【作者】 邸鑫；

【导师】 房至一；

【作者基本信息】 吉林大学 ， 软件工程， 2010， 硕士

【摘要】 网络设备的管理与维护是当今电信网中的重要组成部分，是网络能否正常运行的要素之一。网络设备管理包括设备的规划、配置、监控、故障管理、性能控制、安全等等，而网络设备的密码管理则是网络设备安全管理的重中之重，它将网络安全与管理集于一身。本文针对华为公司的网络设备密码集中化、自动化管理问题，调查与研究了现有的网络设备管理系统、网络设备密码管理系统和它们的研究和发展现状，根据实际的具体需要，实现了集中化、自动化、安全的网络设备管理系统的批量密码修改子系统。出于安全可靠的角度考虑，本文在利用现有的HTTP隧道技术的前提下，放弃原来的人为的密码设置方式，而采用密码自动生成技术，并对生成的密码进行二次审核，使密码的安全度更高，更加难以破解，增加了网络设备的安全性。由于许多网络设备都有对密码进行集中化管理的需求，而现有的网络设备管理系统缺乏对这种管理方式的有效支持，许多同样的工作仍然需要分别处理，设备密码修改起来极不方便而且还容易出错。为了解决这一问题，本文提出的密码自动化管理，突破了常见的远程密码管理方式，采用批量密码管理。本文分析设计实现了网络设备管理系统的批量密码修改子系统，在实现方式上，采用B/S结构，利用Power Designer UML统一建模工具进行需求分析，概要设计和详细设计的建模，采用JSP+Servlet技术在Eclipse集成开发环境下实现了系统的各个功能模块。系统主要分三个功能模块：用户管理模块、网络设备管理模块（网元管理模块）、日志管理模块。用户管理模块用来对管理员进行统一身份认证和授权，网元管理模块是该系统的核心部分，共分为三个主要子模块：分别为密码自动生成模块，复杂度检查模块和密码再次审核模块，这三个子模块实现了密码的批量自动化和安全管理。密码批量修改的过程中可能出现个别设备密码修改失败，为了进行错误分析，进行手动的远程登录修改或者其他方式解决，需要记录设备密码管理的相关信息，日志管理模块主要用于记录这些信息，以便于管理人员的查询与维护。批量密码修改子系统的实现，使华为网元设备密码的修改实现了自动化、集中化。批量密码修改子系统通用性很好，管理员可在多种平台下对网络设备的密码进行维护。通过对该子系统的使用及使用情况统计表明：在保证安全可靠性的前提下，原来600多个网元，一次密码修改大概需要3个工作日精力高度集中的工作，现在运用该子系统进行密码修改只需2个小时即可完成。该子系统的运用节省了大量重复的人工劳动，提高了密码管理的质量和效率，具有现实意义。更多还原

【Abstract】 Nowadays, the management and maintenance of network equipment is importantcomponent of telecommunication network, and one factor of network normal running.Network equipment management includes planning, configuration, supervision, faultmanagement and performance control, security and so on. Password administration isa primary task of the security management network equipment, and it sets networksecurity and management in a suit.This paper surveys and researches the existing network equipment managementsystem，and development situation of current network equipment managementresearch. Considering the security and reliability, encryption and decryption of data isstudied in this paper. To ensure the data is not theft, it uses Asymmetric encryption inthe process of the password transmission, combining hash check technology to ensurethat the data was not damaged. Besides, while modifying password, this paper usespassword automatically generating instead of the original human setting. So, thesecurity of password is higher, and can not be obtained easily.The author’s main work is attending the overall design of net element equipmentmanagement system, designing in detail and realizing user management module andequipment management module, also proposing password modify in batches inequipment management module.In the design of the system, this paper adopts B/S structure and the pattern ofjsp+ servlet, in order to make system transplantation easier, so that user can operate itin any OS. It uses Object-oriented method in the analysis of the system, adoptsUnified Modeling Language (UML) and modeling tool Power Design to design themanagement system, realizes the system by the design pattern of MVC（Model-View-Controller）. Model layer realizes specific business logic, View layerdisplays user interface and Controller layer is mainly in charge of the controlrelationship between Model layer and View layer. Among the system html+CSSdesigns the presentation layer, so a good interface environment is realized. The patternof jsp+ servlet abstracts specific business, and the formative javabean is used toexpress specific model, while all of the requests are sent to servlet which is regard asthe controller, according to request, method of specific model is called. This designway commendably realizes not only the separation of presentation layer and businesslayer, but also high reusability and practicability, so developing life cycle cost isreduced and it is in favor of the soft engineered management.The system is mainly divided into three functional modules: user module,equipment module, and log module. Three of the modules are interrelated. The author is responsible for the design of user module and password modify in batches ofequipment module, also some functions such as CRUD. Because of the large scale,there can not be only several administrators, and the duties of administrators are notidentical, so the author adopts the idea of delamination, divides the users into differentlevels, that is, different roles have different permissions. In equipment management,this paper puts forward concept of group, divides equipments into different groupsaccording to actual area or specific types of equipments, mean wile, concept of groupalso applies to the users. User manages equipments belong to his group, so differentgroups of users can manage different sets of equipment. Therefore, three user levels,ordinary user only has the permission to view equipments, equipment groupadministrator can manage the restructuring of the equipment; super administrator canmanage the administrator manager and ordinary users.Equipment requires regular password modify, but the past system do not have thefunction of modify in batches, so it is inconvenient to do it. Therefore, the authorproposes the pattern of password modify in batches, and gives up the past human way,adopts password automatically generating. During modifying password in batches,individual failures may occur, this need to manual remote log to modify or find othersolving ways according to error analysis. At the same time, password in databaseshould also be modified, in order to maintain data synchronization. Of course, userscan individually modify equipment password.The underlying communication of system adopts HTTP tunnel technology,which is based on Web Service, using SOAP（simple object access protocol）ascommunication protocol, HTTP as transport protocol, so it can pass through allfirewalls.With the continuous development of computer science and technology, the scaleexpanding of computer networks, network equipment management will become moreand more important, and password management will be more widely appreciated.更多还原