Equipment security management and access control method in airship platform OMC system

Abstract

The invention provides an equipment safety management and access control method in an airship platform OMC system, which comprises the following steps that: a related safety management module is arranged in the airship platform OMC system, and the safety management module is used for carrying out safety management and access control on managed equipment in the airship platform OMC system; wherein the security management module adopts a role-based right control RBAC framework to perform security management on managed equipment, and performs access control through a multi-dimensional security access control mechanism.

Description

Technical Field

[0001] This invention relates to the field of security management technology, and more specifically, to a method for equipment security management and access control in an airship platform OMC system. Background Technology

[0002] High Altitude Platform Station (HAPS) airships, as an emerging communication and detection platform, demonstrate enormous potential in long-distance communication, environmental monitoring, and homeland security by carrying various payloads such as terahertz communication, remote sensing, and navigation enhancement. The Airship Platform Operations and Maintenance Center (OMC) system is the core for the unified management, monitoring, and scheduling of these payloads; its security directly affects the stable operation of the entire platform and the success or failure of missions.

[0003] In the field of access control, existing OMC systems or similar network management systems have widely studied attribute-based access control (ABAC) models due to their high flexibility. ABAC makes authorization decisions by dynamically evaluating multiple attributes such as users, resources, operations, and environment. However, directly applying the ABAC model to scenarios like airship platform OMC systems, which are centered on device management and have high requirements for real-time performance and management simplicity, presents significant limitations. First, the complexity and management overhead of ABAC model policies are enormous. To achieve fine-grained control over different users managing different specific devices, a large number of fine-grained policy rules need to be defined and maintained, such as allowing access only if "user department = Operations and Maintenance Unit 1, device type = optical payload, and device location = area A". As the number of devices, user roles, and business scenarios grow, the policy set becomes exceptionally large and complex, leading to policy conflicts, performance bottlenecks, and management difficulties, which contradicts the goal of efficient and clear operation and maintenance in OMC systems. Second, ABAC faces performance and real-time challenges in specific scenarios. Its dynamic evaluation process requires the collection and calculation of multiple attributes with each access request. In high-frequency operation scenarios such as device status query and configuration distribution in the OMC system of the airship platform, this may introduce a significant performance overhead and affect the real-time performance of the system. Summary of the Invention

[0004] In view of this, the present invention proposes a device security management and access control method in the OMC system of an airship platform to solve the problems existing in the prior art.

[0005] To achieve the above objectives, this invention proposes a method for device security management and access control in an airship platform OMC system, including: A relevant security management module is set in the airship platform OMC system. The security management module is used to perform security management and access control on the managed devices in the airship platform OMC system. The security management module employs a role-based access control (RBAC) framework to manage the security of the managed devices and uses a multi-dimensional security access control mechanism for access control.

[0006] Optionally, the role-based access control (RBAC) framework includes binding relationships between users and resources, users and roles, and roles and operation permissions, and performs security management through the above binding relationships.

[0007] Optionally, the process of implementing the binding relationship includes: Create role information and user accounts, with one role information corresponding to one role; Configure operation codes for all executable operations within the OMC system, and associate these operation codes with pre-established role information to form a role-operation permission set; The managed devices on the airship platform are registered as system resources, and each device is assigned a globally unique device identifier to associate the device identifier with the system resource. Associating a user account with one or more role information allows the user to inherit the set of operation permissions of the role; Bind user accounts to the system resources of different managed devices to limit the range of device resources that users can access; The final operation permissions of a user account are the Cartesian product of the set of operation permissions of all associated roles and the resource range of the corresponding bound device.

[0008] Optionally, during security management, a role-based access control (RBAC) framework is used for security authentication to manage the managed devices. The security authentication process includes: User login is enabled via user account. Identity authentication is performed during user login, and a secure session is established after successful verification. In a secure session, when a user account initiates an operation request, the operation permission is first authenticated to verify whether the role information associated with the current user account contains the operation code corresponding to the operation request. When the corresponding operation code is included, resource permission authentication is performed after the operation permission authentication is passed. This verifies whether the target device identifier of the operation request is within the resource range of the device currently bound to the user. When the target device identifier is within the resource range of the device currently bound to the user, the resource permission authentication is passed. The operation request is only allowed to be executed if both operation permission authentication and resource permission authentication are successful.

[0009] Optionally, the multi-dimensional security access control mechanism is used for security access control of system access security, software version security, network security and anti-virus, anti-attack, data security and security logs and security auditing.

[0010] Optionally, the secure access control for data security includes data access security, data storage security, and data transmission security; wherein, the data access security is implemented through row-level permission control, wherein the row-level permission control automatically attaches filtering conditions based on the list of authorized device resources of the current user when generating data query statements, so that the user can only access device data within his / her permission scope.

[0011] Optionally, the access control at the software version security layer includes: Digitally sign the software distribution package of the OMC system itself, and verify its signature and integrity during deployment or upgrade. Deployment or upgrade is carried out after verification. For firmware upgrade packages of managed devices in the OMC system of the airship platform, hash verification and digital signature verification are performed on the managed devices. If the verification is successful, the installation can proceed.

[0012] Optionally, the access control at the network security layer includes: In the OMC system, access to the web management interface is forcibly encrypted using the HTTPS protocol; An IPSec VPN or an encrypted tunnel based on two-way TLS authentication is established between the OMC server and the management agent on the airship platform for communication; the OMC server is used to host the OMC system. Deploy the OMC server behind a firewall and configure firewall policies to only open the necessary service ports.

[0013] Optionally, the access control at the security log and security audit level includes: In the OMC system, a unified log service component records security logs containing log ID, time, user ID, operation module, operation action, operation details, and operation results when users log in, log out, and perform critical operations. It also provides security log query, statistics, and reports.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: Compared to the ABAC model, which requires maintaining a large number of fine-grained policy rules, this invention uses a combined authorization model of "role-based operation binding and user-based resource binding" to deconstruct the core elements of permission management into four intuitive entities: role, operation, user, and resource. System administrators do not need to write complex attribute policy rules; they can achieve fine-grained permission control at the device instance level simply by intuitively selecting and binding operations through a graphical interface. This entity-based authorization method greatly simplifies the maintenance of the permission model, reduces management overhead, and avoids the policy conflicts and rule bloat problems common in the ABAC model.

[0015] This invention pre-calculates and stores user permissions through a pre-binding method. When a user initiates an operation request, the system only needs to execute an efficient two-level authentication process—operation permission authentication and resource permission authentication. This matching query based on predefined relationships significantly reduces the computational overhead in the permission determination process compared to the ABAC model, which requires dynamically collecting and calculating multiple attributes for each request. This design is particularly suitable for the management scenarios of high-frequency device operations in the OMC system of airship platforms, ensuring that the system maintains excellent real-time response performance even under high concurrency access.

[0016] The permission system established by this invention naturally provides clear visualization capabilities. Administrators can directly view the complete binding relationship between "users, roles, and resources," quickly answering key operational questions such as "which devices can a user manage?" and "which users can manage a device?" This entity-relationship-based permission view overcomes the "black box" effect caused by hiding permission logic in complex policy rules in the ABAC model, greatly improving the transparency and understandability of system permission management, and facilitating daily operation, maintenance, and auditing.

[0017] This invention organically combines granular access control with multiple security layers, including system access security, software version security, network security, and data security, forming a defense-in-depth architecture. Particularly in the data security layer, by automatically attaching SQL filtering conditions based on the user-authorized device list, it achieves natural row-level data isolation at the database level. This access control implemented at the data source is more efficient and secure than control implemented through complex strategies at the application layer, providing reliable protection for special application scenarios like airship platforms where equipment value is high and security requirements are stringent. Attached Figure Description

[0018] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. In the drawings: Figure 1This is a schematic diagram of a role-based RBAC security management framework in an embodiment of the present invention; Figure 2 This is a schematic diagram of the internal architecture of the security management component in an embodiment of the present invention; Figure 3 This is a schematic diagram of the overall method flow in an embodiment of the present invention. Detailed Implementation

[0019] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the disclosure to those skilled in the art. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] This embodiment proposes a method for device security management and access control in the OMC system of an airship platform, such as... Figure 3 As shown, it includes: A relevant security management module is set up in the airship platform OMC system to perform security management and access control on the managed devices in the airship platform OMC system.

[0021] Security management is achieved through a security management module that manages roles, operation codes, accounts, and system login. Role management governs system roles, supporting the creation, deletion, modification, and querying of roles, as well as the allocation of resources and operation permissions. Operation code management defines and queries various operation codes, ensuring the legality and security of operations. Account management governs system user accounts, supporting the creation, deletion, modification, and querying of accounts, role assignment, password management, and status settings. System login management manages user login and authentication, ensuring that only authorized users can access the system.

[0022] The architecture and logic of its security management module's security management components are shown below: Security Management Framework: Security management employs a Role-Based Access Control (RBAC) framework, further improved by incorporating Operation and Resource Authorization (OMC) methods. In the traditional RBAC model, operations and resources are bound to roles; possessing a specific role grants access to the corresponding resources. For users, simply assigning the appropriate role is sufficient. This access control model is characterized by simple authorization and authentication. However, it also has limitations, such as the inability to authorize different resources for users with the same role.

[0023] In the OMC system, the initial consideration is to adopt a combined authorization model of role-based operation binding and user-based resource binding to complete the access control function, based on the RBAC model. Its role-based RBAC security management framework is as follows: Figure 1 As shown.

[0024] Component architecture: The internal architecture of the security management component is as follows: Figure 2 As shown, it specifically includes a security management view GUI sub-component, a security management processor, user management, role management, security authorization, security authentication, operation management, and encryption / decryption services. The security management view GUI sub-component is used to display and operate user management, role management, security authorization, security authentication, and operation management. The security management processor is used to implement different functions through key business logic. User management, role management, security authorization, security authentication, operation management, and encryption / decryption services are all further interactive components of the relevant security management view GUI sub-components. Users can perform further clicks, selections, deselections, or removals through these interactive components on the security management view GUI sub-components. The background security management processor handles these operations to complete the various tasks.

[0025] Key business logic: 1. Management of roles, users, operations, and resources In the security management subsystem, roles, users, operations, and resources are the basic elements. The definition of these elements and the setting of their interrelationships constitute the security authorization process. The management of these elements includes basic operations such as adding, deleting, querying, and modifying data, as well as establishing and dissolving relationships.

[0026] 2. User / Role Authorization Logic User / role authorization is essentially a process of binding relationships between roles and operations, users and resources, and users and roles. The binding of roles and operations determines the set of operations a role can perform; the binding of users and roles determines the set of operations a user can perform. Since a user may have multiple roles, this means a user has multiple sets of operations corresponding to those roles; the binding of users and resources determines the range of resource instances a user can access. Combined with role relationships, this ultimately determines which resources a user has which operational permissions.

[0027] 3. User authentication logic User authentication is essentially a process of determining whether a user has the right to perform certain operations on a specific resource / resource. It involves comparing the user, resource, and operation against existing authorization criteria. If the authorization requirements are met, authentication succeeds; otherwise, it fails.

[0028] The key business logic described above is described in detail as follows: First, the system administrator needs to define all possible operations within the system in the operation code management interface, such as "delete device," "issue configuration," and "confirm alarm." Each operation is assigned a unique operation code and persistently stored in the system operation definition table. Subsequently, in the role management interface, the administrator can create roles such as "system administrator" and "regional operations and maintenance personnel," and assign the aforementioned set of operation codes to these roles by checking boxes. This establishes the hierarchical relationship between roles and operation codes. When a role is active, the corresponding operation code can be used to complete related tasks, thus determining the inherent operational capabilities of each role. Role information and its association with operation codes are recorded in the system role table and the role-operation association table, respectively.

[0029] After modeling roles and operational permissions, administrators move on to user and resource management. In the account management interface, user accounts are created for each operations and maintenance personnel. Their usernames, passwords processed with encryption algorithms, and other basic information are stored in the system's user table. Appropriate roles are assigned to each user, establishing the hierarchical relationship between users and roles. Simultaneously, various payload devices on the airship platform are registered in the system through the device management module. Each device receives a globally unique device identifier, becoming a managed resource entity within the system. Finally, and crucially, in achieving granularity, administrators bind specific device resources to specific user accounts through a dedicated authorization interface. This user-role-resource binding relationship is recorded in a dedicated association table, thus precisely defining the scope of devices each user can manage.

[0030] Once the basic configuration is complete and the system enters daily operation, every user action triggers a real-time authentication process in the background. This process is the execution engine of the permission system. First, when a user logs into the system, the identity authentication module verifies whether the password information provided matches the encrypted password stored in the system's user table. Only users who pass the verification can establish a session and enter the system. Afterward, when a user attempts to perform any operation, such as clicking "Issue Command" in the configuration management interface, the system immediately initiates operation permission authentication. This process determines whether the user has the permission to execute the target operation by querying their associated roles and operation code set based on their current identity. If the user's role does not contain this operation permission, the process immediately terminates and returns a "Permission Insufficient" message to the user.

[0031] After operation permission authentication is successful, the system will further initiate resource permission authentication, which is the final checkpoint to prevent unauthorized access to the device. The system will obtain the target device identifier for the current operation and query the user's authorized resource list. Only if the target device is indeed within the user's authorized resource list will the system ultimately allow the operation command to be issued to the device for execution. This design of separating and sequentially executing "operation permission authentication" and "resource permission authentication" ensures the rigor of permission determination.

[0032] Regardless of the success or failure of the operation, the system will fully record the access behavior in the security log table. The log content covers key information such as the operator, time, module, action, target device, and execution result, thus forming an immutable audit trail chain. System administrators can periodically review these security logs to monitor the system's security status, troubleshoot faults, or trace security incidents, thereby forming a complete security management closed loop from permission configuration and real-time control to post-event auditing.

[0033] Access control is implemented through a security management module, which uses a system security access control mechanism. This mechanism ensures system access security, software version security, network security, anti-virus protection, attack prevention, data security, and security logging and auditing. The access control content includes the following: 1. System access security Through the OMC security management module, a role-based security access control mechanism is established. Each system user has a corresponding role, and authorization and authentication of resources and operations are performed based on these roles. When a system user accesses the system, they need to provide a valid user ID and password. Only users whose credentials are verified by the system can log in, access resources and data within their authorized scope, and perform authorized operations. System user logins, logouts, and all operations performed after entering the system are all recorded in relevant security logs for post-event auditing and verification.

[0034] 2. Software version security The release, installation, and upgrade processes of the OMC system all require verification of the version's legitimacy to ensure that the software version is safe and reliable.

[0035] 3. Network security and antivirus / attack protection During the operation of the OMC system, network security access mechanisms need to be considered, such as encrypted transmission, TSL, IPSec, and VPN. In addition, the OMC system operating environment should have necessary antivirus and anti-malware software installed and deployed to prevent virus attacks and illegal assaults, ensuring the stable and secure operation of the system.

[0036] 4. Data security Data security access is ensured by the system security access mechanism described above, allowing system users to access only authorized data and preventing unauthorized access to OMC data. For the OMC system, various management data are closely linked to devices, and access permissions for different user roles can be controlled through access authorization for different devices.

[0037] For secure data storage, critical management data needs to be backed up regularly, and off-site backups and encrypted storage should be performed when necessary to ensure data storage security.

[0038] For secure data transmission, OMC uses necessary encryption technologies to encrypt critical data (such as password information, device identity information, and key configuration command information) during transmission to prevent unauthorized acquisition or tampering.

[0039] 5. Security Logs and Security Audits The OMC system must record detailed security logs for user login, logout, and critical add, delete, query, and modify operations for subsequent security audits. The contents of the security logs are shown in Table 1.

[0040] Table 1

[0041] Explanation of the security log fields in the table above: Core identifier fields: LOGID: Uniquely identifies each security log record; LOGTITLE: A title that briefly describes the log content.

[0042] Time information: LOGTIME: Records the specific timestamp of a security event, and an index is created to facilitate querying and analysis.

[0043] User identity information: USERID: The unique identifier of the user performing the operation; USERNAME: The name of the user performing the operation.

[0044] Operation behavior information: OPMODULE: Records the functional module where the operation occurred (e.g., device management, configuration management, alarm management, etc.); OPACTION: Records the specific operation actions (e.g., login, deletion, modification, query, etc.); OPINFO: Records the specific content and parameters of the operation in detail.

[0045] Operation result status: OPRET: Explicitly records the operation execution result status: 0: Success, 1: Failure, 2: Unknown; Additional information: REMARK: Other notes that need to be explained.

[0046] Security logs are primarily used to record: system user logins, logouts, and all operations performed after logging into the system are logged for post-event auditing and review. Specifically, this includes: user login / logout behavior, addition, deletion, and modification of critical data, permission changes, system configuration changes, and other important security-related operations. These security logs provide the system with complete operational auditing and tracing capabilities, meeting security compliance requirements. The access control measures described above are described in detail below: At the system access security level, implementation begins with strict identity authentication. When a user attempts to log in, their submitted password credentials undergo one-way hashing and salting, and are compared with the encrypted data stored in the database to ensure the security and reliability of the verification process. Upon successful authentication, the system establishes a secure session context for the user, which persists throughout the user's entire operation cycle. For the front-end interface, the system dynamically renders visible menu items and operable function buttons based on the user's assigned role, preventing the exposure of unauthorized functions from the source of human-computer interaction. At the more critical back-end business logic layer, the system automatically filters each type of business request through pre-defined interceptors. For example, when a user initiates a device configuration command, the interceptor first extracts the user's identity from the session, then queries the set of operation permissions associated with their role to verify whether the operation is permitted. After the operation permission verification is successful, the system further checks whether the specific device identifier to which the operation points is within the resource list explicitly authorized by the user. Only when both levels of authentication pass successfully will the business request be delivered to the corresponding service component for execution. Failure at any stage will result in the immediate termination of the operation and the generation of an alarm log.

[0047] At the software version security level, this invention ensures the trustworthiness of the operating environment through digital signatures and integrity verification mechanisms. For the OMC system's own software distribution packages, the issuer's private key is used for digital signature during the build phase. During deployment or upgrades, the system installer first uses a pre-set public key to verify the legality of the package signature and calculates its hash value to ensure that the content has not been tampered with during transmission, thus achieving end-to-end trusted distribution. For managed devices on the airship platform, the over-the-air firmware upgrade process also incorporates security mechanisms. After downloading the firmware package from the OMC server, the device does not install it immediately but first performs hash verification and digital signature verification on the local machine. Only firmware versions that have passed complete trusted verification are allowed to be written to the device's storage area, thus constructing a robust software supply chain security defense line.

[0048] In terms of network security and protection, this invention employs a strategy combining channel encryption and perimeter protection. All traffic accessing the OMC web management interface via a browser is forcibly encrypted using HTTPS with an SSL / TLS certificate issued by a trusted certificate authority, ensuring the confidentiality and integrity of management commands and status data during transmission. For communication between the OMC server and the management agent located on the airship platform, a secure tunnel is established using IPSec VPN or two-way TLS authentication based on X.509 certificates, depending on the actual network conditions, to encrypt and transmit management data over untrusted public networks or wireless links. In terms of system deployment architecture, the OMC server is placed behind a firewall, and the firewall policy is strictly configured to open only necessary service ports to specific management terminals, thereby minimizing the network attack surface. Simultaneously, at the server operating system level, enterprise-grade antivirus software is installed and runs, configured to perform regular virus definition updates and full system scans, proactively defending against malware attacks.

[0049] At the data security level, protection measures cover the entire data lifecycle. For data access security, its implementation relies heavily on the system's access security mechanisms. All data query operations automatically embed filtering conditions based on the current user's authorized scope when generating the final SQL statement. For example, when querying performance data, the system automatically adds constraints such as `WHERE device_dn IN (user authorized list)`, achieving precise row-level access control from the data source. For data storage security, the system employs differentiated encryption strategies for different types of sensitive information. User passwords are stored after being processed by a strong hash algorithm, while certain configuration information that needs to be restored is encrypted and written to disk using symmetric encryption algorithms such as AES. In addition, the system has established regular automated data backup tasks, backing up the core database and configuration files to physically isolated off-site storage media. Regarding data transmission security, its protection mainly relies on the aforementioned network layer encryption channels such as HTTPS and VPN to ensure data security during transmission.

[0050] At the security log and audit level, this invention constructs a complete traceability system. The system embeds log collection points into all critical business operation nodes through a unified log service component. When an operation occurs, key information such as operation time, executing user, target device, action type, request parameters, and final result is automatically and instantly encapsulated into a structured record and persisted to the security log database table. To transform these massive logs into effective security insights, the system provides a powerful log management interface. Authorized users (such as auditors) can use this interface to perform multi-dimensional, combined conditional searches, such as quickly locating all operations of a specific user within a certain time window, or statistically analyzing failed login attempts within a period of time. The system also supports the periodic generation of standardized security audit reports and allows export for offline in-depth analysis, thus meeting the rigid requirements of operational compliance and security incident investigation. All these security log records are themselves considered highly sensitive data, with strictly limited access permissions to prevent malicious tampering or deletion, ensuring the integrity and reliability of audit trails.

[0051] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for device security management and access control in an airship platform OMC system, characterized in that, The method comprises the following steps: A security management module is arranged in the airship platform OMC system, and the security management module is used for security management and access control of the managed devices in the airship platform OMC system. The security management module adopts a role-based permission control (RBAC) framework to perform security management on the managed devices, and a multi-dimensional security access control mechanism is used for access control.

2. The method of claim 1, wherein: The role-based permission control (RBAC) framework includes users and resources, binding relationships between users and roles, roles and operation permissions, and security management is performed through the binding relationships.

3. The method of claim 2, wherein: The implementation process of the binding relationship comprises: Role information and user accounts are constructed, and one role information corresponds to one role; Operation codes of all executable operations in the OMC system are set, and the operation codes are associated with pre-established role information to form a role-operation permission set; The managed devices on the airship platform are registered as system resources, and each device is assigned a globally unique device identification number to associate the device identification number with the system resources; User accounts are associated with one or more role information to enable users to inherit the operation permission set of the roles; User accounts are bound to system resources of different managed devices to limit the range of device resources that users can access; The final operation permission of the user account is the Cartesian product of the operation permission set of all corresponding roles and the device resource range corresponding to the bound devices.

4. The method of claim 3, wherein: In the security management process, security authentication is performed through the role-based permission control (RBAC) framework to perform security management on the managed devices, and the security authentication process comprises: User login is performed through a user account, identity authentication is performed when the user logs in, and a secure session is established after verification; In the secure session, when the user account initiates an operation request, operation permission authentication is first performed to verify whether the role information associated with the user account contains the operation code corresponding to the operation request; If the corresponding operation code is included, the operation permission authentication is passed, and resource permission authentication is performed to verify whether the target device identification number of the operation request is located within the device resource range bound by the current user, and the resource permission authentication is passed when the target device identification number is located within the device resource range bound by the current user; Only when both the operation permission authentication and the resource permission authentication are passed, the operation request is allowed to be executed.

5. The method of claim 1, wherein: The multi-dimensional security access control mechanism is used for security access control of system access security, software version security, network security, and anti-virus, anti-attack, data security, and security log and security audit.

6. The method of claim 5, wherein: In the secure access control of the data security, the data access security, the data storage security and the data transmission security are included; the data access security is realized by the row-level permission control, the row-level permission control is automatically appending the filter condition based on the device resource list authorized to the current user when generating the data query statement, so that the user can only access the device data within the permission range.

7. The method of claim 5, wherein, the access control of the software version security layer includes: the software release package of the OMC system is digitally signed, and the signature and the integrity are verified when deploying or upgrading, and the deployment or upgrade is performed after the verification is completed; the firmware upgrade package of the managed device of the OMC system in the airship platform is subjected to hash check and digital signature verification in the managed device, and the installation is performed after the verification is passed.

8. The method of claim 5, wherein, the access control of the network security layer includes: in the OMC system, the access to the Web management interface is forced to use the HTTPS protocol for encryption; between the OMC server and the management agent on the airship platform, an IPSec VPN or an encrypted tunnel based on two-way TLS authentication is established for communication; the OMC server is used to carry the OMC system; the OMC server is deployed behind the firewall, and the firewall policy is configured to only open the necessary service port.

9. The method of claim 5, wherein, the access control of the security log and security audit layer includes: in the OMC system, through a unified log service component, when the user logs in, logs out and performs a key operation, a security log containing a log ID, a time, a user ID, an operation module, an operation action, an operation detail and an operation result is recorded, and the query, statistics and report of the security log are provided.

Images