to obtain the license request file.

[0014] In the above implementation process, the security and confidentiality of the license request file are ensured by adopting encryption and signature algorithms based on national cryptographic standards.

[0015] Furthermore, the verification of the license document includes:

[0016] Based on hardware binding rules, the hardware information of the license file is verified using a built-in public key;

[0017] The license file information is verified using a built-in public key. This information includes the signature value, expiration date, product model, and product feature identifier.

[0018] In the above implementation process, by adopting hardware-bound rules, the license file is ensured to be associated with specific hardware, thus preventing unauthorized use.

[0019] Furthermore, the process of collecting deployment variables from the front-end page, processing these variables, and generating a configuration file includes:

[0020] Collect deployment variables from the front-end page; these variables include: deployment node IP, network interface name used by the connection detection mechanism, IP and password of each database, and log storage path.

[0021] The deployment variables are stored in a file with a second configuration format that can be recognized by the configuration and maintenance components, and the variables are processed using the configuration template syntax.

[0022] Based on the defined syntax, deployment variables are assigned to different Roles; each Role corresponds to a defined component or service, and the correct variable configuration for each Role is ensured.

[0023] Based on the deployment variables and configuration file templates assigned to the components, configuration files are dynamically generated and the variables in the default configuration file in the deployment package are replaced.

[0024] In the above implementation process, the flexibility and adaptability of deployment are improved.

[0025] Furthermore, the deployment parameters defined according to different deployment environments and requirements include:

[0026] It adopts packaged configuration management tools and sets up operation and maintenance components to receive deployment parameters customized by users according to different deployment environments and needs; among them, the supported configuration dimensions are: operating system type, operating system version, operating system architecture, security service product version, and database type;

[0027] Among them, by setting a dynamic inventory mechanism for operation and maintenance components, the system receives the target host IPs directly configured by the user on the deployment page and dynamically generates a host list.

[0028] In the above implementation process, deployment parameters such as operating system, operating system version, and architecture are customized according to different deployment environments and needs of users, thereby improving the flexibility and adaptability of packaged deployment.

[0029] Furthermore, it also includes:

[0030] Optimize the user interface.

[0031] Furthermore, the optimization of the user interface includes:

[0032] The user interface uses the Vue framework to display the status and log information of the deployment nodes in real time; the deployment nodes include: machine initialization, middleware installation, and service node deployment.

[0033] Optimize the interaction design of the user interface.

[0034] In the above implementation process, an intuitive user interface is provided to display deployment nodes and log information in real time, thereby improving the user interaction experience.

[0035] Secondly, embodiments of this application provide an automated deployment device for a cryptographic service platform, integrated into the cryptographic service platform, comprising:

[0036] The license processing module is used to receive the encrypted license request file, generate the platform's license file, verify the license file, and complete the license file deployment process.

[0037] The configuration processing module is used to collect deployment variables from the front-end page, process the deployment variables, and generate configuration files; where deployment variables are deployment parameters defined according to different deployment environments and requirements.

[0038] The deployment processing module is used to pass the instructions for deploying various services to the target deployment node, execute the deployment tasks, and complete the configuration and deployment process.

[0039] Thirdly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a server, implements the automated deployment method of the cryptographic service platform as described above.

[0040] Fourthly, embodiments of this application provide a computer program product, the computer program product including instructions, which, when executed by a computer, cause the computer to perform the method described above. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 A flowchart illustrating an automated deployment method for a cryptographic service platform provided in this application embodiment;

[0043] Figure 2 This is a schematic diagram of the structure of an automated deployment device for a cryptographic service platform provided in an embodiment of this application;

[0044] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0045] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0046] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0047] Ansible's operations and maintenance components refer to the core functional modules that make up its automation architecture, used to implement operations and maintenance operations such as configuration management, application deployment, and task orchestration.

[0048] The FAQ (Frequently Asked Questions) module is an important entry point for users to obtain key information. When designing it, it should be based on user needs and provide clear and professional answers.

[0049] The automated deployment platform for cryptographic services primarily provides automated installation and support for the deployment of domestically developed information technology systems and databases. The underlying technology utilizes the Go programming language combined with Ansible operation and maintenance components. The following is a brief description of the existing technical solutions:

[0050] The password cloud deployment module, as the core of the deployment platform, is responsible for the deployment and installation of each node of the password service platform. It includes reading deployment instructions, server detection, deployment strategy formulation, middleware configuration, service configuration, and starting the installation process. After installation, the platform provides a detailed deployment table, allowing users to clearly understand the deployment details of each service and module.

[0051] License Management Module: This module involves the authorization management of the cryptographic service platform. Users need to input information such as the production serial number, project number, and the number of cryptographic resources authorized. A signature value is calculated using the national cryptographic algorithm to generate a request file. Users submit this file to the production department to generate a License file (lic). This file is then imported to activate and use the cryptographic service functions corresponding to the license's permissions.

[0052] Deployment Log Module: Logs generated during deployment are displayed in this module, facilitating troubleshooting. Users can view and download logs to better monitor the deployment process and analyze potential problems.

[0053] FAQ Module: This module summarizes common problems that may be encountered during deployment and their solutions, helping users use the deployment platform more efficiently. In addition, it includes a dependency diagram between various modules and services, enabling users to more clearly understand the structure and components of the cryptographic service platform.

[0054] However, existing technologies may lack customized support for specific user needs during automated deployment, leading to incompatibility or manual handling when deployed on different operating system environments. The generation and activation of license files can be cumbersome and pose certain security risks, such as interception or tampering during transmission. Log analysis functionality may be limited, requiring users to utilize additional tools or expertise for in-depth log data analysis. Limitations in compatibility and scalability may hinder adaptation to constantly changing hardware and software environments.

[0055] Based on this, this application proposes an automated deployment method for a cryptographic service platform to solve the above problems.

[0056] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating an automated deployment method for a cryptographic service platform provided in an embodiment of this application. The automated deployment method for the cryptographic service platform includes:

[0057] 100. Receive the encrypted license request file, generate the platform's license file, verify the license file, and complete the license file deployment process.

[0058] In some embodiments, before receiving the encrypted license request file, the method further includes:

[0059] 11. Assemble the relevant objects for the license request and convert them into strings in the first set format; wherein the fields of the relevant objects for the license request include: license version number, product serial number, hardware information and generation date.

[0060] For example, assembling a licReq object includes the following fields: version: lic version number; sn: product serial number, assigned by the production platform; hwinfo: hardware information, including MAC address, taken as the hash value of the MAC address of the first network card; gendate: generation date.

[0061] 12. Use locally generated random numbers to perform symmetric encryption on the string in the first set format, and use the built-in asymmetric encryption public key to encrypt the random numbers.

[0062] For example, the licReq object is converted into an XML string. The XML content is then encrypted using SM4 with a locally generated random number (key); this random number is then encrypted using the built-in SM2 public key.

[0063] 13. Concatenate the encrypted string and the encrypted random number to obtain the concatenated data.

[0064] For example, the encrypted string and the encrypted random number can be concatenated in a fixed format, such as: [encrypted string length identifier][encrypted string][separator][encrypted random number length identifier][encrypted random number]; or a simple separator can be used directly for concatenation.

[0065] 14. Write the concatenated data to a file to obtain the license request file.

[0066] Optionally, the concatenated data can be formatted to match the file format.

[0067] For example, writing concatenated data sequentially: appending the concatenated data directly to the end of the file; writing concatenated data in a formatted way: writing it to the file using structures such as JSON and XML.

[0068] Optionally, the license request file can be named using a unique identifier (such as a UUID) or a timestamp, and metadata (such as version number and generation time) can be added to the file header or comments.

[0069] In some embodiments, verifying the license document includes: verifying the hardware information of the license document using a built-in public key based on hardware binding rules; verifying the file information of the license document using the built-in public key, wherein the file information includes a signature value, expiration time, product model, and product function identifier; thereby, by adopting hardware binding rules, ensuring that the license document is associated with specific hardware and preventing unauthorized use.

[0070] 200. Collect deployment variables from the front-end page, process the deployment variables, and generate configuration files; where deployment variables are deployment parameters defined according to different deployment environments and requirements.

[0071] The deployment parameters, defined according to different deployment environments and requirements, include: using packaged configuration management tools and setting up operation and maintenance components to receive user-defined deployment parameters based on different deployment environments and requirements; among which, the supported configuration dimensions are: operating system type, operating system version, operating system architecture, security service product version, and database type.

[0072] Among them, by setting a dynamic inventory mechanism for operation and maintenance components, the system receives the target host IPs directly configured by the user on the deployment page and dynamically generates a host list.

[0073] For example, Jenkins packaging configuration management and Ansible operation and maintenance components are introduced to allow users to customize deployment parameters according to different deployment environments and needs.

[0074] Supported configuration dimensions: Operating system type: Supports multiple domestically developed operating systems; Operating system version: Supports different versions of operating systems; Operating system architecture: Supports both x86 and ARM architectures; Security service product version: Supports different versions of security service products to meet customer functional requirements; Database type: Supports multiple mainstream databases, including MySQL, Kingbase, DM, Gauss, etc.; Dynamic management: Through Ansible's dynamic inventory mechanism, users can directly configure the target host IP on the deployment page and dynamically generate a host list, thereby flexibly meeting the needs of multi-machine deployment.

[0075] Jenkins is an open-source automation server used for continuous integration and continuous delivery. Inventory is a file system used by Ansible to manage hosts and host groups.

[0076] 210. Collect deployment variables from the front-end page; among which, deployment variables include: deployment node IP, network card name used by the connection detection mechanism, IP and password of each database, and log storage path.

[0077] For example, front-end page variable collection: Users fill in the following variables on the deployment platform's front-end page: deployment node IP; network card name used by the connection detection mechanism Keepalive; IP and password of database, Kafka, Zookeeper, Elasticsearch; log storage path, and other related variables.

[0078] Understandably, Kafka, Zookeeper, and Elasticsearch are commonly used technology components in the fields of big data and distributed systems. They each have different responsibilities and often work together in the technology stack. Kafka is a distributed stream processing platform used to build real-time data streaming pipelines and stream processing applications. Zookeeper is a distributed coordination service used to manage configuration, naming, and synchronization services. Elasticsearch is a distributed search and analytics engine used for real-time search and analysis of large-scale text data.

[0079] 220. Store deployment variables in a file with a second configuration format that can be recognized by the configuration and maintenance components, and process the variables using the configuration template syntax.

[0080] For example, the collected variables are stored in a YAML file that the Ansible operations component can recognize. Jinja2 template syntax is used to process some variables, such as: multi-IP formatting: formatting multiple IP addresses into a format that conforms to the configuration file requirements; password encryption: encrypting sensitive information (such as database passwords, Kafka passwords, etc.) with ciphertext.

[0081] Jinja2 is a powerful and flexible template engine in Python, widely used to generate dynamic HTML, XML, JSON and other text content.

[0082] 230. Based on the defined syntax, assign deployment variables to different Roles; where each Role corresponds to a defined component or service, and ensure that the variable configuration of each Role is correct.

[0083] For example, based on the Role syntax of Ansible Playbook, the processed variables are assigned to different Roles: each Role corresponds to a set component or service (such as database Role, Kafka Role, Zookeeper Role, etc.), ensuring that the variables in each Role are configured correctly and independently.

[0084] 240. Based on the deployment variables and configuration file templates assigned to the components, dynamically generate configuration files and replace the variables in the default configuration file in the deployment package.

[0085] For example, the Ansible operations component dynamically generates the actual configuration file based on the deployment variables and configuration file templates assigned to the Role; it replaces the default configuration file in the deployment package to ensure that the variables in the configuration file are correctly populated.

[0086] 300. Transmit the instructions for deploying each service to the target deployment node, execute the deployment task, and complete the configuration and deployment process.

[0087] Specifically, the instructions for deploying each service are passed to the target deployment nodes, and each target deployment node executes the deployment task according to the generated configuration file. Optionally, the deployment task is verified after execution, such as executing automated test cases to verify whether the new configuration has taken effect, verifying service status (such as HTTP response codes, port listening), checking log files, and confirming that there are no error logs. The configuration deployment process is then complete.

[0088] As described above, this embodiment of the application receives an encrypted license request file, generates a platform license file, verifies the license file, and completes the license file deployment process; collects deployment variables from the front-end page, processes the deployment variables, and generates a configuration file; transmits the instructions for deploying each service to the target deployment node, executes the deployment task, and completes the configuration deployment process; by adopting encryption processing and hardware-bound rules, the security and confidentiality of the license file are ensured; during the deployment and configuration process, deployment parameters are defined according to different deployment environments and requirements, improving the flexibility and adaptability of deployment.

[0089] In some embodiments, the automated deployment method of the cryptographic service platform of this application may further be specified as: optimizing the user interface.

[0090] Specifically, the user interface uses the Vue framework to display the status and log information of the deployment nodes in real time, enabling users to quickly understand the deployment progress and status.

[0091] The deployment nodes include: machine initialization, middleware installation, and service node deployment. For example, machine initialization involves completing basic environment configurations, such as server optimization and JDK installation.

[0092] For example, middleware installations include databases (such as MySQL, PostgreSQL, Gaussian), Redis, Kafka, Elasticsearch, etc.

[0093] For example, the deployed service nodes include: monitoring platform, configuration center, authentication service, microservice management platform, API gateway, log platform, inspection service, craas service, cfaas service, and KMS (key management service).

[0094] Specifically, optimize the user interface's interaction design. This will provide clear navigation and help prompts, reducing the learning curve for users.

[0095] Specifically, set up real-time log monitoring in the user interface: logs generated during deployment are updated in real time, and users can view and download logs at any time.

[0096] For example, the cryptographic service platform of this application is designed with full consideration of the characteristics of domestically produced software and hardware to ensure compatibility with domestic environments. Extensive compatibility testing is conducted during development to ensure stable operation of the platform in various domestically produced software and hardware environments.

[0097] Understandably, in today's digital age, data security is paramount, especially in the field of password service management. The security of license files directly impacts the stable operation of the entire system and the protection of user rights. This application's embodiment uses the Chinese national cryptographic algorithm SM4 to encrypt the license file content, and then uses the Chinese national cryptographic algorithm SM2 asymmetric encryption to encrypt the key used in the above process with a built-in public key. The SM4 algorithm boasts extremely high security and reliability. It employs a 256-bit key length and uses complex nonlinear transformations and round function operations to encrypt data, effectively resisting various forms of attacks and ensuring the confidentiality of the license file during transmission and storage, preventing data theft or tampering. Even if data is intercepted during transmission, the high-strength protection of the encryption algorithm makes it difficult for attackers to obtain valid information.

[0098] During the license generation process, this embodiment of the application binds the license to specific hardware by reading specific information of the hardware device, such as its MAC address. The MAC address is a unique identifier for a network device and is globally unique; by reading the MAC address, the hardware device can be accurately identified. In practice, when a user applies for a license, the system automatically reads the user's device's MAC address and associates it with the content of the license request file. This binding method ensures that the license can only be used on authorized hardware devices, effectively preventing the illegal copying and dissemination of the license. Even if someone obtains the license file, if their hardware device's MAC address does not match the bound MAC address, they cannot activate and use the license, thereby protecting the software provider's intellectual property rights and legitimate interests.

[0099] During license activation, the password service platform module subsystem automatically verifies whether the hardware information matches the binding information in the license. The verification process is roughly as follows: The system first reads the current device's MAC address and then compares it with the MAC address recorded in the license file. If they match perfectly, the verification passes, and the user can activate and use the license normally. If they do not match, such as due to expiration or failed license decryption, the verification fails, the system refuses activation, and prompts the user that there may be unauthorized use. This strict verification mechanism further enhances the security of license management, ensures the legitimate use of the software, and provides reliable protection for both users and software providers.

[0100] The user interface of this application embodiment has the function of displaying the deployment node status and log information in real time, enabling users to understand the deployment progress and status in real time and intuitively. During the deployment process, the user interface displays detailed information of each deployment node in a graphical or list format, including node name, IP address, deployment progress, current status (such as deploying, deployment successful, deployment failed, etc.), and related log information. Through this real-time display function, users can keep track of the deployment dynamics at any time and promptly identify and resolve potential problems. When a node deployment fails, users can immediately view the corresponding log information, quickly locate the problem, and take appropriate measures to solve it, greatly improving deployment efficiency and success rate.

[0101] The log monitoring system in this embodiment implements real-time log monitoring. During deployment, the system records and updates generated log information in real time. This log information details every operation step, time, and potential error messages during deployment. Users can view these real-time logs at any time through the user interface to understand the detailed deployment process and current status. Users can also filter and query logs according to their needs, such as by time range or node name, to quickly find the information they are interested in. This real-time log monitoring function provides users with timely and accurate deployment information, helping them to promptly identify and resolve problems, ensuring the smooth progress of deployment.

[0102] To facilitate in-depth analysis and processing of logs, this embodiment supports users downloading logs at any time. Users can download log files to their local machines and use professional log analysis tools for further analysis and processing. Downloaded log files can serve as records and backups of the deployment process for later review and auditing. In case of problems, users can provide the downloaded log files to technical support personnel to help them quickly locate and resolve issues. This log download function provides users with greater flexibility and convenience, contributing to improved quality and efficiency of deployment work.

[0103] This application's embodiments introduce Jenkins packaging configuration management and Ansible operation and maintenance components, greatly improving deployment flexibility. Users can customize deployment parameters according to different deployment environments and needs. Different configuration parameters, such as database connection addresses, server port numbers, and log levels, may be required in development, testing, and production environments. Through the inventory files, Roles, Facts, Jinja2 templates, and other methods within the Ansible operation and maintenance components, corresponding parameters can be easily set for different environments, achieving one-click installation and deployment. This can be completed without excessive intervention on the server backend, lowering the deployment threshold for frontline implementation and effectively improving efficiency. It also offers broad compatibility with domestic IT innovation.

[0104] During the platform design phase, the characteristics of domestically produced hardware and software were fully considered. From architecture design to functional module implementation, targeted optimizations and adjustments were made to ensure compatibility with domestic environments. On the hardware side, comprehensive adaptation and testing were conducted on domestic servers and storage devices to ensure stable operation on various domestic hardware platforms. On the software side, deep integration and optimization with domestic operating systems, databases, and middleware were achieved, enabling seamless interoperability. Compatibility testing and optimization with multiple databases were performed to ensure the platform can operate normally in these software environments, fully utilizing its functionality and performance.

[0105] The steps described above are not strictly performed in the order of their numbers; they should be understood as a whole.

[0106] Secondly, based on the above embodiments, Figure 2 This is a schematic diagram of an automated deployment device for a cryptographic service platform provided in an embodiment of this application. (Reference) Figure 2 The automated deployment device for the cryptographic service platform provided in this embodiment specifically includes: a license processing module 201, a configuration processing module 202, and a deployment processing module 203.

[0107] The license processing module 201 receives the encrypted license request file, generates the platform's license file, verifies the license file, and completes the license file deployment process. The configuration processing module 202 collects the deployment variables from the front-end page, processes the deployment variables, and generates a configuration file. The deployment variables are deployment parameters defined according to different deployment environments and requirements. The deployment processing module 203 transmits the instructions for deploying each service to the target deployment node, executes the deployment task, and completes the configuration deployment process.

[0108] As described above, this embodiment of the application receives an encrypted license request file, generates a platform license file, verifies the license file, and completes the license file deployment process; collects deployment variables from the front-end page, processes the deployment variables, and generates a configuration file; transmits the instructions for deploying each service to the target deployment node, executes the deployment task, and completes the configuration deployment process; by adopting encryption processing and hardware-bound rules, the security and confidentiality of the license file are ensured; during the deployment and configuration process, deployment parameters are defined according to different deployment environments and requirements, improving the flexibility and adaptability of deployment.

[0109] The automated deployment device for the cryptographic service platform provided in this application embodiment can be used to execute the automated deployment method for the cryptographic service platform provided in the above embodiment, and has corresponding functions and beneficial effects.

[0110] Thirdly, embodiments of this application also provide an electronic device that can integrate the automated deployment device for the cryptographic service platform provided in embodiments of this application. Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. (Reference) Figure 3 The electronic device includes an input device 33, an output device 34, a memory 32, and one or more processors 31. The memory 32 stores one or more programs. When the one or more programs are executed by the one or more processors 31, the one or more processors 31 implement the automated deployment method of the cryptographic service platform provided in the above embodiments. The input device 33, output device 34, memory 32, and processors 31 can be connected via a bus or other means. Figure 3 Taking the example of a connection between China and Israel via a bus.

[0111] The processor 31 executes various functional applications and data processing of the device by running software programs, instructions and modules stored in the memory 32, thereby realizing the above-mentioned automated deployment method of the cryptographic service platform.

[0112] The electronic device provided above can be used to execute the automated deployment method of the cryptographic service platform provided in the above embodiments, and has corresponding functions and beneficial effects.

[0113] Fourthly, embodiments of this application also provide a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the automated deployment method of the cryptographic service platform as described above, and can achieve the same beneficial effects.

[0114] Of course, the computer-executable instructions provided in the embodiments of this application are not limited to the automated deployment method of the cryptographic service platform as described above, but can also perform related operations in the automated deployment method of the cryptographic service platform provided in any embodiment of this application.

[0115] Fifthly, embodiments of this application also provide a computer program product. The methods described in the various embodiments of this application can be implemented entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the various embodiments of this application are executed entirely or partially. The computer can be a general-purpose computer, a special-purpose computer, a computer network, network equipment, user equipment, core network equipment, OAM (Open Application Model), or other programmable devices.

[0116] The computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; or an optical medium, such as a digital video optical disc; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0117] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0118] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0119] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0120] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0121] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0122] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. An automated deployment method for a cryptographic service platform, characterized in that, Applied to a cryptographic service platform, the method includes: Receive the encrypted license request file, generate the platform's license file, verify the license file, and complete the license file deployment process; Collect deployment variables from the front-end page, process the deployment variables, and generate configuration files; where deployment variables are deployment parameters defined according to different deployment environments and requirements; The instructions for deploying each service are passed to the target deployment node to execute the deployment task and complete the configuration and deployment process; in: The verification of the license document includes: Based on hardware binding rules, the hardware information of the license file is verified using a built-in public key; The license file information is verified using a built-in public key. This information includes the signature value, expiration date, product model, and product feature identifier. The process of collecting deployment variables from the front-end page, processing these variables, and generating a configuration file includes: Collect deployment variables from the front-end page; these variables include: deployment node IP, network interface name used by the connection detection mechanism, IP and password of each database, and log storage path. The deployment variables are stored in a file with a second configuration format that can be recognized by the configuration and maintenance components, and the variables are processed using the configuration template syntax. Based on the defined syntax, deployment variables are assigned to different Roles; each Role corresponds to a defined component or service, and the correct variable configuration for each Role is ensured. Based on the deployment variables and configuration file templates assigned to the components, configuration files are dynamically generated and the variables in the default configuration file in the deployment package are replaced.

2. The automated deployment method for a cryptographic service platform according to claim 1, characterized in that, Before receiving the encrypted license request file, the method further includes: Assemble the relevant objects for the license request and convert them into strings in a first defined format; wherein the fields of the relevant objects for the license request include: license version number, product serial number, hardware information, and generation date; The string in the first set format is symmetrically encrypted using a locally generated random number, and the random number is encrypted using the built-in asymmetric encryption public key. The encrypted string and the encrypted random number are concatenated to obtain the concatenated data; Write the concatenated data to a file to obtain the license request file.

3. The automated deployment method for a cryptographic service platform according to claim 1, characterized in that, The deployment parameters defined according to different deployment environments and requirements include: It adopts packaged configuration management tools and sets up operation and maintenance components to receive deployment parameters customized by users according to different deployment environments and needs; among them, the supported configuration dimensions are: operating system type, operating system version, operating system architecture, security service product version, and database type; Among them, by setting a dynamic inventory mechanism for operation and maintenance components, the system receives the target host IPs directly configured by the user on the deployment page and dynamically generates a host list.

4. The automated deployment method for a cryptographic service platform according to claim 1, characterized in that, Also includes: Optimize the user interface.

5. The automated deployment method for a cryptographic service platform according to claim 4, characterized in that, The optimization of the user interface includes: The user interface uses the Vue framework to display the status and log information of the deployment nodes in real time; the deployment nodes include: machine initialization, middleware installation, and service node deployment. Optimize the interaction design of the user interface.

6. An automated deployment device for a cryptographic service platform, characterized in that, Integrated into the cryptographic service platform, including: The license processing module is used to receive the encrypted license request file, generate the platform's license file, verify the license file, and complete the license file deployment process. The configuration processing module is used to collect deployment variables from the front-end page, process the deployment variables, and generate configuration files; where deployment variables are deployment parameters defined according to different deployment environments and requirements. The deployment processing module is used to pass the instructions for deploying each service to the target deployment node, execute the deployment task, and complete the configuration and deployment process; in: The license processing module is used for: Based on hardware binding rules, the hardware information of the license file is verified using a built-in public key; The license file information is verified using a built-in public key. This information includes the signature value, expiration date, product model, and product feature identifier. The configuration processing module is used for: Collect deployment variables from the front-end page; these variables include: deployment node IP, network interface name used by the connection detection mechanism, IP and password of each database, and log storage path. The deployment variables are stored in a file with a second configuration format that can be recognized by the configuration and maintenance components, and the variables are processed using the configuration template syntax. Based on the defined syntax, deployment variables are assigned to different Roles; each Role corresponds to a defined component or service, and the correct variable configuration for each Role is ensured. Based on the deployment variables and configuration file templates assigned to the components, configuration files are dynamically generated and the variables in the default configuration file in the deployment package are replaced.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by the server, implements the automated deployment method of the cryptographic service platform as described in any one of claims 1-5.

8. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computer, cause the computer to implement the automated deployment method of the cryptographic service platform as described in any one of claims 1-5.

Images