KR20060078363A - Method for authorizing of operation support system in the heterogeneous network enviroment - Google Patents

Abstract

The present invention performs user authentication and authorization for an operator managing each subsystem in an OSS (Operation Support System) that manages network elements in a multi-network environment, so that only authorized operators can manage the subsystem. The present invention relates to a technology for providing a system, comprising: a human resources management system configured to authenticate to an operator configured to manage subsystems in an intranet; A first OSS subsystem group in association with the human resources management system for authenticating the operator; And a second subsystem group that interoperates with the first OSS subsystem group, authenticates the directly connected operator and authorizes the operator based on authorization information transmitted from the first OSS subsystem group. It characterized by having a.

Description

User authentication method and system in integrated network management system {METHOD FOR AUTHORIZING OF OPERATION SUPPORT SYSTEM IN THE HETEROGENEOUS NETWORK ENVIROMENT}

1 is a system configuration to which the user authentication method is applied in the integrated network management system according to an embodiment of the present invention.

2 is a detailed structural diagram of OSS subsystem group 1 (10) of FIG.

3 is a detailed structural diagram of OSS subsystem group 2 (20) of FIG.

4 is a flowchart illustrating a user authentication method in an integrated network management system according to an embodiment of the present invention.

The present invention relates to a user authentication method and system in an integrated network management system, and more particularly, to an operator managing each subsystem in an OSS (Operation Support System) that manages network elements in a multi-network environment. The present invention relates to a technique for performing user authentication and authorization so that only authorized operators can manage the subsystem.                         

As the types of communication networks are diversified according to data types, each communication network is provided with an OSS that provides configuration / failure / monitoring functions for elements constituting each communication network.

The OSS provided in the subscriber system manages the PSTN exchanger and the PSTN exchanger tester, and the OSS provided in the IP packet network provides a configuration / fault / monitoring function for the equipment constituting the IP packet network, ATM network, F / R, and OSS provided in the backbone network provides configuration / failure / monitoring functions for the facilities constituting each network.

In order to perform the functions as described above, the OSS operator can not only check the status of the equipment constituting the network through a GUI (Graphic User Interface) for network management, but also predetermined network management for the network. Work can be done.

In recent years, in an environment in which a variety of communication networks are gradually diversified, a variety of communication networks can be managed as multiple networks, and in consideration of complex authentication and authorization management, the OSS system can be operated only by authorized users. In addition, there is an increasing need for an OSS system capable of performing only a task corresponding to a preset authority.

SUMMARY OF THE INVENTION The present invention has been made in view of the above requirements, and an object of the present invention is to perform authentication and authorization for an OSS operator managing a facility of each network in multiple networks in a secure manner, thereby improving reliability in OSS operation. To raise.

In order to realize the above object, the user authentication method in the integrated network management system according to the present invention, in connection with the personnel management system established in the intranet, authentication for the operator that the first OSS subsystem group manages the predetermined network Performing a first process; And in a second OSS subsystem group to which the authenticated operator is connected, when a predetermined task is requested from the operator, performing an authorization for the operator, and having a second process of allowing the operator's work when the authentication is successful. It features.

In addition, in order to realize the above object, the user authentication system in the integrated network management system according to the present invention, a human resource management system for authenticating the operator is established in the intranet to manage the subsystems; A first OSS subsystem group in association with the human resources management system for authenticating the operator; And a second subsystem group that interoperates with the first OSS subsystem group, authenticates the directly connected operator and authorizes the operator based on authorization information transmitted from the first OSS subsystem group. It characterized by having a.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of a system to which a user authentication method is applied in an integrated network management system according to an embodiment of the present invention.

As shown in FIG. 1, a user authentication system in an integrated network management system according to an exemplary embodiment of the present invention includes a subscriber system operator or an OSS subsystem group in association with a human resources management system 50 through an intranet 56. 2 (20), OSS Subsystem Group 3 (30), and OSS Subsystem Group 1 (10) for authenticating and authorizing each operator of OSS Subsystem Group 4 (40).

Personnel management system 56 performs a function for authenticating a specific operator upon request from OSS Subsystem Group 1 (10), and therein, an identifier, password, and authority information for the operator to be authenticated are stored. Personnel information DB 51 is provided. The authority information stored in the personnel information DB 51 is also stored in the main DB 12 of the OSS subsystem group 1 (10).

In addition, the OSS subsystem group 1 (10) shown in FIG. 1 includes the subscriber EM driver server 15, the OSS subsystem group 2 (20), the OSS subsystem group 3 (30), and the OSS subsystem group 4 ( 40) is connected to a dedicated line (HOT LINE), respectively, to maintain security.

OSS subsystem group 1 (10) has an AP server (11), a main DB (12), a local DB (13), and an authentication management server (14), as shown in FIG.

The AP server 11 is connected to the OSS subsystem group 2 (20), the OSS subsystem group 3 (30), and the OSS subsystem group 4 (40) through a dedicated line, and the OSS subsystem group 2 (20). When authentication and authorization for a specific operator are requested from the OSS subsystem group 3 (30), and the OSS subsystem group 4 (40), the authentication is performed in association with the authentication management server 14, and the main DB Use (12) to perform authorization for the operator.

When the authentication management server 14 requests authentication from the AP server 11, the authentication management server 50 interoperates with the human resources management system 50 through the intranet 56 and requests the authentication of the corresponding operator to the human resources management system 50. It transmits the authentication result transmitted from the management system 50 to the AP server (11).

The main DB 12 stores authority information for the operator of each subsystem. The authority information includes, for example, service network information, operator group information, operator rating information, operator work area information, service information, detailed work information, and the like. For reference, the service network information is information indicating which service network the operator is performing, and indicates information on which subsystem the operator can access based on the information. In addition, the operator grade information is control information indicating a grade to the operator and what operations can be performed in the corresponding subsystem. Operator region information is information indicating in which region the operator can perform work. Service information is information that indicates what kind of service the operator can work among services provided in the service network. Detailed job information is role information for detailed information that cannot be divided into operator rating information and service information. Such authority information can be registered for each operator and then approved by the operator of the ADMIN group. ADMIN group is divided into CENTER ADMIN, LOCAL ADMIN, and service network ADMIN. Approval for ADMIN group is done by CENTER ADMIN only.

In FIG. 1, the subscriber EM driver server 15 is connected to another subscriber network, and manages a PSTN, a subscriber switch of an IP network, and the like.

OSS subsystem group 2 (20) is configured in the IP packet network, it is possible to directly connect to the equipment installed in the IP packet network to perform the query, test, assignment, alarm collection and the like.

OSS subsystem group 3 (30) is configured in the ATM network, and can directly connect to the equipment installed in the ATM network to perform tasks such as inquiry, testing, allocation, alarm collection.

OSS subsystem group 4 (40) is connected to the backbone network 46 through the management network (MANAGEMENT NETWORK), to perform operations such as inquiry, testing, allocation, alarm collection for the equipment installed in the backbone network 46 Can be done. The management network is a security network that is disconnected from the external network.

Each OSS subsystem group 2, 3, 4 (20, 30, 40) has an AP server and a local DB 22, as shown in FIG. Although FIG. 3 shows only the detailed configuration of the OSS subsystem group 2 (20) for convenience of description, the OSS subsystem group 3 (30) and the OSS subsystem group 4 (40) also have the same detailed configuration as in FIG.

In FIG. 3, when a specific operator logs in for network operation, the AP server 21 requests authentication and authorization of the corresponding operator to the OSS subsystem group 1 (10) through a dedicated line, and based on the result. AP server 21 to allow the network management of the operator and a local DB 22 for storing the facility information for network management.

Although not shown in Figs. 1 to 3, the operator can manage the OSS subsystem group 1 (10), OSS subsystem group 2 (20), OSS subsystem group 3 (30), and OSS subsystem group for management of the network. The terminal used to access 4 (40) has a web browser and a client program, and a function provided on a web basis for network operation is used through a web browser, and a client program is loaded to perform an operation for actual network operation. Do this.

At this time, after authentication on the web base through the OSS subsystem group 1 (10), after receiving a re-authentication from the OSS subsystem group 1 (10) when using the client program, using the authentication information, etc. according to the authentication result Restrict operator network operations.

In addition, the operator terminal requires a dedicated module for storing token information, and data can be exchanged between the web and the client program using the dedicated module. For reference, the token (SSO token) is stored as intermediate information for authentication, ID, access time, IP, connection type, the degree corresponding to the operator group to be used at the time of connection, and the information is managed by the authentication management server 14 When the connection type is changed, it is rewritten and stored in the token. When the token is used for reauthentication for a specific operating terminal, authentication may be performed without using ID and PW.

Hereinafter, a user authentication method in an integrated network management system according to an embodiment of the present invention will be described in detail with reference to the above-described flowcharts shown in FIGS. 1 to 3 and 4.

An operating terminal connected to any one of the OSS subsystem groups of OSS subsystem group 1 (10), OSS subsystem group 2 (20), OSS subsystem group 3 (30), and OSS subsystem group 4 (40) is logged. When requesting authentication, the AP server of the corresponding OSS subsystem group transmits the ID and password inputted from the operating terminal to the AP server 11 of the OSS subsystem group 1 (10) to request authentication for the corresponding operating terminal ( S2).

Accordingly, the AP server 11 requests the authentication of the operation terminal to the authentication management server 14, the authentication management server 14 is the authentication of the operation terminal with the personnel management system 50 built on the intranet Ask. Personnel management system 50 checks whether the ID and password input from the operating terminal is valid registered in the personnel information DB (51) (S4). In the present invention, the identifier of the operator who operates the operating terminal is designated as an ID, but can be managed in addition to the ID. In this case, the operating terminal enters its own number and password at login.

On the other hand, if the S4 confirms that the ID and password input from the operation terminal are not registered in the personnel information DB 51 (No in S6), the human resources management system 50 of the OSS subsystem group 1 (10). The authentication management server 14 notifies the authentication failure, and the authentication management server 14 notifies the authentication failure to the AP server of the OSS subsystem group which accommodates the operation terminal, so that the authentication failure is notified to the operation terminal ( S8).

However, on the contrary, if the ID and the passweed input from the operating terminal are registered in the personnel information DB 51 (YES in S6), the personnel management system 50 is the authentication management server of the OSS subsystem group 1 (10). (14) A notification of successful authentication is made.

The authentication management server 11 inquires the authority information stored in the main DB 12, and the OSS subsystem accommodating the corresponding operation terminal through the AP server 11 with the authentication result and the authority information query result according to the authentication success. It transmits to the AP server of the group (S12).

In this state, when a predetermined job is requested from the operation terminal (S14), the AP server determines whether the operation satisfies the authority information of the operation terminal based on the authority information inquiry result (S16).

That is, the AP server determines whether the operation requested from the operation terminal is based on the authority information, whether the operation of the operation terminal is for the accessible subsystem, whether the operation is allowable, the allowable region, or the service is available. If it is determined that the operation satisfies the authority information (Yes in S16), the operation is performed (S18).

However, if it is determined in S16 that the job does not satisfy the authority information (No in S16), the operation terminal is notified of the job rejection (S24).

After that, if a log-off is requested from the operating terminal (Yes in S20), the above-described series of processes are terminated, and if a log-off from the operating terminal is not detected (No in S20), the operation command is waited ( S22), when a predetermined work command is requested, the processes of S14 SO to S24 described above are repeatedly performed.

While these operations are being performed, the operating terminal performs log-in and statistical tasks through a web browser and accesses the subsystems in the group through a dedicated client program.

After connecting, you move the subsystem as needed, and you need navigation between the Web and a dedicated client program. A dedicated client program requires a dedicated module to store token information, and data transfer is performed between the web and the dedicated client program using this module. In the case of the movement of the web or a dedicated client program, a request is made to the AP server using the subsystem, and the new authentication session information is formed by receiving operator grade information and local information corresponding to the changed subsystem through the authentication server. In the movement of web-only client, call the dedicated client program on the web, or call the web from the dedicated client program, take over the token from the token information storage module and transfer the information of the token back to the authentication server, creating a new authentication session. Configure

 On the other hand, in the present invention, the operator existing in the intranet cannot directly access the subsystem groups 2, 3, and 4 (20, 30, 40). Also, it is not possible to connect directly to the device. If there is no need for direct communication to the network components, such as statistics of subsystem groups 2, 3, and 4 (20, 30, 40), the OSS subsystem group 1 (10) via a remote call. Can be accessed through the AP server 11. In this case, the operators are managed by being divided into different operator classes from those who access each service network.

According to the user authentication method and system in the integrated network management system according to the embodiment of the present invention described above, in developing an OSS system for managing multiple networks, it is possible to perform complex rights management and to manage operators for various services. There is an effect that can effectively set the working rights to accept.

On the other hand, the present invention is not limited to the above-described embodiment, but can be modified and modified within the scope not departing from the gist of the present invention, such modifications and changes should be regarded as belonging to the following claims. will be.

Claims (13)

 A first step of performing authentication of an operator managing a predetermined network by a first OSS subsystem group in association with a human resource management system established in an intranet; And In the second OSS subsystem group to which the successful operator is connected, if a predetermined task is requested from the operator, the second OSS subsystem performs authorization for the operator, and has a second process of allowing the operator's work upon successful authentication. User Authentication Method in Integrated Network Management System. The method of claim 1, wherein the first process is A step 1-1 of the second OSS subsystem group transmitting an operator identifier and a password input from an operator requesting authentication to the first OSS subsystem group to request authentication of the operator; A first step 1-2 for the first OSS subsystem group to request the authentication of the operator by transmitting the operator identifier and password to a human resource management system; First to third steps of the personnel management system verifying whether the operator identifier and the password have been previously registered, and authenticating the operator; And And if the authentication of the operator is successful, integrating the authority information of the operator and transmitting the authentication result information and the authority information to the first OSS subsystem group. User Authentication Method in Network Management System. The method of claim 2, wherein the identifier of the operator User authentication method in the integrated network management system, characterized in that one of the operator ID or number. The method of claim 2, wherein the authority information A user authentication method in an integrated network management system comprising service network information, operator group information, operator rating information, operator work area information, service information, and detailed business department information. The method of claim 1 or 4, wherein the second process is Step 2-1, in which the second OSS subsystem group compares the requirement of the requested operation with authority information for the operator; And And if the work requirement satisfies the authority information, having a 2-2 process of determining that the authorization is successful and permitting the operator to perform the corresponding work. The method of claim 1, wherein each time the OSS subsystem to be worked on is changed, the operator requests authentication to the second OSS subsystem group, is authorized to the second OSS subsystem group, and then is authorized. User authentication method in an integrated network management system, characterized in that further comprises the process of performing the corresponding time. A human resources management system that is established in the intranet and authenticates an operator managing the subsystems; A first OSS subsystem group in association with the human resources management system for authenticating the operator; And A second subsystem group which interoperates with the first OSS subsystem group, authenticates the directly connected operator and authorizes the operator based on authorization information transmitted from the first OSS subsystem group; User authentication system in an integrated network management system characterized in that it comprises. The system of claim 7, wherein the personnel management system User authentication system in an integrated network management system, characterized in that the personnel information DB is stored, the identifier, password, and authorization information for the operator. 8. The method of claim 7, wherein the first OSS subsystem group is An authentication management server connected to the human resource management system through the intranet and performing authentication for a specific operator; It is connected to the second subsystem group through a dedicated line and transmits an authentication request for a specific operator transmitted from the second subsystem group to the authentication management server. An AP server for querying authority information and transmitting the inquiry result and the authentication result to the second subsystem group; And User authentication system in the integrated network management system, characterized in that it comprises a main DB for storing the authority information for the operators. 8. The method of claim 7, wherein the second OSS subsystem group is A user authentication system in an integrated network management system comprising at least one of an OSS subsystem group managing an ATM network, an OSS subsystem group managing a backbone network, and an OSS subsystem group managing an IP network. . 11. The method of claim 7 or 10, wherein the second OSS subsystem group is A local DB in which facility information for operating the network is stored; And Connected to the first OSS subsystem through the dedicated line, the authorized operator is authorized based on the authentication result and the authority information transmitted from the first OSS subsystem, so that the operator conforms to the authority. User authentication system in the integrated network management system, characterized in that it comprises an AP server for controlling to perform the operation. 12. The system of claim 11, wherein the second OSS subsystem is When the movement from the operator to the other sub-system is requested, re-authentication through the first OSS subsystem reconfigures the authentication session information, and performs authorization for the operator based on this. User authentication system in the system. The terminal of claim 12, wherein the operator's terminal is A web browser, a dedicated client program, and a token information storage module, wherein the web browser and the dedicated client program share information via a token stored in the token information storage module when moving to another subsystem, User authentication system in an integrated network management system, characterized in that navigation between the dedicated client program is performed.

Images