CN102075357A

CN102075357A - Multi-domain security management method for network management system

Info

Publication number: CN102075357A
Application number: CN2010106212528A
Authority: CN
Inventors: 张珏
Original assignee: Wuhan NEC Fiber Optic Communications Industry Co Ltd
Current assignee: Wuhan NEC Fiber Optic Communications Industry Co Ltd
Priority date: 2010-12-31
Filing date: 2010-12-31
Publication date: 2011-05-25
Anticipated expiration: 2030-12-31
Also published as: CN102075357B

Abstract

The invention provides a multi-domain security management method for a network management system, which comprises the following steps of: 1) creating one or more logic security management domains; 2) distributing network elements to corresponding logic security management domains; 3) creating a user group and assigning different users to the user groups; 4) creating an operating rights set; 5) specifying the rights set for the logic security management domains and establishing an association relation of the logic security management domains and the operating rights set; and 6) specifying an association relation of the one or more logic security management domains and the operating rights set for the user group, and finally establishing an association relation of the user group, the logic security management domains and the operating rights set. By the method, a problem of control in different domains by different rights in the network management system is solved, and different rights in different management domains are distributed to the users flexibly.

Description

Network management system multiple domain method for managing security

Technical field

The present invention relates to SDH (SDH (Synchronous Digital Hierarchy))/MSTP (based on the multi-service transport platform of SDH)/PTN (Packet Transport Network) transmission network, pay close attention to the Authority and Domain Based Management management of network management system, control user right flexibly, stop undelegated customer access network resource and Network Management Function.

Background technology

In recent years, along with the transmission network scale constantly enlarges, the transmission network of telecom operators had formed many producers, the situation of transmitting more and depositing.The equipment of transmission network management centralized management all kinds and each producer, real-time monitoring warning and performance, the configuration diverse network connects and is professional.Because transmission network management is centralized management, and the function of the scope of management and realization is more and more, and therefore the safety management to webmaster proposes higher requirement.User expectation provides control of authority means flexibly, for designated user is given one or more operating right.

The various types of equipment of the various producers of management in the network management system, and be distributed in different physical regions.User expectation has different administration authorities to different zones, for example there is the modification authority in the A territory, and authority is only checked in the B territory.Configure user authority and control its operation makes things convenient for the control of authority management, the fail safe that improves system so flexibly.

The prior art relevant with the present invention, its technical scheme one is as follows:

The granularity of control of authority is the territory, and binds with the physical domain of true environment, and a user's authority is at specific one or more physical domain.

By technique scheme as can be seen, there is following defective in prior art scheme one:

User right directly and the physical domain binding, may scene and exist: the user has operating right to some some network element of physical domain A, and some network element of territory B is had operating right, user right is provided with the management area and just has problems under this scene.

Technical scheme two:

The granularity of control of authority is a network element, and user's authority is provided with at each network element.

By technique scheme as can be seen, there is following defective in the prior art scheme:

It is loaded down with trivial details that user right distributes, and need carry out right assignment and control at each network element, and exist a large amount of redundant informations.

Summary of the invention

Technical problem to be solved by this invention is: a kind of network management system multiple domain method for managing security is provided, and by this method, authority control problem is divided in the branch territory in the solution network management system, distributes the different rights of different management domains flexibly to the user.

The technical solution adopted in the present invention is: network management system multiple domain method for managing security comprises:

S1) create one or more logical security management domain;

S2) distribute network element to corresponding logical security management domain;

S3) create user's group, assign different user to this user's group;

S4) creation operation authority set;

S5), set up the incidence relation of logical security management domain-operating right set to the set of logical security management domain specified right;

S6) user is organized the incidence relation of specifying one or more logical security management domains-operating right set, finally set up the incidence relation of user's group-logical security management domain-operating right set.

The logical security management domain of described step S1 is virtual domain logic, and it comprises the network element of one or more physical domain.

User's group of described step S3 comprises keeper, Systems Operator and observer.These user's groups are system default values, can also new user organize according to user's oneself requirements definition.

The operating right set of described step S4 comprises system, operates and checks authority set.

Described System Privileges collection comprises system manager's relevant operating right item, for example comprises that network element operating right item, network element check that authority items, business operations competence item, business check authority items and user's operating right item; The operating right collection comprises that network element operating right item, network element check that authority items, business operations competence item and business check authority items; Check that authority set comprises that network element checks that authority items and business check authority items.

Described network element checks that authority items comprises the operation of checking network element attribute, checking network element state, and network element operating right item comprises the operation that creates NE, deletes network element and revise network element.

The incidence relation of user's group-logical security management domain of described step S6-operating right set comprises: administrator's group-all logical security management domain-System Privileges collection, operator user's group-all logical security management domain-operating right collection, and observer user's group-all domain logics-check authority set.

Advantage of the present invention: in network management system, this method has solved the subject matter of branch territory safety, at different user, provides rights management mechanism flexibly.

At first it has solved the binding of safety and physical domain, and the scope of user management network element and physical address are without any related, and the user can assign the range of management of network element flexibly.Secondly, it has reduced the operating time of security configuration, need not carry out independent authority configuration at each network element, only uses the logical security management domain is unified configure user group and authority set, alleviates the servicing time.

Description of drawings

Fig. 1 is a key diagram of the present invention.

Fig. 2 is normal flow figure of the present invention.

Fig. 3 is authority incidence relation figure of the present invention.

Embodiment

At first create virtual logical security management domain (this territory and physical domain are not contacted directly, and the logical security management domain can be regarded the set of a group NEs as, but the network element in this set can belong to different physical domain respectively) according to user's needs; According to user's actual safety management demand, the physical NE of different physical domain is divided in this logic manage territory then; Create user's group, add the associated user to this user's group; Give different safety management authorities to the logical security management domain at last, and the contact of designated user group and logical security management domain.The user just can manage different network elements in the various different physical domain flexibly according to actual conditions like this, and different equipment is had different operating right set, satisfies the branch territory decentralized management requirement of webmaster.

The invention provides following technical scheme:

This programme mainly comprises following notion:

1. network element: true physical equipment and Virtual NE equipment.

2. physical domain: real equipment control territory, generally divide according to the region, for example all physical equipments of Wuhan City can be regarded a physical domain as.

3. logical security management domain: the virtual logical security management domain that comes out, be mainly used in user's security control, virtual Domain and physical domain are not contacted directly, and he is the set of a group NEs, the network element that can comprise different physical domain, can the flexible assignment network element in domain logic.

Example: domain logic=network element 1, network element 24 ...

4. user: real user.

5. the user organizes: one group of user's set with identity logic safety management domain and identical authority.

Example: user's group=keeper, the Systems Operator ...

The user organizes that the default administrator of having organizes, operator user's group and observer user's group or the like, and the user can also self-defined user's group.

6. authority items: the set of operating right, can dispose according to the function granularity.

Example: network element operating right item=create NE, the deletion network element is revised network element ...

7. authority set: distribute to the set of user function authority items.

Example: keeper's operating right collection=network element operating right item, the business operations competence item ...

Wherein, action-item is that system is self-defining, and action-item is the set of operation; Authority set is the set of action-item, and which action-item the user can select see the following form 1～3.

The authority items that table 1 authority set is comprised

Annotate: the authority set system default has system, operates, checks authority set etc.OAM refers to Operations, Administration and Maintenance.

The operational set that table 2 authority items is comprised

The authority key name	Operational set
		Network element operating right item	Create NE, the deletion network element is revised network element .. etc.
Network element is checked authority	Check network element attribute, check network element state .. etc.

Annotate: by system definition, the user can not be self-defined according to the function granularity for authority items.

Table 3 user organizes the incidence relation of pairing domain logic-authority set

User's group name	Domain logic: corresponding authority set
		Administrator's group	All network element domain logics: System Privileges collection
Operator user's group	All network element domain logics: operating right collection
		Observer user's group	All network element domain logics: check authority set
User Defined group 1	Domain logic A: System Privileges collection
		User Defined group 2	Domain logic A: operating right collection; Domain logic B: check authority set

Annotate: authority is user's group, domain logic, operating right collection three incidence relation at last.

This mechanism mainly comprises the steps:

S1) at first create one to a plurality of domain logics according to user's request.

S2) according to the actual requirement of user the network element of different physical domain is divided in the different domain logics then.

S3) create user's group, and assign the associated user in user's group.

S4) create different authority set or the authority set of using system acquiescence (the authority set acquiescence has the keeper, operator, observer etc.).

S5) different logical security management domains is distributed different authority set.

S6) one or more logical securities territory (containing operating right collection relation) is assigned to particular group of users.

Embodiment:

For a kind of webmaster right management method is provided, by this method, authority control problem is divided in the branch territory in the solution network management system, distributes the different rights of different management domains flexibly to the user.

Normal flow of the present invention is as follows:

Step 1: create the logical security territory.

Step 2: distribute network element to the logical security territory.

Step 3: creation operation authority set.

Step 4: virtual Domain is formulated the authority set.

Step 5: the user is specified virtual Domain and authority set.

Claims

1. network management system multiple domain method for managing security is characterized in that comprising:

S1) create one or more logical security management domain;

S3) create user's group, assign different user to this user's group;

S4) creation operation authority set;

2. method according to claim 1 is characterized in that: the logical security management domain of step S1 is virtual domain logic, and it comprises the network element of one or more physical domain.

3. method according to claim 1 is characterized in that: user's group of step S3 comprises keeper, Systems Operator and observer.

4. method according to claim 1 is characterized in that: the operating right set of step S4 comprises system, operates and checks authority set.

5. method according to claim 4 is characterized in that: the System Privileges collection comprises that network element operating right item, network element check that authority items, business operations competence item, business check authority items and user's operating right item; The operating right collection comprises that network element operating right item, network element check that authority items, business operations competence item and business check authority items; Check that authority set comprises that network element checks that authority items and business check authority items.

6. method according to claim 5 is characterized in that: network element checks that authority items comprises the operation of checking network element attribute, checking network element state, and network element operating right item comprises the operation that creates NE, deletes network element and revise network element.

7. according to claim 3 or 4 described methods, it is characterized in that: the incidence relation of user's group-logical security management domain of step S6-operating right set comprises: administrator's group-all logical security management domain-System Privileges collection, operator user organizes all logical security management domain-operating right collection, and observer user's group-all domain logics-check authority set.