CN102903029A - Domain-partitioned authorization method for cloud computing resources - Google Patents

Domain-partitioned authorization method for cloud computing resources Download PDF

Info

Publication number
CN102903029A
CN102903029A CN2012103712795A CN201210371279A CN102903029A CN 102903029 A CN102903029 A CN 102903029A CN 2012103712795 A CN2012103712795 A CN 2012103712795A CN 201210371279 A CN201210371279 A CN 201210371279A CN 102903029 A CN102903029 A CN 102903029A
Authority
CN
China
Prior art keywords
resource
operator
node
business
tree
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN2012103712795A
Other languages
Chinese (zh)
Inventor
吴涛
梅树灿
周锦煌
郝伟勇
杜桂山
李筠
张怡炘
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Guangdong Eshore Technology Co Ltd
Original Assignee
Guangdong Eshore Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Guangdong Eshore Technology Co Ltd filed Critical Guangdong Eshore Technology Co Ltd
Priority to CN2012103712795A priority Critical patent/CN102903029A/en
Publication of CN102903029A publication Critical patent/CN102903029A/en
Pending legal-status Critical Current

Links

Images

Landscapes

  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The embodiment of the invention discloses a domain-partitioned authorization method for cloud computing resources. The domain-partitioned authorization method for cloud computing resources comprises the steps of: setting the basic information of an operator; setting the authority role information of the operator; generating a resource-service authorization tree, wherein the resource-service authorization tree comprises the following resources: one or more than two business domains, and the businesses and the clusters included by the business domains; loading the resource-service authorization tree to a user interface; determining the resources chosen by a user to be the operable resources of the operator from the resource-service authorization tree; and storing the basic information of the operator, the authority role information of the operator and the operable resources of the operator in an operator table, an operator authority role table and an operator resource relationship table respectively. By the technical scheme provided by the invention, the demand of rapidly opening basic facility resource management authorities in batch of a manager aiming at one operator is met.

Description

Cloud computing resources divides the territory authorization method
Technical field
The present invention relates to the cloud computing field, relate in particular to a kind of cloud computing resources minute territory authorization method.
Background technology
The consumer can obtain service from perfect computer based Infrastructure by the Internet.This class service is called infrastructure and namely serves (IaaS, Infrastructure as a Service).IaaS is a kind of form of expression of cloud computing, and it externally provides the infosystem infrastructure such as calculating, network, storage as service.Use pattern with respect to traditional information technology resources, cloud computing mode has the advantages such as required use, elastic telescopic, dynamic migration and rapid deployment, therefore becomes one of telecom operators' development priority in recent years.
At present, commercialization infrastructure management platform all is equipped with Rights Management System in various degree, yet, existing Rights Management System can only be sorted out the infrastructure resources of same alike result, although the Vcenter such as Vmware company possesses stronger virtual and physical resource authorization function, the user of different rights need to be set respectively for each infrastructure resources (as: virtual center, cluster, main frame and virtual machine).As seen, existing Rights Management System can not satisfy in carrier class cloud resource management architecture, need to open for operating personnel's rapid batch the demand of infrastructure resources administration authority.
Summary of the invention
The embodiment of the invention provides a kind of cloud computing resources minute territory authorization method, is used for satisfying the keeper opens the infrastructure resources administration authority for operating personnel's rapid batch demand.
For solving the problems of the technologies described above, the embodiment of the invention provides following technical scheme:
First aspect present invention provides a kind of cloud computing resources minute territory authorization method, comprising:
Setting operation person's essential information, aforesaid operations person's essential information comprises: aforesaid operations person's account and password;
Set aforesaid operations person's authorization role information, wherein, above-mentioned authorization role information comprises: one or more kinds of authorization roles, and wherein, every kind of authorization role is corresponding to the operation to specific cloud computing resources;
Generate resource-service authorization tree, wherein, above-mentioned resource-service authorization tree comprises following resource: the business domains that one or two are above, and above-mentioned the business domains business and the cluster that comprise;
Loading above-mentioned resource-service authorization sets to user interface;
But the resource that the user selects is defined as aforesaid operations person's operating resource from the resource of above-mentioned loading-service authorization tree;
With aforesaid operations person's essential information, but aforesaid operations person's authorization role information and aforesaid operations person's operating resource information is stored in respectively operator's table, in operator's authorization role relation table and the operator's resources relationship table; Wherein, aforesaid operations person's authorization role relation table is associated with aforesaid operations person's table, and aforesaid operations person's resources relationship table is associated with aforesaid operations person's table.
In conjunction with first aspect, in the possible implementation of the first,
Above-mentioned generation resource-service authorization tree comprises:
In the resource table of storage, search the resource that resource type is business domains;
Above-mentioned business domains resource of searching is converted to tree node, the tabulation of spanning tree node;
The father node tabulation of newly-built sky is tabulated as current parent's node;
Tabulation travels through to the present tree node:
If the root node sign that the parent resource of the current node that traverses sign equals to preset then is labeled as the above-mentioned current node that traverses the root node that resource-service authorization is set;
If the parent resource of the current node that traverses sign is not equal to the root node sign that presets, then in above-mentioned resource table, search resource identification and equal the resource of the parent resource sign of the above-mentioned current node that traverses, the resource mark that above-mentioned resource identification is equaled the parent resource sign of the above-mentioned current node that traverses is the father node of the above-mentioned current node that traverses, and when not comprising above-mentioned resource identification equaling the resource of parent resource sign of the above-mentioned current node that traverses in current parent's node tabulation, the resource that above-mentioned resource identification is equaled the parent resource sign of the above-mentioned current node that traverses is added the tabulation of current parent's node to;
If present tree node list traversal is complete, and current parent's node tabulation be empty, then with the tabulation of current parent's node as the tabulation of present tree node, carry out the father node of above-mentioned newly-built sky and tabulate and follow-up step;
If present tree node list traversal is complete, and the tabulation of current parent's node is for empty, then:
Make up initial resource-service authorization tree according to the mark recurrence;
For each resource type in above-mentioned initial resource-service authorization tree is that the resource of business domains is added name and is called " business " and " cluster " two child nodes;
In above-mentioned resource table, search resource type and be all professional resources, the above-mentioned business that finds is equaled the child node of " business " node under the business domains of this professional parent resource sign as resource identification, for each above-mentioned business domains, in the resource business relations table of storage, obtain cluster resource sign corresponding to above-mentioned business domains, be identified at according to above-mentioned cluster resource and search corresponding cluster in the above-mentioned resource table, with the cluster that the finds child node as " cluster " node under the corresponding service territory, to generate final resource-service authorization tree, wherein, above-mentioned resource business relations table comprises the correspondence relationship information of business domains and cluster;
Above-mentioned resource-the service authorization of above-mentioned loading is set to user interface and is specially:
Using Tree control to load above-mentioned final resource-service authorization sets to user interface, and check box is set before each node selects for authorizing, wherein, above-mentioned check box is set as follows acquiescence and chooses rule: when the child node under " business " node is chosen, child node below its correspondence " cluster " is all chosen, but the user can manually revise the situation of choosing.
In conjunction with the possible implementation of the first of first aspect or first aspect, in the possible implementation of the second,
Above-mentioned essential information with aforesaid operations person, but aforesaid operations person's authorization role information and aforesaid operations person's operating resource information is stored in respectively operator table, in operator's authorization role relation table and the operator's resources relationship table after, also comprise:
If the operator successfully logins according to aforesaid operations person's account and password, then:
Generate aforesaid operations person's system view tree and service view tree;
Said system Views tree and above-mentioned service view tree are loaded on operator interface, and establish switch labels, wherein, above-mentioned switch labels is used for said system Views tree and above-mentioned service view tree are shown switching in user interface;
Wherein, above-mentioned generation aforesaid operations person's system view tree comprises:
In aforesaid operations person's resources relationship table, read the resource identification of aforesaid operations person's cluster according to aforesaid operations person's account;
In resource table, obtain the parent resource sign of above-mentioned cluster;
Obtain the father node of above-mentioned cluster according to the parent resource sign of above-mentioned cluster;
From above-mentioned resource table, obtain the parent resource sign of the father node of above-mentioned cluster, obtain successively ancestors' nodes at different levels of above-mentioned cluster, until trace back to root node;
According to the resource identification of cluster, from resource table, obtain the child node of above-mentioned cluster;
According to concerning the tectonic system Views tree between ancestors' nodes at different levels of the child node of above-mentioned cluster, above-mentioned cluster and above-mentioned cluster;
Wherein, above-mentioned generation aforesaid operations person's service view tree comprises:
In aforesaid operations person's resources relationship table, read the resource identification of aforesaid operations person's business according to aforesaid operations person's account;
In resource table, obtain the parent resource sign of above-mentioned business;
Obtain the father node of above-mentioned business according to the parent resource sign of above-mentioned business;
From above-mentioned resource table, obtain the parent resource sign of the father node of above-mentioned business, obtain successively ancestors' nodes at different levels of above-mentioned business, until trace back to root node;
According to the pass series structure service view tree between ancestors' nodes at different levels of above-mentioned business and above-mentioned business.
In conjunction with the possible implementation of the second of first aspect, in the third possible implementation, above-mentioned said system Views tree and above-mentioned service view tree is loaded on operator interface, comprise afterwards:
The resource of in said system Views tree or above-mentioned service view tree, choosing according to aforesaid operations person, and the authorization role information of aforesaid operations person in aforesaid operations person's authorization role relation table, aforesaid operations person is loaded on the aforesaid operations operator interfaces to the corresponding action button of operating right that the above-mentioned resource of choosing possesses.
In conjunction with the possible implementation of the first of first aspect or first aspect, in the 4th kind of possible implementation, said method also comprises:
If detect newly-increased cloud computing resources, then:
Obtain above-mentioned newly-increased cloud computing resources information;
Resource type according to above-mentioned newly-increased cloud computing resources, above-mentioned newly-increased cloud computing resources information is write the resource entity table of respective type, and in above-mentioned resource table and the above-mentioned resource business relations table, so that above-mentioned resource entity table, above-mentioned resource table and above-mentioned resource business relations table are upgraded.
In conjunction with the possible implementation of the first of first aspect or first aspect, in the 5th kind of possible implementation, said method also comprises:
If it is deleted to detect the current cloud computing resources that exists, then:
Resource type according to above-mentioned deleted cloud computing resources, with the resource entity table of above-mentioned deleted cloud computing resources information from respective type, and delete in above-mentioned resource table, resource business relations table and the aforesaid operations person's resources relationship table, so that above-mentioned resource entity table, above-mentioned resource table, above-mentioned resource business relations table and aforesaid operations person's resources relationship table are upgraded.
In conjunction with the possible implementation of the first of first aspect or first aspect, in the 6th kind of possible implementation, said method also comprises:
Before above-mentioned setting aforesaid operations person's the authorization role information, comprising:
From the authorization role table of storage, read authorization role;
The above-mentioned authorization role that reads is loaded on user interface;
Above-mentioned setting aforesaid operations person's authorization role information is specially:
Obtain the authorization role that the user selects from the authorization role of above-mentioned loading, the authorization role that above-mentioned user is selected from the authorization role of above-mentioned loading is set as aforesaid operations person's authorization role information.
Therefore, set up in advance the relation between physical resource (such as machine room, cluster, main frame, virtual machine etc.) and the logical resource (such as business domains, business etc.) in the embodiment of the invention, comprising the resource of physical resource and logical resource-service authorization by loading sets to the interface, select so that the keeper can manage the batch of resource in the service resources tree, satisfied the demand of opening the infrastructure resources administration authority for operating personnel's rapid batch.
Description of drawings
In order to be illustrated more clearly in the embodiment of the invention or technical scheme of the prior art, the below will do to introduce simply to the accompanying drawing of required use in embodiment or the description of the Prior Art, apparently, accompanying drawing in the following describes only is some embodiments of the present invention, for those of ordinary skills, under the prerequisite of not paying creative work, can also obtain according to these accompanying drawings other accompanying drawing.
Embodiment schematic flow sheet of cloud computing resources minute territory authorization method that Fig. 1-a provides for the embodiment of the invention;
A kind of minute territory authorisation data model schematic diagram that Fig. 1-b provides for the embodiment of the invention;
The schematic flow sheet of a kind of resource that Fig. 1-c provides for the embodiment of the invention-service authorization tree generating mode;
Showing interface figure is authorized in minute territory under a kind of scene that Fig. 1-d provides for the embodiment of the invention;
Fig. 2-a represents schematic flow sheet for the operator's login based on cloud computing resources of the present invention minute territory authorization method that the embodiment of the invention provides;
System view tree under a kind of scene that Fig. 2-b provides for the embodiment of the invention represent the form schematic diagram;
Service view tree under a kind of scene that Fig. 2-c provides for the embodiment of the invention represent the form schematic diagram;
Operation interface under a kind of scene that Fig. 2-d provides for the embodiment of the invention represents schematic diagram.
Embodiment
The embodiment of the invention provides a kind of cloud computing resources minute territory authorization method.
For so that goal of the invention of the present invention, feature, advantage can be more obvious and understandable, below in conjunction with the accompanying drawing in the embodiment of the invention, technical scheme in the embodiment of the invention is clearly and completely described, obviously, described embodiment only is the present invention's part embodiment, but not whole embodiment.Based on the embodiment among the present invention, those of ordinary skills belong to the scope of protection of the invention not making the every other embodiment that obtains under the creative work prerequisite.
The below is described a kind of cloud computing resources minute territory authorization method that the embodiment of the invention provides, and at first explanation is that in the embodiment of the invention and subsequent embodiment, the resource that occurs all refers to cloud computing resources.See also Fig. 1-a, minute territory authorization method of a kind of cloud computing resources in the embodiment of the invention comprises:
101, setting operation person's essential information;
The cloud computing resources management platform is by obtaining operator's essential information creation operation person, and wherein, operator's essential information comprises: operator's account and password.In embodiments of the present invention, the cloud computing resources management platform can be presented at user interface with operator's essential information login page, operator's essential information login page can comprise the Data Enter frame of account and password, the user further can also include but not limited to the Data Enter frames such as title, phone, mobile phone, mailbox, so that will need the operator's that creates essential information to be entered in the cloud computing resources management platform.Certainly, in actual applications, the cloud computing resources management platform also can be obtained from other shared platform or share service device operator's essential information, is not construed as limiting herein.
102, setting operation person's authorization role information;
In the embodiment of the invention, every kind of authorization role is corresponding to the operational motion (as starting, stop, moving the operational motions such as virtual machine) to specific cloud computing resources (such as physical resource, logical resource).
The cloud computing resources management platform can read one or more kinds of authorization roles from the authorization role table of storage, the authorization role that reads is loaded on user interface, for this operator selects one or more authorization role, the cloud computing resources management platform is obtained the authorization role information that the authorization role that the keeper is selected is defined as this operator to user's (being the keeper) from the authorization role that loads from the authorization role that loads.The cloud computing resources management platform can only read and the loading section authorization role from the authorization role table of storage, also can from the authorization role table of storage, read and load all authorization roles in the authorization role table, particularly, which kind of authorization role is the cloud computing resources management platform read and can set according to actual conditions from the authorization role table of storage, be not construed as limiting herein.Certainly, the cloud computing resources management platform also can be obtained by other approach operator's authorization role information, for example, can import to the cloud computing resources management platform by this operator's that will configure authorization role information, make the cloud computing resources management platform get access to this operator's authorization role information, be not construed as limiting herein.
103, generate resource-service authorization tree;
In embodiments of the present invention, can be by a plurality of virtual managements center in each machine room, a kind of particular virtual software of virtual management centre management (such as vmware, kvm and hyper-v etc.).Many same specifications in each machine room are with the physical host formation cluster of configuration with virtual management software.Can move many virtual machines on every physical host, the strategies such as the scheduling of virtual machine, migration, high availability all configure in same cluster.One or more clusters can consist of business domains, and dissimilar service application (such as mobile phone applied business territory, sector application business domains etc.) is disposed in the different business territory.Many virtual machines that move under the business domains consist of professional, the specific application system of deploying virtual machine (such as electronics bookstore, flight house keeper, liking music etc.) in business.The cloud computing resources management platform can configure different cloud computing resources for every operator, and cloud computing resources refers to the manipulable concrete object of operator, is divided into the types such as machine room, cluster, physical host, virtual machine, business domains and business.
The cloud computing resources management platform generates resource-service authorization tree, wherein, comprises following resource in resource-service authorization tree: the business domains that one or two are above, and this business domains business and the cluster that comprise.
In a kind of implementation of the embodiment of the invention, preset a minute territory authorisation data model in the cloud computing resources management platform, minute territory authorisation data model prestores the relation between many resource entity tables such as resource table, resource type relation table, machine room table, cluster table, traffic table (such as traffic table, machine room table, cluster table etc.) and table and the table.Wherein, preserve the resource identification (ID of all resources in the resource table, Identity) and the hierarchical relationship between the resource, the resource type relation table is preserved the corresponding relation of physical resource (such as machine room, cluster etc.) and logical resource, the machine room table is preserved the basic configuration information of machine room, and cluster table is preserved the basic configuration information of cluster.
Be depicted as a kind of minute territory authorisation data model that is applied to the embodiment of the invention such as Fig. 1-b.Wherein, in resource table, what id field represented is the sign of resource in resource table, resource example ID field represents ID(such as cluster resource in resource table the ID in cluster table of resource in the resource entity table of correspondence in the resource table, the ID of machine room resource in the machine room table in the resource table), the parent resource id field is used to indicate the hierarchical relationship between the resource.Illustrate, suppose that resource table is as shown in table 1:
Table 1
ID Title Describe The resource example ID Resource type ID Parent resource ID
00001 The cloud management platform Describe 1 01001 001 -1
00002 The mobile phone application domain Describe 2 02001 002 00001
00003 The flight house keeper Describe 3 03001 003 00003
Suppose that the root node that presets is designated-1, then by one of the parent resource ID of table 1 as can be known, " cloud management platform " is that the superiors' resource is (in tree-like performance, " cloud management platform " is the root node of tree), " mobile phone application domain " is that lower floor's resource of " cloud management platform " is (in tree-like performance, " mobile phone application domain " is the child node of " cloud management platform "), " flight house keeper " is lower floor's resource (in tree-like performance, " flight house keeper " is the child node of " mobile phone application domain ") of " mobile phone application domain ".
The cloud computing resources management platform generates resource-service authorization tree according to a minute territory authorisation data model that presets.Wherein, the cloud computing resources management platform generate the flow process of resource-service authorization tree can be shown in Fig. 1-c:
A1, the storage resource table in search the resource that resource type is business domains;
The cloud computing resources management platform can find out the resource that resource type is business domains according to one of the resource type in the resource table of storage.
A2, the business domains resource of searching is converted to tree node, the tabulation of spanning tree node.
The father node tabulation of A3, newly-built sky is tabulated as current parent's node.
A4, present tree node tabulation is traveled through.
A5, judge the root node sign whether the parent resource sign of the current node that traverses equals to preset, if, execution in step A6 then, if not, execution in step A7 then.
A6, the current node that traverses is labeled as the root node of current resource-service authorization tree;
The cloud computing resources management platform is labeled as the current node that traverses the root node of resource-service authorization tree, afterwards execution in step A11.
A7, searching the resource that resource identification equals the parent resource sign of the current node that traverses in the resource table of storage, is the father node of the current node that traverses with this resource mark.
A8, judge whether comprise the resource that resource identification equals the parent resource sign of the current node that traverses in the current parent's node tabulation;
If do not comprise, with execution in step A9, if comprise, execution in step A10 then.
A9, the resource that resource identification is equaled the parent resource sign of the current node that traverses are added the tabulation of current parent's node to.
A10, to judge whether present tree node tabulation travels through complete;
It is complete that the cloud computing resources management platform judges whether the tabulation of present tree node travels through, if then execution in step A11 if not, then jumps to next traversal node, returns steps A 5.
A11, judge whether current parent's node tabulation is empty;
The cloud computing resources management platform judges whether current parent's node tabulation is empty, if be empty, if execution in step A12 then is sky, then execution in step A13.
A12, with current parent's node tabulation as the tabulation of present tree node, return steps A 3.
A13, make up initial resource-service authorization tree according to the mark recurrence;
The mark recurrence that the cloud computing resources management platform is done according to abovementioned steps makes up initial resource-service authorization tree.
A14, for each resource type in initial resource-service authorization tree be that the resource of business domains is added " business " and " cluster " two child nodes;
A15, search resource type and be all professional resources, as the child node of corresponding " business " node.;
The cloud computing resources management platform is searched resource type and is all professional resources in above-mentioned resource table, the business that finds is equaled the child node of " business " node under the business domains of this professional parent resource sign as resource identification.
A16, in the resource business relations table of storage, obtain cluster resource corresponding to business domains sign, search corresponding cluster according to the cluster resource sign;
In the embodiment of the invention, resource business relations table comprises the correspondence relationship information of business domains and cluster, the cloud computing resources management platform is for each business domains in initial resource-service authorization tree, from the resource business relations table of storage, can get access to cluster resource sign corresponding to each business domains, wherein, a business domains may be corresponding to one or more cluster resource sign.Further be identified at according to the cluster resource that gets access to and search corresponding cluster in the above-mentioned resource table, with the cluster that the finds child node as " cluster " node under the corresponding service territory, to generate final resource-service authorization tree.
Professional and the cluster of all that find when above-mentioned all adds to after initial resource-service authorization tree, namely generates final resource-service authorization and sets.
Need to prove, in the above-described embodiments, steps A 15 and steps A 16 also can be carried out simultaneously, and perhaps, step 16 also can be carried out before step 15, was not construed as limiting herein.
104, loading the resource-service authorization that generates sets to user interface;
The resource that the cloud computing resources management platform generates step 103-service authorization tree is loaded on user interface, but selects operator's operating resource from this resource-service authorization tree for the keeper.
Particularly, resource-the service authorization that can use Tree control load step 103 to generate in the embodiment of the invention is set to user interface, Tree control arranges check box and selects for authorizing before each node of resource-service authorization tree, so that the user carries out resource selection in resource-service authorization tree.Further, following final election rule also can be set in Tree control: when the child node of " business " node or " business " node was chosen, " cluster " node corresponding with the child node of this " business " node or " business " node and child node acquiescence thereof were all chosen.But the keeper can manually revise the situation of choosing.Be depicted as a kind of resource of being loaded on user interface-service authorization tree exploded view such as Fig. 1-d.
But the resource of 105, the user being selected from the resource that loads-service authorization tree is defined as aforesaid operations person's operating resource;
But the user selects operator's operating resource from the resource that is loaded on user interface-service authorization tree, but the cloud computing resources management platform is selected the user from the resource that loads-service authorization tree resource is defined as aforesaid operations person's operating resource.
106, with aforesaid operations person's essential information, but being stored in respectively the operator, aforesaid operations person's authorization role information and aforesaid operations person's operating resource information shows, in operator's role relation table and the operator's resources relationship table;
In the embodiment of the invention, aforesaid operations person's role relation table is associated with aforesaid operations person's table, and aforesaid operations person's resources relationship table is associated with aforesaid operations person's table.The cloud computing resources management platform is with aforesaid operations person's essential information, but aforesaid operations person's authorization role information and aforesaid operations person's operating resource information are stored in respectively operator's table, in operator's authorization role relation table and the operator's resources relationship table, thereby finish record to this operator's minute territory Authorized operation.
In actual applications, because resource updates (as adding or the resources such as deletion machine room, cluster, main frame, business domains, business), the cloud computing resources management platform need to be carried out updating maintenance to the correlation tables such as resource entity table (cluster table, machine room table, empty machine table etc.), resource table and resource business relations table of respective type according to the resource type of renewal.For example, when adding physical resource (such as machine room, cluster, main frame, virtual machine etc.), resource type according to physical resource writes resource information in the resource entity table (such as machine room table, cluster table, main frame table, virtual machine table etc.) of respective type, simultaneously this resource information is write in the resource table, as when adding machine room, obtain this machine room information, this machine room information is write in the machine room table, simultaneously this machine room information is write in the resource table; When adding logical resource (such as business domains, business), resource information is write in traffic table and the resource table, simultaneously the physical resource information that comprises in the logical resource that adds is write in the resource business relations table.Need to prove, when adding virtual machine, also should indicate the business that this virtual machine carries.Again for example, in the deletion of physically resource (such as machine room, cluster, main frame, virtual machine etc.) time, according to the resource type table of the physical resource of deletion at the resource entity table of respective type (such as the machine room table, cluster table, the main frame table, virtual machine table etc.) resource information of this physical resource of deletion in, simultaneously also will be at resource table, the resource information of this physical resource of deletion in resource business relations table and the operator's resources relationship table, as when deleting machine room, except the information at this machine room of machine room list deletion, also will be at resource table, the information of this machine room of deletion in resource business relations table and the operator's resources relationship table; When deletion logical resource (such as business domains, business), the resource information that need in traffic table, resource table, resource business relations table and operator's resources relationship table, delete this logical resource.The embodiment of the invention provides automatic detection update mechanism, be increase or the deletion whether real-time detection of cloud computing resources management platform exists cloud computing resources, when detecting newly-increased cloud computing resources, obtain newly-increased cloud computing resources information, resource type according to newly-increased cloud computing resources, newly-increased cloud computing resources is write in the resource business relations table of the resource table of resource entity table, storage of respective type and storage, upgrade with resource entity table, resource table and resource business relations table to storage; The current cloud computing resources that exists is deleted when detecting, then: according to the resource type of deleted cloud computing resources, deleted cloud computing resources information is deleted from the resource business relations table of the resource table of the resource entity table of respective type, storage, storage and operator's resources relationship table, upgrade with resource entity table, resource table, resource business relations table and operator's resources relationship table to storage.Certainly, the table of storing in the embodiment of the invention also can be safeguarded, is not construed as limiting herein in artificial regeneration.
Therefore, set up in advance the relation between physical resource (such as machine room, cluster, main frame, virtual machine etc.) and the logical resource (such as business domains, business etc.) in the embodiment of the invention, comprising the resource of physical resource and logical resource-service authorization by loading sets to the interface, select so that the operator can manage the batch of resource in the service resources tree, satisfied the demand of opening the infrastructure resources administration authority for operating personnel's rapid batch.
On basis embodiment illustrated in fig. 1, also provide the flow process that represents after operator's login in the embodiment of the invention.Shown in Fig. 2-a, comprising:
201, the operator logins;
Account and the password of operator when creating can sign in to the cloud computing resources management platform resource with authority is managed operation, and when detecting the operator and login, the cloud computing resources management platform starts the flow process that represents in the embodiment of the invention.
202, whether the operator logins successfully;
If not, then return step 201, if then execution in step 203.
203, generate aforesaid operations person's system view tree;
After the operator logined successfully, the cloud computing resources management platform generates this operator's system view tree according to operator's account, and was specific as follows:
The cloud computing resources management platform reads this operator's cluster in operator's resources relationship table according to operator's account;
After the operator successfully logined, the cloud computing resources management platform can read according to operator's account the resource identification of this operator's cluster in operator's resources relationship table; In the resource table of storage, obtain the parent resource sign of above-mentioned cluster; From resource table, obtain the parent resource sign of the father node of above-mentioned cluster, obtain successively ancestors' nodes at different levels (being the father node etc. of the father node of the father node of above-mentioned cluster, above-mentioned cluster) of above-mentioned cluster, until trace back to root node; From resource table, obtain the child node of above-mentioned cluster according to the resource identification of cluster.Wherein, obtain child node regular as follows of ancestors' nodes at different levels of above-mentioned cluster and above-mentioned cluster: the resource identification of the father node of a node equals the parent resource sign of this node, and the parent resource sign of the child node of a node equals the resource identification of this node.Illustrate, if the resource identification of resource A equals the parent resource sign of resource B, show that then resource A is the father node of resource B, correspondingly, resource B is the child node of resource A.
The form that represents of system view tree can be with reference to shown in Fig. 2-b, and by Fig. 2-b as seen, the manageable physical resource of operator comprises: machine room A and machine room B, and machine room A is comprised of cluster A and cluster B, and cluster A is comprised of main frame 1, main frame 2 and main frame 3.
204, generate aforesaid operations person's service view tree;
After the operator logined successfully, the cloud computing resources management platform generates this operator's service view tree according to operator's account, and was specific as follows:
In aforesaid operations person's resources relationship table, read the resource identification of aforesaid operations person's business according to aforesaid operations person's account; In resource table, obtain the parent resource sign of above-mentioned business; Obtain the father node of above-mentioned business according to the parent resource sign of above-mentioned business; From state resource table, obtain the parent resource sign of the father node of above-mentioned business, obtain successively ancestors' nodes at different levels of above-mentioned business, until trace back to root node; According to the pass series structure service view tree between ancestors' nodes at different levels of above-mentioned business and above-mentioned business.Wherein, obtain ancestors' nodes at different levels regular as follows of above-mentioned business: the resource identification of the father node of a node equals the parent resource sign of this node.Illustrate, if the resource identification of resource A equals the parent resource sign of resource B, show that then resource A is the father node of resource B.
The form that represents of service view tree can be with reference to shown in Fig. 2-c, by Fig. 2-c as seen, the manageable logical resource of operator comprises: mobile phone application domain, sector application territory and network application territory, mobile phone application domain comprise flight house keeper, electronics bookstore and like three kinds of business of music.
205, system view tree and service view tree are loaded on operator interface, and establish switch labels.
The cloud computing resources management platform is loaded on operator interface with system view tree and the service view tree of step 203 and step 204 generation, and switch labels is set.Above-mentioned switch labels is used for said system Views tree and above-mentioned service view tree are shown switching in user interface, so that the operator clicks the demonstration that switch labels is come switched system Views tree and service view tree.
Be depicted as the form that represents in operation interface system view tree and service view tree such as Fig. 2-d, switch labels switches in the demonstration of service view tree.
Further, the resource that the cloud computing resources management platform can also be chosen in system view tree or service view tree according to aforesaid operations person, and the authorization role information of this operator in operator's authorization role relation table, this operator is loaded on same operator interface to the corresponding action button of operating right that the resource of choosing possesses.Illustrate, suppose that there are the authorization role information such as " startup ", " hang-up " to " virtual machine " resource, " restarting " in this operator in operator's authorization role relation table, then when the operator selects the relevant operation pages such as " virtual machine ", the cloud computing resources management platform is loaded on same operation interface with buttons such as " startup ", " hang-up ", " restarting ", when the operator clicks associated button, can trigger the corresponding operating of corresponding virtual machine.
Therefore, set up in advance the relation between physical resource (such as machine room, cluster, main frame, virtual machine etc.) and the logical resource (such as business domains, business etc.) in the embodiment of the invention, comprising the resource of physical resource and logical resource-service authorization by loading sets to the interface, select so that the operator can manage the batch of resource in the service resources tree, satisfied the demand of opening the infrastructure resources administration authority for operating personnel's rapid batch.Further, when operating personnel login, represent relation between resource from system architecture view and two dimensions of service view, so that operating personnel can see the machine room of its management at a glance from the system architecture view, cluster, relation between main frame, the business that the cloud computing resources management platform that then represents service view supports and the relation between the subservice thereof, the former can help operating personnel to dispose the quick locating resource of angle from hardware, the latter can help operating personnel from the quick locating resource of professional structure angle degree, as seen, the technical scheme that provides of the invention process is very easy to telecom operators and the affiliate carries out operation maintenance management to the physical resource in the term of reference and business.
Need to prove, for aforesaid each embodiment of the method, for easy description, therefore it all is expressed as a series of combination of actions, but those skilled in the art should know, the present invention is not subjected to the restriction of described sequence of movement, because according to the present invention, some step can adopt other order or carry out simultaneously.Secondly, those skilled in the art also should know, the embodiment described in the instructions all belongs to preferred embodiment, and related action and module might not all be that the present invention is necessary.
In the above-described embodiments, the description of each embodiment is all emphasized particularly on different fields, do not have the part that describes in detail among certain embodiment, can be referring to the associated description of other embodiment.
One of ordinary skill in the art will appreciate that, part or all or part of of this technical scheme that technical scheme of the present invention contributes to prior art in essence in other words can embody with the form of software product, this computer software product is stored in the storage medium, comprise that some instructions (can be personal computers in order to the command calculations machine equipment, server, the perhaps network equipment etc.) carry out all or part of step of the described method of each embodiment of the present invention.And aforesaid storage medium comprises: the various media that can be program code stored such as USB flash disk, portable hard drive, ROM (read-only memory) (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disc or CD.
Above a kind of cloud computing resources provided by the present invention minute territory authorization method is described in detail, for one of ordinary skill in the art, thought according to the embodiment of the invention, all will change in specific embodiments and applications, to sum up, this description should not be construed as limitation of the present invention.

Claims (7)

1. a cloud computing resources divides the territory authorization method, it is characterized in that, comprising:
Setting operation person's essential information, described operator's essential information comprises: described operator's account and password;
Set described operator's authorization role information, wherein, described authorization role information comprises: one or more kinds of authorization roles, and wherein, every kind of authorization role is corresponding to the operation to specific cloud computing resources;
Generate resource-service authorization tree, wherein, described resource-service authorization tree comprises following resource: the business domains that one or two are above, and described the business domains business and the cluster that comprise;
Loading described resource-service authorization sets to user interface;
But the resource that the user selects is defined as described operator's operating resource from the resource of described loading-service authorization tree;
With described operator's essential information, but described operator's authorization role information and described operator's operating resource information is stored in respectively operator's table, in operator's authorization role relation table and the operator's resources relationship table; Wherein, described operator's authorization role relation table is associated with described operator's table, and described operator's resources relationship table is associated with described operator's table.
2. method according to claim 1 is characterized in that,
Described generation resource-service authorization tree comprises:
In the resource table of storage, search the resource that resource type is business domains;
Described business domains resource of searching is converted to tree node, the tabulation of spanning tree node;
The father node tabulation of newly-built sky is tabulated as current parent's node;
Tabulation travels through to the present tree node:
If the root node sign that the parent resource of the current node that traverses sign equals to preset then is labeled as the described current node that traverses the root node that resource-service authorization is set;
If the parent resource of the current node that traverses sign is not equal to the root node sign that presets, then in described resource table, search resource identification and equal the resource of the parent resource sign of the described current node that traverses, the resource mark that described resource identification is equaled the parent resource sign of the described current node that traverses is the father node of the described current node that traverses, and when not comprising described resource identification equaling the resource of parent resource sign of the described current node that traverses in current parent's node tabulation, the resource that described resource identification is equaled the parent resource sign of the described current node that traverses is added the tabulation of current parent's node to;
If present tree node list traversal is complete, and current parent's node tabulation be empty, then with the tabulation of current parent's node as the tabulation of present tree node, carry out the father node of described newly-built sky and tabulate and follow-up step;
If present tree node list traversal is complete, and the tabulation of current parent's node is for empty, then:
Make up initial resource-service authorization tree according to the mark recurrence;
For each resource type in described initial resource-service authorization tree is that the resource of business domains is added name and is called " business " and " cluster " two child nodes;
In described resource table, search resource type and be all professional resources, the described business that finds is equaled the child node of " business " node under the business domains of this professional parent resource sign as resource identification, for each described business domains, in the resource business relations table of storage, obtain cluster resource sign corresponding to described business domains, be identified at according to described cluster resource and search corresponding cluster in the described resource table, with the cluster that the finds child node as " cluster " node under the corresponding service territory, to generate final resource-service authorization tree, wherein, described resource business relations table comprises the correspondence relationship information of business domains and cluster;
Described resource-the service authorization of described loading is set to user interface and is specially:
Using Tree control to load described final resource-service authorization sets to user interface, and check box is set before each node selects for authorizing, wherein, described check box is set as follows acquiescence and chooses rule: when the child node under " business " node is chosen, child node below its correspondence " cluster " is all chosen, but the user can manually revise the situation of choosing.
3. method according to claim 1 and 2 is characterized in that,
Described essential information with described operator, but described operator's authorization role information and described operator's operating resource information is stored in respectively operator table, in operator's authorization role relation table and the operator's resources relationship table after, also comprise:
If the operator successfully logins according to described operator's account and password, then:
Generate described operator's system view tree and service view tree;
Described system view tree and described service view tree are loaded on operator interface, and establish switch labels, wherein, described switch labels is used for described system view tree and described service view tree are shown switching in user interface;
Wherein, the described operator's of described generation system view tree comprises:
In described operator's resources relationship table, read the resource identification of described operator's cluster according to described operator's account;
In resource table, obtain the parent resource sign of described cluster;
Obtain the father node of described cluster according to the parent resource sign of described cluster;
From described resource table, obtain the parent resource sign of the father node of described cluster, obtain successively ancestors' nodes at different levels of described cluster, until trace back to root node;
According to the resource identification of cluster, from resource table, obtain the child node of described cluster;
According to concerning the tectonic system Views tree between ancestors' nodes at different levels of the child node of described cluster, described cluster and described cluster;
Wherein, the described operator's of described generation service view tree comprises:
In described operator's resources relationship table, read the resource identification of described operator's business according to described operator's account;
In resource table, obtain the parent resource sign of described business;
Obtain the father node of described business according to the parent resource sign of described business;
From described resource table, obtain the parent resource sign of the father node of described business, obtain successively ancestors' nodes at different levels of described business, until trace back to root node;
According to the pass series structure service view tree between ancestors' nodes at different levels of described business and described business.
4. method according to claim 3 is characterized in that, described described system view tree and described service view are set is loaded on operator interface, comprises afterwards:
The resource of in described system view tree or described service view tree, choosing according to described operator, and the authorization role information of described operator in described operator's authorization role relation table, described operator is loaded on described operator interface to the corresponding action button of operating right that the described resource of choosing possesses.
5. method according to claim 1 and 2 is characterized in that, described method also comprises:
If detect newly-increased cloud computing resources, then:
Obtain described newly-increased cloud computing resources information;
Resource type according to described newly-increased cloud computing resources, described newly-increased cloud computing resources information is write the resource entity table of respective type, and in described resource table and the described resource business relations table, so that described resource entity table, described resource table and described resource business relations table are upgraded.
6. method according to claim 1 and 2 is characterized in that, described method also comprises:
If it is deleted to detect the current cloud computing resources that exists, then:
Resource type according to described deleted cloud computing resources, with the resource entity table of described deleted cloud computing resources information from respective type, and delete in described resource table, resource business relations table and the described operator's resources relationship table, so that described resource entity table, described resource table, described resource business relations table and described operator's resources relationship table are upgraded.
7. method according to claim 1 and 2 is characterized in that,
Before the described operator's of described setting the authorization role information, comprising:
From the authorization role table of storage, read authorization role;
The described authorization role that reads is loaded on user interface;
The described operator's of described setting authorization role information is specially:
Obtain the authorization role that the user selects from the authorization role of described loading, the authorization role that described user is selected from the authorization role of described loading is set as described operator's authorization role information.
CN2012103712795A 2012-09-27 2012-09-27 Domain-partitioned authorization method for cloud computing resources Pending CN102903029A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN2012103712795A CN102903029A (en) 2012-09-27 2012-09-27 Domain-partitioned authorization method for cloud computing resources

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN2012103712795A CN102903029A (en) 2012-09-27 2012-09-27 Domain-partitioned authorization method for cloud computing resources

Publications (1)

Publication Number Publication Date
CN102903029A true CN102903029A (en) 2013-01-30

Family

ID=47575247

Family Applications (1)

Application Number Title Priority Date Filing Date
CN2012103712795A Pending CN102903029A (en) 2012-09-27 2012-09-27 Domain-partitioned authorization method for cloud computing resources

Country Status (1)

Country Link
CN (1) CN102903029A (en)

Cited By (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103188269A (en) * 2013-04-08 2013-07-03 汉柏科技有限公司 Method for controlling user access permission in cloud platform
CN104796737A (en) * 2015-04-28 2015-07-22 天脉聚源(北京)传媒科技有限公司 Group-based channel play implementing method, system and equipment
CN105072183A (en) * 2015-08-10 2015-11-18 浪潮(北京)电子信息产业有限公司 Management method and management device for cloud operation system (OS) software repository
CN105635311A (en) * 2016-01-22 2016-06-01 广东亿迅科技有限公司 Method for synchronizing resource pool information in cloud management platform
CN103873460B (en) * 2014-01-27 2017-08-25 华为技术有限公司 Service resources group implementation method and device
CN107124304A (en) * 2017-04-19 2017-09-01 千寻位置网络有限公司 Resources configuration management method and system, cloud terminal based on cloud resource
CN109286579A (en) * 2017-07-21 2019-01-29 中兴通讯股份有限公司 A kind of distribution method of user resources, device and computer readable storage medium
CN109445781A (en) * 2018-09-20 2019-03-08 福建星瑞格软件有限公司 A kind of quick permission access management method and system
CN110826027A (en) * 2019-09-29 2020-02-21 烽火通信科技股份有限公司 Method and system for distributing computer software user permission
CN111259429A (en) * 2020-02-10 2020-06-09 支付宝(杭州)信息技术有限公司 Resource operation authority control method and device and electronic equipment
CN111581633A (en) * 2020-03-31 2020-08-25 浪潮通用软件有限公司 Function authority control method, device and medium based on cloud computing
CN111698326A (en) * 2020-06-12 2020-09-22 北京百度网讯科技有限公司 Method and apparatus for determining cost attribution of cloud service resources
CN111859419A (en) * 2020-06-29 2020-10-30 远光软件股份有限公司 Method for configuring resource authority to main body based on micro service
CN111898143A (en) * 2020-07-16 2020-11-06 北京金和网络股份有限公司 Dynamic authority management method, device and terminal
CN112437123A (en) * 2020-11-09 2021-03-02 北京京东尚科信息技术有限公司 Resource management method, device, computer system and readable storage medium
CN114185676A (en) * 2021-12-06 2022-03-15 深圳威科软件科技有限公司 Server distribution method, device, electronic equipment and computer readable storage medium

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101453379A (en) * 2009-01-06 2009-06-10 中国人民解放军信息工程大学 Resource management method and system
WO2010133074A1 (en) * 2009-05-22 2010-11-25 中兴通讯股份有限公司 Privilege management system and method based on object
CN102035849A (en) * 2010-12-23 2011-04-27 华为技术有限公司 Method, equipment and system for realizing resource management in cloud computing
CN102075357A (en) * 2010-12-31 2011-05-25 武汉日电光通信工业有限公司 Multi-domain security management method for network management system
CN102148696A (en) * 2010-09-06 2011-08-10 华为技术有限公司 Method and system for managing network service

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101453379A (en) * 2009-01-06 2009-06-10 中国人民解放军信息工程大学 Resource management method and system
WO2010133074A1 (en) * 2009-05-22 2010-11-25 中兴通讯股份有限公司 Privilege management system and method based on object
CN102148696A (en) * 2010-09-06 2011-08-10 华为技术有限公司 Method and system for managing network service
CN102035849A (en) * 2010-12-23 2011-04-27 华为技术有限公司 Method, equipment and system for realizing resource management in cloud computing
CN102075357A (en) * 2010-12-31 2011-05-25 武汉日电光通信工业有限公司 Multi-domain security management method for network management system

Cited By (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103188269B (en) * 2013-04-08 2016-12-28 汉柏科技有限公司 The control method of access privilege in cloud platform
CN103188269A (en) * 2013-04-08 2013-07-03 汉柏科技有限公司 Method for controlling user access permission in cloud platform
CN103873460B (en) * 2014-01-27 2017-08-25 华为技术有限公司 Service resources group implementation method and device
CN104796737B (en) * 2015-04-28 2018-10-26 天脉聚源(北京)传媒科技有限公司 Channel based on group plays implementation method, system and equipment
CN104796737A (en) * 2015-04-28 2015-07-22 天脉聚源(北京)传媒科技有限公司 Group-based channel play implementing method, system and equipment
CN105072183A (en) * 2015-08-10 2015-11-18 浪潮(北京)电子信息产业有限公司 Management method and management device for cloud operation system (OS) software repository
CN105635311A (en) * 2016-01-22 2016-06-01 广东亿迅科技有限公司 Method for synchronizing resource pool information in cloud management platform
CN107124304A (en) * 2017-04-19 2017-09-01 千寻位置网络有限公司 Resources configuration management method and system, cloud terminal based on cloud resource
CN109286579A (en) * 2017-07-21 2019-01-29 中兴通讯股份有限公司 A kind of distribution method of user resources, device and computer readable storage medium
CN109445781A (en) * 2018-09-20 2019-03-08 福建星瑞格软件有限公司 A kind of quick permission access management method and system
CN110826027A (en) * 2019-09-29 2020-02-21 烽火通信科技股份有限公司 Method and system for distributing computer software user permission
CN110826027B (en) * 2019-09-29 2021-11-09 烽火通信科技股份有限公司 Method and system for distributing computer software user permission
CN111259429A (en) * 2020-02-10 2020-06-09 支付宝(杭州)信息技术有限公司 Resource operation authority control method and device and electronic equipment
CN111581633A (en) * 2020-03-31 2020-08-25 浪潮通用软件有限公司 Function authority control method, device and medium based on cloud computing
CN111698326A (en) * 2020-06-12 2020-09-22 北京百度网讯科技有限公司 Method and apparatus for determining cost attribution of cloud service resources
CN111698326B (en) * 2020-06-12 2023-01-31 北京百度网讯科技有限公司 Method and device for determining cost attribution of cloud service resources
CN111859419A (en) * 2020-06-29 2020-10-30 远光软件股份有限公司 Method for configuring resource authority to main body based on micro service
CN111859419B (en) * 2020-06-29 2023-10-10 远光软件股份有限公司 Method for configuring resource permission to main body based on micro-service
CN111898143A (en) * 2020-07-16 2020-11-06 北京金和网络股份有限公司 Dynamic authority management method, device and terminal
CN111898143B (en) * 2020-07-16 2024-04-16 北京金和网络股份有限公司 Dynamic authority management method, device and terminal
CN112437123A (en) * 2020-11-09 2021-03-02 北京京东尚科信息技术有限公司 Resource management method, device, computer system and readable storage medium
CN112437123B (en) * 2020-11-09 2024-04-09 北京京东尚科信息技术有限公司 Resource management method, device, computer system and readable storage medium
CN114185676A (en) * 2021-12-06 2022-03-15 深圳威科软件科技有限公司 Server distribution method, device, electronic equipment and computer readable storage medium
CN114185676B (en) * 2021-12-06 2022-12-16 深圳威科软件科技有限公司 Server distribution method, device, electronic equipment and computer readable storage medium

Similar Documents

Publication Publication Date Title
CN102903029A (en) Domain-partitioned authorization method for cloud computing resources
US11070543B2 (en) Multi-persona management and devices
US9703834B2 (en) Topological query in multi-tenancy environment
US20170010673A1 (en) Gesture based sharing of user interface portion
US11120212B2 (en) Creating and modifying applications from a mobile device
US11005735B1 (en) Configuration system and method for an integrated computing system
CN102054217A (en) Entity morphing in metamodel-based tools
US20240028991A1 (en) Flexible Work Breakdown Structure
US10572247B2 (en) Prototype management system
US8903889B2 (en) Method, system and article for mobile metadata software agent in a data-centric computing environment
CN113296891B (en) Platform-based multi-scene knowledge graph processing method and device
US10409787B1 (en) Database migration
US11940969B2 (en) Managing locations of derived storage objects
WO2023056793A1 (en) Optimizing a just-in-time compilation process
CN106569829B (en) Method for realizing switching of working modes of touch screen, touch screen device and head-mounted equipment
US20220198404A1 (en) Asset health score based on digital twin resources
US20170220936A1 (en) Identifying Linguistically Related Content for Corpus Expansion Management
US10169382B2 (en) Keyword identification for an enterprise resource planning manager
CN112148461A (en) Application scheduling method and device
CN112101890A (en) Authority control method, device, equipment and medium based on role and cloud function
US11106498B1 (en) Element life cycle management system and method for the components of an integrated computing system
US20230161761A1 (en) Data virtualization in natural language
US11321353B2 (en) Dynamic roll-over of source and target latency in a replication environment
US11928117B2 (en) Live comment management
WO2024001441A1 (en) Fine granularity read access to generational safeguarded copy data

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20130130

RJ01 Rejection of invention patent application after publication