Automatic OpenVPN account management method based on approval linkage

Abstract

The invention provides an automatic OpenVPN account management method based on examination and approval linkage, and relates to the technical field of network communication, and the method comprises the steps: checking VPN application information filled by an applicant, and generating an examination and approval form based on the VPN application information passing the examination and approval; calling a Python API (Application Program Interface), and mapping parameters in the approval form into OpenVPN (Open Virtual Private Network) configuration parameters; a client certificate and a private key are generated based on an EasyRSA component, and certificate generation is completed through non-interactive password input; according to the authority level, dynamically updating an authority rule in an OpenVPN configuration directory, and distributing a main IP address and a standby IP address from a preset IP address pool; and forming VPN information by the certificate, the authority rule, the main IP rule and the standby IP rule, and sending the VPN information to the applicant.

Description

Technical Field

[0001] This application belongs to the field of network communication technology, specifically relating to an automated OpenVPN account management method based on approval linkage. Background Technology

[0002] With the acceleration of digital transformation and the explosive growth in demand for remote work, enterprises are increasingly seeking secure and reliable network access solutions. OpenVPN, a widely used open-source Virtual Private Network (VPN) software, plays a crucial role in providing secure network access. However, traditional OpenVPN account management relies on command-line operations, which not only requires administrators to have high technical skills but also leads to inefficiency and errors due to complex procedures. Furthermore, existing management models cannot be effectively integrated with enterprise approval systems, resulting in lengthy application-to-account activation cycles that fail to meet the needs of enterprises for efficient management and rapid response.

[0003] While existing technologies offer some improvements to OpenVPN in terms of performance optimization, security enhancement, and simplified deployment and management, these solutions generally suffer from the following problems:

[0004] Command-line operations require manual execution of multiple steps, increasing the risk of errors. The lack of automatic integration with the enterprise approval system results in lengthy account creation cycles. Inconsistent operating standards among different administrators hinder unified management and monitoring. Summary of the Invention

[0005] This application provides an automated OpenVPN account management method based on approval linkage to solve one of the aforementioned technical problems.

[0006] The technical solution adopted in this application is as follows:

[0007] This application provides an automated OpenVPN account management method based on approval linkage, including:

[0008] The VPN application information submitted by the applicant is reviewed, and an approval form is generated based on the approved VPN application information;

[0009] Call the Python API interface to map the parameters in the approval form to OpenVPN configuration parameters;

[0010] The client certificate and private key are generated based on the EasyRSA component, and the certificate generation is completed through non-interactive password input.

[0011] The OpenVPN configuration directory is dynamically updated according to the permission level, and primary and backup IP addresses are allocated from the preset IP address pool.

[0012] The VPN information, consisting of the certificate, permission rules, primary IP rules, and backup IP rules, is sent to the applicant.

[0013] According to one embodiment of this application, the review of the VPN application information filled in by the applicant includes:

[0014] The applicant's direct supervisor reviews the rationale for the application and whether the scope of authority matches the job requirements. The review result is either approval or rejection. If rejected, the approval opinion must be attached.

[0015] The review process can be completed on mobile devices, and reviewers can perform the approval process through a mobile app or web page.

[0016] The IT department reviews the compliance of the scope of authority and the reasonableness of the validity period.

[0017] According to one embodiment of this application, the step of calling the Python API interface to map the parameters in the approval form to OpenVPN configuration parameters includes:

[0018] The Python API uses JWT token authentication, allowing only administrators to access it, thus ensuring the security of API calls.

[0019] The interface design is based on the Flask framework to implement a RESTful architecture and receives parameters in JSON format.

[0020] The mapping relationship between the parameters in the approval form and the OpenVPN configuration parameters includes:

[0021] Applicant's name and OpenVPN username, validity period and certificate validity period, manually entered password and OpenVPN account password, permission level and permission rules in the OpenVPN configuration directory.

[0022] According to one embodiment of this application, the step of generating a client certificate and private key based on the EasyRSA component, and completing certificate generation through non-interactive password input, includes:

[0023] The Expect tool simulates interactive command-line operations, automatically completing password input and certificate signing request processing.

[0024] The certificate validity period parameter is dynamically passed to the EasyRSA component, and the certificate validity period is dynamically controlled by the validity period field in the approval form.

[0025] Special characters in passwords are escaped to prevent command injection risks;

[0026] If the applicant does not manually enter a password, a random password with the required complexity will be automatically generated.

[0027] According to one embodiment of this application, the step of dynamically updating the permission rules in the OpenVPN configuration directory according to the permission level and allocating a primary IP address and a backup IP address from a preset IP address pool includes:

[0028] Dynamically update the permission rules in the OpenVPN client configuration directory based on the permission level in the approval form;

[0029] Permission rules include IP address binding, routing policies, and access control lists;

[0030] Extract the primary IP address from the preset IP address pool and generate a backup IP address using regular expression replacement rules;

[0031] Allocated IP addresses are marked in the IP address pool to prevent duplicate allocation;

[0032] Backup IP addresses are generated using the primary IP address replacement rules, supporting a dual IP redundancy mechanism.

[0033] According to one embodiment of this application, sending VPN information composed of the certificate, authorization rules, primary IP rules, and backup IP rules to the applicant includes:

[0034] The email content includes the applicant's account information, the primary and backup IP addresses bound to the application, the certificate download link, and installation instructions;

[0035] The email content is dynamically generated using formatted strings and supports multi-language template adaptation.

[0036] The email attachment contains the client certificate, configuration file, and installation guide;

[0037] The attachment file name is generated based on the applicant's name and timestamp to ensure uniqueness.

[0038] According to one embodiment of this application, it also includes anomaly handling and monitoring functions, specifically including:

[0039] When a Python API call fails, an alert is sent to the IT operations group, and the application status is marked as failed.

[0040] Adopt an exponential backoff and retry strategy;

[0041] The task status is recorded by Redis caching, and the execution results can be queried via the interface;

[0042] Integrate with Prometheus monitoring metrics to record performance data such as script execution time and the number of concurrent tasks.

[0043] According to one embodiment of this application, the VPN application information includes: applicant's name, corporate email address, required permissions, validity period, and password.

[0044] A second aspect of this application provides a computer-readable storage medium having a program stored thereon that, when executed by a processor, implements the steps described in the method.

[0045] A third aspect of this application provides an electronic device including a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method as described.

[0046] Due to the adoption of the above technical solution, the beneficial effects achieved by this application are as follows:

[0047] The applicant submits their application information through the internal workflow approval system. After initial review by the department and approval by the IT department, an approval form containing the required parameters is automatically generated. This step significantly reduces manual intervention and improves management efficiency.

[0048] This application utilizes a Python API to seamlessly map parameters in approval forms to OpenVPN configuration parameters, achieving automatic alignment between approval results and account configurations. This approach not only improves work efficiency but also ensures the accuracy and consistency of configurations.

[0049] This application is based on the EasyRSA component and uses the Expect tool to simulate interactive command-line operations, automatically completing the certificate generation process. This avoids errors that may occur from manually entering passwords and improves the security and reliability of the operation.

[0050] This application dynamically updates the permission rules in the OpenVPN configuration directory based on the applicant's permission level and allocates primary and backup IP addresses from a preset IP address pool. This mechanism not only enhances the flexibility and adaptability of the network but also improves the stability of network connections through a dual IP redundancy mechanism.

[0051] This application packages the generated certificate, permission rules, primary and backup IP addresses, and other information and sends them to the applicant via email, providing a convenient way to transmit information while also ensuring information security. Attached Figure Description

[0052] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0053] Figure 1A flowchart illustrating an automated OpenVPN account management method based on approval linkage, provided for an embodiment of this application;

[0054] Figure 2 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0055] Figure label:

[0056] 810, Processor; 820, Communication interface; 830, Memory; 840, Communication bus. Detailed Implementation

[0057] To more clearly illustrate the overall concept of this application, a detailed explanation is provided below with reference to the accompanying drawings.

[0058] Many specific details are set forth in the following description to provide a thorough understanding of this application. However, this application may also be implemented in other ways different from those described herein. Therefore, the scope of protection of this application is not limited to the specific embodiments disclosed below. It should be noted that, unless otherwise specified, the embodiments of this application and the features thereof can be combined with each other.

[0059] In this application, unless otherwise expressly specified and limited, the "above" or "below" of the second feature can mean that the first and second features are in direct contact, or that the first and second features are in indirect contact through an intermediate medium. In the description of this specification, references to terms such as "an embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples.

[0060] Example 1

[0061] like Figure 1 As shown, an automated OpenVPN account management method based on approval linkage includes:

[0062] The VPN application information submitted by the applicant is reviewed, and an approval form is generated based on the approved VPN application information.

[0063] As mentioned above, employees submit VPN account applications containing detailed information (such as name, company email, required permissions, validity period, and password) through the internal workflow approval system. The system first performs a preliminary validation of this information for format and content, ensuring all required fields are filled in correctly. Subsequently, according to the company's management processes, the relevant department head or IT administrator reviews the application. The review process includes verifying the rationale for the application, whether the permission scope matches the job requirements, and whether the validity period setting is reasonable. Once approved, the system automatically generates a standardized approval form containing all necessary configuration parameters for subsequent automated processing.

[0064] For example, suppose an employee named Zhang San needs to access development network resources for remote work. He submits a VPN account application through the company's internal workflow approval system, filling in the following information:

[0065] Name: Zhang San

[0066] Company email: zhangsan@company.com

[0067] Required permissions: Developer network access permissions

[0068] Validity period: 90 days

[0069] Password: A strong password that meets complexity requirements.

[0070] The system first checks if Zhang San's corporate email address is in the correct format and confirms that the selected permission options are valid. Next, Zhang San's direct supervisor will receive a notification requesting an initial review of Zhang San's application. If the supervisor deems Zhang San indeed needs access to the development network and that the selected permissions are reasonable, they will click "Approval." Then, the IT department will receive a notification for a second review, primarily checking the compliance of the permissions and the reasonableness of the validity period. Once both stages of the review are passed, the system will generate an approval form containing all of Zhang San's necessary information (such as username, password, validity period, and permission level), preparing for the next step of automated configuration.

[0071] It's worth noting that in specific implementation scenarios, in addition to the basic departmental initial review and IT department approval, more complex multi-level approval processes can be introduced based on the above solutions. For example, in some enterprise environments with high security requirements, final approval from the legal department or senior management may also be required. This expansion not only enhances security controls but also makes the entire process more flexible and adaptable to the needs of enterprises of different sizes and types.

[0072] In specific implementation scenarios, building upon the above solutions, the system can intelligently recommend suitable permission combinations based on factors such as the applicant's position and past application records, and provide preset application templates for quick selection. This not only reduces manual input errors but also speeds up the approval process and improves the user experience.

[0073] In specific implementation scenarios, to further enhance security, biometric technologies (such as fingerprint recognition and facial recognition) can be integrated into the approval process. This allows for biometric verification at critical points to confirm user identity, ensuring that only authorized personnel can perform sensitive operations.

[0074] In specific implementation scenarios, based on the above solutions, and considering the diverse device usage in modern enterprise environments, the approval process should support multiple terminal devices (such as PCs, tablets, and smartphones). By optimizing the interface design and interaction logic, it can be ensured that users can smoothly complete application and approval operations whether in the office or on the go.

[0075] Call the Python API interface to map the parameters in the approval form to OpenVPN configuration parameters.

[0076] As described above, after the enterprise's internal administrative approval system reviews the VPN account application submitted by the applicant and generates an approval form, it calls a pre-developed Python API interface to convert the various parameters in the approval form (such as username, password, validity period, and permission level) into specific parameters suitable for OpenVPN configuration. This process involves a security authentication mechanism to ensure that only authorized users can call the API, and all parameters must be verified to guarantee their correctness and security. The API interface is designed based on a RESTful architecture, supports receiving data in JSON format, and can handle complex business logic, such as dynamically adjusting the OpenVPN service configuration according to different permission levels.

[0077] For example, suppose an employee named Li Si has completed a VPN account application and passed the review of his department head and IT department. The approval form contains the following information:

[0078] Username: lisi

[0079] Password: StrongPass123!

[0080] Validity period: 60 days

[0081] Access Level: Testnet Access

[0082] When the approval status changes to "Approved," the administrative approval system automatically triggers a call to the Python API interface. During this process, the system first verifies the caller's identity (e.g., through JWT token authentication), and then maps the parameters in the aforementioned approval form to specific OpenVPN configuration items. For example, "Username" is mapped to the username field in the OpenVPN configuration file, and "Validity Period" is converted to the certificate validity period setting required by the EasyRSA component (e.g., 60 days). Furthermore, based on Li Si's selected "Testnet Access Permissions," the system updates the permission rules in the OpenVPN client configuration directory (ccd directory) accordingly, allowing Li Si to access testnet resources only.

[0083] It should be noted that in specific implementation scenarios, further security layers can be added at the API interface level based on the above solutions. These layers could include IP whitelists and request frequency limits to prevent malicious attacks or API abuse. More advanced authentication methods, such as multi-factor authentication (MFA), can be introduced to ensure that each API call is initiated by a legitimate user.

[0084] In specific implementation scenarios, custom mapping rules can be supported based on the above solutions, allowing different enterprises to meet their specific needs through simple configuration adjustments, rather than hard-coding them into the system. Support for complex permission structures, such as hierarchical permission management, can also be added, enabling administrators to more precisely control the access level of each user.

[0085] In specific implementation scenarios, real-time monitoring tools can be integrated into the above solutions to track the health status and service response time of API interfaces. Once an anomaly is detected, an alert notification can be immediately sent to relevant personnel. Detailed logging functionality should be implemented, recording not only every successful API call but also the reason for failure and the number of attempts, facilitating subsequent auditing and troubleshooting.

[0086] In specific implementation scenarios, the design can be further enhanced by considering integration with other network management systems, enabling this solution to be used not only in OpenVPN environments but also easily adaptable to other types of virtual private network solutions. Standardized API documentation and an SDK supporting multiple programming languages ​​are provided, facilitating third-party developers to customize functionality or perform secondary development according to their needs.

[0087] The client certificate and private key are generated based on the EasyRSA component, and the certificate generation is completed through non-interactive password input.

[0088] As described above, the EasyRSA component is used to automatically generate unique client certificates and private keys for each applied OpenVPN account. EasyRSA is an open-source toolset primarily used for managing PKI (Public Key Infrastructure) certificates, including creating, revoking, and managing certificates. In this step, the system automatically executes a series of commands to generate the certificate and private key, and sets the certificate password through a non-interactive password input mechanism, avoiding the process of requiring users to manually enter information one by one in the command-line interface as in traditional manual operations. This not only improves efficiency but also reduces the possibility of human error, ensuring the security and consistency of the certificate generation process.

[0089] For example, suppose an employee named Wang Wu submits a VPN account application and it has been approved. The system will then use the EasyRSA component to generate a client certificate and private key for him. Specifically:

[0090] The system first determines the validity period of the certificate (e.g., 30 days), and then uses EasyRSA to automatically generate a unique client certificate and private key.

[0091] During the certificate generation process, the system will automatically set a strong password to protect the certificate. This password can be a password provided by the applicant that meets the complexity requirements, or it can be a random password automatically generated by the system.

[0092] Throughout the process, all interactive commands (such as entering and confirming passwords) are scripted, allowing certificate generation to be completed without manual intervention. This ensures efficient and accurate processing even when faced with a large number of batch certificate generation requests from users.

[0093] It should be noted that, in specific implementation scenarios, more complex password strategies can be introduced based on the above solutions. For example, periodically changing certificate passwords or dynamically adjusting password complexity requirements based on user behavior can improve account security. Furthermore, the ability to store and inspect historical passwords can prevent the reuse of old passwords, further enhancing security.

[0094] In specific implementation scenarios, the above solutions can be expanded to include comprehensive management support for the certificate lifecycle, such as certificate renewal reminders, automatic renewal, and automatic revocation upon certificate expiration, ensuring that all certificates are under effective monitoring. Detailed logging is provided to track the entire process of each certificate from creation to revocation, facilitating auditing and troubleshooting.

[0095] In specific implementation scenarios, building upon the above solutions and considering the needs of global enterprises, multilingual support can be added to the certificate generation process. This allows certificate generation notification emails to be sent to users worldwide in different languages. Support for username and password input in multiple character sets is also provided for the convenience of users whose native language is not English.

[0096] In specific implementation scenarios, biometric technologies (such as fingerprint recognition and facial recognition) can be combined with the above solutions as an additional means of authentication, adding a layer of security during certificate generation. Integration with other authentication services (such as OAuth and SAML) is supported, allowing users to obtain certificates after authenticating through third-party services, thus improving the system's flexibility and compatibility.

[0097] The OpenVPN configuration directory is dynamically updated based on the permission level, and primary and backup IP addresses are allocated from the preset IP address pool.

[0098] As described above, after generating the client certificate and private key, the system automatically updates the permission rules in the OpenVPN configuration directory (usually the ccd directory) based on the permission level selected by the applicant in the approval form (e.g., development network, test network, or production network). Furthermore, the system allocates a primary IP address to the user from a pre-defined IP address pool and generates a backup IP address to improve network connection reliability. This approach not only enables precise control over access permissions for different users but also ensures that users can still connect via the backup IP address even if the primary IP address is unavailable.

[0099] For example, suppose an employee named Zhao Liu submits a VPN account application and selects "Developer Network" as his desired access level. After the certificate is generated, the system will perform the following operations:

[0100] Permission rule update: Based on Zhao Liu's selected "development network" permission, the system adds corresponding routing rules and access control lists (ACLs) for him in the OpenVPN configuration directory to ensure that he can only access development network resources.

[0101] IP address allocation:

[0102] The system first selects an unused primary IP address (e.g., 172.16.181.10) from the preset IP address pool and assigns it to Zhao Liu.

[0103] Next, the system generates a backup IP address (e.g., 172.16.53.10) based on certain replacement rules. If the primary IP address encounters a problem, Zhao Liu can use the backup IP address to continue connecting to the network.

[0104] This mechanism not only improves the efficiency of network management, but also enhances the system's fault tolerance, ensuring that users can maintain their connection when the network fails.

[0105] It should be noted that, in specific implementation scenarios, more intelligent IP address allocation strategies can be implemented based on the above solutions. For example, the optimal IP address can be dynamically selected based on factors such as the user's geographical location and current network load. An IP address recycling mechanism can be introduced, so that when a user no longer needs an IP address, the system can automatically mark it as available and return it to the address pool for other users to use.

[0106] In specific implementation scenarios, more complex permission structures, such as hierarchical permission management or role-based access control (RBAC), can be supported based on the above solutions, allowing administrators to define more granular access rules according to actual needs. Combining time restrictions, certain permissions can be set to be valid only during specific time periods, further enhancing security.

[0107] In specific implementation scenarios, further levels of redundancy can be added to the above solution. For example, in addition to primary and backup IP addresses, a third or even fourth level of backup IP addresses can be provided to ensure network connectivity is maintained even in extreme situations. A heartbeat detection mechanism can be introduced to periodically check the status of each IP address. If an anomaly is detected, the backup IP address is immediately activated, and relevant personnel are notified for handling.

[0108] In specific implementation scenarios, based on the above solutions, and considering the diverse device usage of modern enterprises, permission rules and IP address allocation logic can be optimized to seamlessly adapt to different operating systems and network environments, whether it's Windows, macOS, or Linux. Standardized API interface documentation and SDKs supporting multiple programming languages ​​are provided to facilitate third-party developers in customizing functions or performing secondary development according to their needs.

[0109] The VPN information, consisting of the certificate, permission rules, primary IP rules, and backup IP rules, is sent to the applicant.

[0110] As mentioned above, after completing all necessary configurations, the system automatically compiles the generated client certificate, assigned permission rules, primary IP address, and backup IP address, and sends this information to the applicant via email or other communication methods. This step ensures that users can quickly obtain all the information needed to start using their newly created or updated OpenVPN account. To ensure information security, the email content is usually encrypted or includes a detailed installation guide to instruct users on how to properly set up and use this information.

[0111] For example, suppose an employee of a company, Sun Qi, has completed the VPN account application process, and the system has generated a client certificate (including .crt and .key files), set access rules for the "production network," and assigned him a primary IP address of 172.16.181.20 and a backup IP address of 172.16.53.20. Next, the system will perform the following operations:

[0112] Information organization: The system integrates all the above information into an easy-to-understand format, including username, password, validity period, permission description, primary and backup IP address list, and client certificate.

[0113] Email Preparation: The system will automatically generate an email containing a detailed installation guide and attachments (such as .ovpn configuration files, certificate files, etc.). The email content will clearly instruct the user on how to import the certificate into the OpenVPN client and how to connect based on the assigned IP address.

[0114] Secure delivery: Emails are sent to Sun Qi's corporate email address via the company's secure email server, and encryption technology may be used to protect the security of the email content.

[0115] The benefits of doing this are that it not only improves the user experience and reduces the possibility of errors in manual configuration, but also enhances the professionalism and security of the entire process.

[0116] It's worth noting that in specific implementation scenarios, in addition to email, notifications can also be sent to users via SMS and instant messaging tools (such as WeChat Work and Slack) to ensure that important information is received even if emails are not checked in a timely manner. Customizable notification templates are supported, allowing administrators to adjust the notification style according to corporate culture and brand image, thereby enhancing the user experience.

[0117] In specific implementation scenarios, based on the above solutions, the email content can be encrypted before sending sensitive information, ensuring that only authorized users can decrypt and view the email's contents. Introducing digital signature verification ensures that users can confirm that the received information indeed comes from a trusted source, preventing phishing attacks.

[0118] In specific implementation scenarios, more detailed installation guides and support documents can be provided based on the above solutions, covering specific configuration steps for different operating systems to help users complete the setup smoothly. Offering online customer service or a technical support hotline provides immediate assistance when users encounter problems, further improving user satisfaction.

[0119] In specific implementation scenarios, in addition to the above solutions, feedback links or surveys can be included in emails to encourage users to share problems and suggestions encountered during setup and use, so as to continuously optimize products and services. The content and format of notifications can be adjusted based on user feedback, such as adding a frequently asked questions section to reduce user confusion.

[0120] In specific implementation scenarios, a centralized self-service platform can be established based on the above solutions. Users can download the latest configuration files, view history, reset passwords, etc., on the platform without waiting for administrator intervention. The platform supports multilingual interfaces, making it convenient for users around the world and enhancing the internationalization of services.

[0121] According to one embodiment of this application, the review of the VPN application information filled in by the applicant includes:

[0122] The applicant's direct supervisor reviews the rationale for the application and whether the scope of authority matches the job requirements. The review result is either approval or rejection. If rejected, the approval opinion must be attached.

[0123] The review process can be completed on mobile devices, and reviewers can perform the approval process through a mobile app or web page.

[0124] The IT department reviews the compliance of the scope of authority and the reasonableness of the validity period.

[0125] As mentioned above, VPN account application information submitted by employees is reviewed to ensure that all applications comply with the company's security policies and actual needs. Specifically, the review process consists of two main stages: an initial review by the employee's immediate supervisor and a further review by the IT department.

[0126] The direct supervisor reviews the application, first assessing whether the applicant's reasons for applying and the scope of their authority match the job requirements.

[0127] The direct supervisor needs to review the applicant's reasons for requesting access to specific network resources to determine if they are reasonable and genuinely necessary. They also need to confirm whether the requested access level is appropriate for the applicant's job responsibilities. For example, an employee responsible for development work may only need access to the development network and not the production network.

[0128] The review result can be "approved" or "rejected". If rejected, a detailed review opinion must be attached, explaining the reasons for the rejection, so that the applicant understands the problem and can make the corresponding modifications before resubmitting the application.

[0129] To facilitate reviewers' work anytime, anywhere, the system supports approval operations via mobile app or web browser. This means that reviewers can log in to the system's review interface using mobile devices such as smartphones and tablets to view application details and make decisions.

[0130] After the application is approved by the direct supervisor, the IT department will conduct a second review, focusing on checking the compliance of the scope of permissions and the reasonableness of the validity period.

[0131] The IT department needs to thoroughly review whether the permissions specified in the application align with the company's overall security policy. For example, certain sensitive network resources (such as production environments) may have stricter access restrictions, allowing only specially authorized personnel to access them. Furthermore, the IT department needs to verify the reasonableness of the application's validity period settings, typically with a minimum (e.g., 7 days) and a maximum (e.g., 500 days) to ensure that there are no excessively long or unreasonable validity period settings.

[0132] Based on the above checks, the IT department will ultimately decide whether to approve the application. If any non-compliance is found, the application can be rejected, and detailed feedback will be provided.

[0133] Through these two stages of review, enterprises can effectively control the issuance of VPN accounts, ensuring that each account meets actual business needs while also adhering to the company's security standards. This two-tiered review mechanism not only improves management efficiency but also enhances the security and transparency of the entire process.

[0134] According to one embodiment of this application, the step of calling the Python API interface to map the parameters in the approval form to OpenVPN configuration parameters includes:

[0135] The Python API uses JWT token authentication, allowing only administrators to access it, thus ensuring the security of API calls.

[0136] The interface design is based on the Flask framework to implement a RESTful architecture and receives parameters in JSON format.

[0137] The mapping relationship between the parameters in the approval form and the OpenVPN configuration parameters includes:

[0138] Applicant's name and OpenVPN username, validity period and certificate validity period, manually entered password and OpenVPN account password, permission level and permission rules in the OpenVPN configuration directory.

[0139] As described above, after reviewing the VPN account application information submitted by the applicant, the system generates an approval form containing complete configuration information. Subsequently, the system calls a Python-based API to convert the information in the approval form into the configuration parameters required by the OpenVPN service. This API is designed and implemented with robust security and scalability, ensuring the stability and controllability of the entire parameter conversion process.

[0140] This API uses a JWT (JSON Web Token) authentication mechanism, ensuring that only users with administrator privileges can successfully call the interface. This authentication method not only enhances the security of API calls but also effectively prevents unauthorized access and operations. Furthermore, the interface is developed based on the Flask framework, employs a RESTful interface design, and can receive and process parameters transmitted in JSON format, offering excellent compatibility and ease of use.

[0141] During the API call, the various fields in the approval form are mapped one by one to the parameters required for OpenVPN configuration. Specifically, the mapping relationships include the following aspects:

[0142] Applicant's Name → OpenVPN Username: The system associates the applicant's name with the enterprise AD account and extracts the username portion as the login username in the OpenVPN service, ensuring the uniqueness and identifiability of the username.

[0143] Validity Period → Certificate Validity Period: The account validity period information filled in the approval form will be converted into a number of days and passed to the certificate generation module as the certificate validity period to control the usage period of the client certificate.

[0144] Manually enter your password → OpenVPN account password: If the applicant manually entered their password when submitting the application, this password will be retained and used to set the access password for their OpenVPN account. The system will validate the password to ensure it meets security complexity requirements.

[0145] Permission Level → Permission Rules in OpenVPN Configuration Directory: Based on the permission level selected by the applicant (such as development network, test network, production network, etc.), the system will generate corresponding permission control rules in the OpenVPN configuration directory (usually the ccd directory) to restrict users to accessing only the network resources they are authorized to access.

[0146] Through the aforementioned interface calls and parameter mapping process, the system can automatically convert business data in the approval process into configuration information that OpenVPN service can recognize and use, achieving a seamless connection from approval to configuration and significantly improving the automation and efficiency of account opening.

[0147] According to one embodiment of this application, the step of generating a client certificate and private key based on the EasyRSA component, and completing certificate generation through non-interactive password input, includes:

[0148] The Expect tool simulates interactive command-line operations, automatically completing password input and certificate signing request processing.

[0149] The certificate validity period parameter is dynamically passed to the EasyRSA component, and the certificate validity period is dynamically controlled by the validity period field in the approval form.

[0150] Special characters in passwords are escaped to prevent command injection risks;

[0151] If the applicant does not manually enter a password, a random password with the required complexity will be automatically generated.

[0152] As described above, without manual intervention, the client certificate and its corresponding private key are automatically generated based on the open-source toolset EasyRSA, and the certificate signing and storage operations are completed. The entire process is controlled by automated scripts, avoiding the interactive behaviors required by users to manually enter passwords and confirm in traditional command-line operations, thus achieving an efficient and secure certificate generation process.

[0153] The specific implementation method is as follows:

[0154] In the traditional EasyRSA certificate generation process, users typically need to manually enter passwords and confirm actions in the command-line interface. To automate this process, the system introduces the Expect tool, which can simulate user input behavior in the command line and automatically complete interactive steps such as password entry and confirmation, thereby achieving a non-interactive, fully automated certificate generation process.

[0155] The certificate's validity period is determined by the "Validity Period" field in the approval form submitted by the applicant. When the system calls EasyRSA to generate the certificate, it dynamically passes the value of this field as a parameter to the certificate generation command, ensuring that the validity period of the generated certificate matches the application information. For example, if the validity period filled in the approval form is 60 days, the generated certificate will automatically expire after 60 days, requiring no further manual management.

[0156] During the automated certificate generation process, if the applicant provides a password, this password may contain special characters (such as "!", "@", "$", etc.). These characters may be mistakenly interpreted as part of a command in a command-line environment, leading to execution errors or security risks. To prevent such problems, the system escapes special characters in the password, ensuring it is correctly recognized and used as plain text, thus avoiding security risks such as command injection.

[0157] If the applicant does not manually enter a password when submitting the application, the system will automatically generate a strong password according to preset password complexity rules. This password typically includes uppercase and lowercase letters, numbers, and special characters, and meets the minimum length requirement (e.g., at least 8 characters). The generated password will be securely transmitted to the certificate generation process and used to protect the generated client certificate, ensuring its security.

[0158] Using the aforementioned technical methods, the system can securely and efficiently generate OpenVPN client certificates and private keys without manual intervention, providing a fundamental guarantee for subsequent permission configuration and information transmission. This method not only improves the efficiency of certificate generation but also enhances the security and controllability of the entire process.

[0159] According to one embodiment of this application, the step of dynamically updating the permission rules in the OpenVPN configuration directory according to the permission level and allocating a primary IP address and a backup IP address from a preset IP address pool includes:

[0160] Dynamically update the permission rules in the OpenVPN client configuration directory based on the permission level in the approval form;

[0161] Permission rules include IP address binding, routing policies, and access control lists;

[0162] Extract the primary IP address from the preset IP address pool and generate a backup IP address using regular expression replacement rules;

[0163] Allocated IP addresses are marked in the IP address pool to prevent duplicate allocation;

[0164] Backup IP addresses are generated using the primary IP address replacement rules, supporting a dual IP redundancy mechanism.

[0165] As mentioned above, after generating the client certificate, how does the system automatically configure the applicant's access permissions in the OpenVPN environment based on the permission level selected by the applicant, and assign primary and backup IP addresses to ensure the stability and security of the network connection?

[0166] The specific implementation is as follows:

[0167] The approval form submitted by the applicant includes a "permission level" field, such as development network, test network, or production network. Upon receiving this information, the system automatically generates corresponding OpenVPN client configuration rules based on the permission level and updates them to the OpenVPN client configuration directory (usually the ccd directory). These rules determine which resources a user can access after connecting.

[0168] Permission rules include the following three types of information:

[0169] IP address binding: Specifies the IP address that the user will use after connecting, ensuring the uniqueness of the address in the network environment.

[0170] Routing policy: Defines the range of subnets that a user can access after connecting, such as whether access to specific network segments of the development, testing, or production environments is allowed.

[0171] Access Control Lists (ACLs): Set the user's access permissions, such as whether to allow access to specific servers or SSH connections, thereby achieving fine-grained access control.

[0172] The system maintains a pre-configured pool of IP addresses containing multiple available IP addresses. After a user is approved, the system selects an unassigned IP address from this pool as the user's primary IP address, which serves as their unique identifier within the OpenVPN network.

[0173] To improve network connectivity reliability, the system also generates a backup IP address based on the primary IP address. The backup IP is generated using preset regular expression replacement rules, such as replacing the third segment of the primary IP address (e.g., if the primary IP is 172.16.181.10, the backup IP is 172.16.53.10), thus ensuring that the backup IP address is in the same network environment but does not conflict with the primary IP.

[0174] After allocating the primary and backup IP addresses, the system marks these two addresses as "allocated" in the IP address pool to prevent other users from being assigned the same address repeatedly in subsequent applications, thus ensuring the uniqueness of the address and the stability of the network.

[0175] The introduction of backup IP addresses allows users to automatically or manually switch to a backup IP address and continue accessing target network resources when the primary IP address fails or becomes unavailable. This dual IP redundancy mechanism effectively improves network connectivity availability and reduces the risk of outages caused by IP conflicts or network failures.

[0176] According to one embodiment of this application, sending VPN information composed of the certificate, authorization rules, primary IP rules, and backup IP rules to the applicant includes:

[0177] The email content includes the applicant's account information, the primary and backup IP addresses bound to the application, the certificate download link, and installation instructions;

[0178] The email content is dynamically generated using formatted strings and supports multi-language template adaptation.

[0179] The email attachment contains the client certificate, configuration file, and installation guide;

[0180] The attachment file name is generated based on the applicant's name and timestamp to ensure uniqueness.

[0181] As mentioned above, after generating the OpenVPN account configuration information, how does the system integrate all relevant data into a complete VPN information package and send it to the applicant via email to ensure that they can successfully configure and use the newly generated account?

[0182] The specific implementation is as follows:

[0183] The email body includes basic information about the applicant's account, such as username, password, and account expiration date. It also includes the primary and secondary IP addresses associated with the account, ensuring the applicant understands their unique identifier on the network. Furthermore, the email provides a certificate download link for the corresponding client certificate and configuration file, along with detailed installation instructions to guide users through configuring and connecting the OpenVPN client.

[0184] To accommodate users from different regions and language backgrounds, the system employs a template-based email generation mechanism. The email body is dynamically populated using formatted strings, ensuring that each applicant receives email content consistent with their language preferences. For example, the system can automatically select email templates in Chinese, English, or other languages ​​based on the applicant's location, thereby improving user experience and communication efficiency.

[0185] The email contains several attached files, providing all the necessary information for the applicant to complete the configuration. Attachments typically include:

[0186] Client certificate files (such as .crt files) are used for authentication;

[0187] A private key file (such as a .key file) is used in conjunction with a certificate;

[0188] OpenVPN configuration files (such as .ovpn files) are used for quick import of client software;

[0189] The installation guide document provides configuration steps for different operating systems to help users complete the setup smoothly.

[0190] To avoid duplicate filenames among different users, the system names attachments using a combination of the applicant's name and the current timestamp. For example, a filename might be "zhangsan_202507201530.crt", where "zhangsan" represents the applicant's name and "202507201530" represents the current timestamp. This method ensures the uniqueness of each attachment, facilitating user identification and management.

[0191] Using the above methods, the system can automatically send complete OpenVPN account information to the applicant via email after the account configuration is completed, ensuring that the applicant can quickly and accurately complete the client configuration, thereby improving the overall account activation efficiency and user experience.

[0192] According to one embodiment of this application, it also includes anomaly handling and monitoring functions, specifically including:

[0193] When a Python API call fails, an alert is sent to the IT operations group, and the application status is marked as failed.

[0194] Adopt an exponential backoff and retry strategy;

[0195] The task status is recorded by Redis caching, and the execution results can be queried via the interface;

[0196] Integrate with Prometheus monitoring metrics to record performance data such as script execution time and the number of concurrent tasks.

[0197] As mentioned above, during the process of the system calling the Python API interface to execute OpenVPN account configuration, if the API call fails due to network interruption, incorrect parameters, interface abnormalities, or other reasons, the system will immediately trigger an alarm mechanism, sending the exception information to the communication group (such as WeChat Work, DingTalk, or email group) where the IT operations and maintenance personnel are located, so that the operations and maintenance personnel can intervene in a timely manner. At the same time, the system will mark the current application status as "failed" and display the specific reason for the failure in the user interface or management backend, facilitating subsequent troubleshooting and handling.

[0198] To improve system fault tolerance, after an API call fails, the system does not immediately give up but automatically attempts to re-execute the call operation according to a preset exponential backoff retry strategy. The basic logic of this strategy is: after the first failure, wait a short time (e.g., 10 seconds) for the first retry; if it still fails, wait a longer time (e.g., 30 seconds) for the second retry; after the third failure, the waiting time is further extended (e.g., 1 minute). This gradually increasing waiting time helps to automatically restore normal processes after temporary failures (such as brief network fluctuations), while avoiding frequent calls in a short period that could waste system resources or overload the service.

[0199] To achieve real-time tracking of task execution status, the system employs Redis caching technology to record the current status of each task, including start time, execution progress, success status, and failure reason. This caching mechanism features high concurrency access capabilities and low latency response, meeting the needs of large-scale concurrent task status queries. Furthermore, the system provides standardized query interfaces (such as / api / vpn / task / ).<task_id> This interface allows administrators or applicants to obtain task execution results in real time, improving the system's transparency and operability.

[0200] To enable visualized monitoring of the overall system operation, the system integrates the Prometheus monitoring platform. This platform allows the system to collect and display multiple key performance indicators in real time, such as average script execution time, current concurrent task count, and task success rate. These indicators help operations personnel promptly identify system bottlenecks, assess resource usage, and take proactive optimization measures when abnormal trends emerge. Furthermore, Prometheus supports setting alarm rules; when certain indicators exceed preset thresholds (e.g., task execution time exceeds 30 seconds), the system will automatically trigger alarm notifications, further improving system observability and stability.

[0201] Through the above-mentioned anomaly handling and monitoring mechanisms, the system can respond quickly and recover automatically when a fault occurs, and provide comprehensive operational status feedback, thereby effectively ensuring the continuity and reliability of the OpenVPN account automated management process.

[0202] According to one embodiment of this application, the VPN application information includes: applicant's name, corporate email address, required permissions, validity period, and password.

[0203] As mentioned above, the applicant's name refers to the full name of the company employee submitting the VPN account application. This information is used for identity verification and is linked to the company's internal Active Directory (AD) account to ensure the applicant's identity is genuine and valid. In the system, the applicant's name is typically not manually editable; instead, it is automatically filled in by the company's identity system to prevent forged or impersonated applications.

[0204] A corporate email address is the applicant's official email address used for internal company communication. This address is used to receive critical information such as approval notifications, certificate information, and configuration files sent by the system. When submitting an application, the system validates the corporate email address to ensure it conforms to standard email format and is typically managed centrally by the company to avoid using unauthorized external email addresses.

[0205] The required permissions refer to the level of network access rights the applicant desires, such as different levels of access for development, test, or production networks. This information determines the network scope and resource restrictions that users can access in the subsequently generated OpenVPN configuration. When submitting an application, the applicant must select the required permissions from the drop-down menu or options provided by the system to ensure the standardization and consistency of the permission request.

[0206] The validity period refers to the timeframe an applicant wishes for their OpenVPN account to remain valid, typically expressed in days. The system sets a minimum (e.g., 7 days) and a maximum (e.g., 500 days) validity period, and provides a default value (e.g., 30 days) to prevent excessively short or long validity periods from impacting security policies. This information is dynamically passed to the certificate configuration during subsequent client certificate generation to control the certificate's expiration date.

[0207] A password is an access credential used to protect the security of your OpenVPN account. Applicants can choose to manually enter a password that meets the required complexity, or the system can automatically generate a strong password. If the applicant manually enters a password, the system will validate the password's format, including length and character combinations, to ensure its security. If the applicant does not manually enter a password, the system will generate a random password containing uppercase and lowercase letters, numbers, and special characters according to preset rules and provide this password to the applicant in an email notification.

[0208] A second aspect of this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any of the embodiments of the first aspect above.

[0209] Figure 2 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 2 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call logical instructions in the memory 830 to execute the method in any of the embodiments of the first aspect described above, the method including:

[0210] The VPN application information submitted by the applicant is reviewed, and an approval form is generated based on the approved VPN application information;

[0211] Call the Python API interface to map the parameters in the approval form to OpenVPN configuration parameters;

[0212] The client certificate and private key are generated based on the EasyRSA component, and the certificate generation is completed through non-interactive password input.

[0213] The OpenVPN configuration directory is dynamically updated according to the permission level, and primary and backup IP addresses are allocated from the preset IP address pool.

[0214] The VPN information, consisting of the certificate, permission rules, primary IP rules, and backup IP rules, is sent to the applicant.

[0215] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0216] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program, the computer program being able to be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer being able to perform the methods provided by the above methods, the method comprising:

[0217] The VPN application information submitted by the applicant is reviewed, and an approval form is generated based on the approved VPN application information;

[0218] Call the Python API interface to map the parameters in the approval form to OpenVPN configuration parameters;

[0219] The client certificate and private key are generated based on the EasyRSA component, and the certificate generation is completed through non-interactive password input.

[0220] The OpenVPN configuration directory is dynamically updated according to the permission level, and primary and backup IP addresses are allocated from the preset IP address pool.

[0221] The VPN information, consisting of the certificate, permission rules, primary IP rules, and backup IP rules, is sent to the applicant.

[0222] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the cigarette box image recognition method provided by the methods described above, the method comprising:

[0223] The VPN application information submitted by the applicant is reviewed, and an approval form is generated based on the approved VPN application information;

[0224] Call the Python API interface to map the parameters in the approval form to OpenVPN configuration parameters;

[0225] The client certificate and private key are generated based on the EasyRSA component, and the certificate generation is completed through non-interactive password input.

[0226] The OpenVPN configuration directory is dynamically updated according to the permission level, and primary and backup IP addresses are allocated from the preset IP address pool.

[0227] The VPN information, consisting of the certificate, permission rules, primary IP rules, and backup IP rules, is sent to the applicant.

[0228] For any parts not mentioned in this application, existing technologies may be used or referenced.

[0229] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0230] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An automated OpenVPN account management method based on approval linkage, characterized in that, include: The VPN application information submitted by the applicant is reviewed, and an approval form is generated based on the approved VPN application information; Call the Python API interface to map the parameters in the approval form to OpenVPN configuration parameters; The client certificate and private key are generated based on the EasyRSA component, and the certificate generation is completed through non-interactive password input. The OpenVPN configuration directory is dynamically updated according to the permission level, and primary and backup IP addresses are allocated from the preset IP address pool. The VPN information, consisting of the certificate, permission rules, primary IP rules, and backup IP rules, is sent to the applicant.

2. The method according to claim 1, characterized in that, The review of the VPN application information submitted by the applicant includes: The applicant's direct supervisor reviews the rationale for the application and whether the scope of authority matches the job requirements. The review result is either approval or rejection. If rejected, the approval opinion must be attached. The review process can be completed on mobile devices, and reviewers can perform the approval process through a mobile app or web page. The IT department reviews the compliance of the scope of authority and the reasonableness of the validity period.

3. The method according to claim 1, characterized in that, The process of calling the Python API interface to map parameters in the approval form to OpenVPN configuration parameters includes: The Python API uses JWT token authentication, allowing only administrators to access it, thus ensuring the security of API calls. The interface design is based on the Flask framework to implement a RESTful architecture and receives parameters in JSON format. The mapping relationship between the parameters in the approval form and the OpenVPN configuration parameters includes: Applicant's name and OpenVPN username, validity period and certificate validity period, manually entered password and OpenVPN account password, permission level and permission rules in the OpenVPN configuration directory.

4. The method according to claim 1, characterized in that, The process of generating client certificates and private keys based on the EasyRSA component, and completing certificate generation through non-interactive password input, includes: The Expect tool simulates interactive command-line operations, automatically completing password input and certificate signing request processing. The certificate validity period parameter is dynamically passed to the EasyRSA component, and the certificate validity period is dynamically controlled by the validity period field in the approval form. Special characters in passwords are escaped to prevent command injection risks; If the applicant does not manually enter a password, a random password with the required complexity will be automatically generated.

5. The method according to claim 1, characterized in that, The step of dynamically updating the permission rules in the OpenVPN configuration directory according to the permission level and allocating primary and backup IP addresses from the preset IP address pool includes: Dynamically update the permission rules in the OpenVPN client configuration directory based on the permission level in the approval form; Permission rules include IP address binding, routing policies, and access control lists; Extract the primary IP address from the preset IP address pool and generate a backup IP address using regular expression replacement rules; Allocated IP addresses are marked in the IP address pool to prevent duplicate allocation; Backup IP addresses are generated using the primary IP address replacement rules, supporting a dual IP redundancy mechanism.

6. The method according to claim 1, characterized in that, The process of sending VPN information, consisting of certificates, authorization rules, primary IP rules, and backup IP rules, to the applicant includes: The email content includes the applicant's account information, the primary and backup IP addresses bound to the application, the certificate download link, and installation instructions; The email content is dynamically generated using formatted strings and supports multi-language template adaptation. The email attachment contains the client certificate, configuration file, and installation guide; The attachment file name is generated based on the applicant's name and timestamp to ensure uniqueness.

7. The method according to claim 1, characterized in that, It also includes anomaly handling and monitoring functions, specifically including: When a Python API call fails, an alert is sent to the IT operations group, and the application status is marked as failed. Adopt an exponential backoff and retry strategy; The task status is recorded by Redis caching, and the execution results can be queried via the interface; Integrate with Prometheus monitoring metrics to record performance data such as script execution time and the number of concurrent tasks.

8. The method according to claim 1, characterized in that, The VPN application information includes: applicant's name, corporate email address, required permissions, validity period, and password.

9. A computer-readable storage medium having a program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1-8.

10. An electronic device comprising a memory, a processor, and a program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1-8.

Images