node.js - "compartmentalizing services"是什么意思？

Question

我正在使用 Node/Express/Angular/Mongo 构建网络应用程序，这是我第一次处理云服务器。 Rackspace 建议我将我的服务划分开来。为了在客户面前听起来不像一个完全的新手，我求助于我在 StackOverflow 的 friend :)

这到底是什么意思？是否有关于如何组织 Mongo 和 Node 的代码和实例以“划分”的常见做法？

我对这个主题的简要阅读让我相信这意味着保护措施，因此用户 A 不能阻碍性能或嗅探用户 B 的敏感信息。

Answer 1

它本质上是确保您正在处理的信息只显示给“需要查看它”的人 - 仅在必须设置对象时才设置它们的属性。确保一切都在需要知道的基础上，并且您不会向缓存层、日志、用户 session 等各个地方发送超出需要的数据。

一个很好的例子，其中划分是有意义的是一个页面，它执行类似 SELECT * FROM user WHERE id=123 并将其存储为 $_SESSION['USER'][123] 用于用户只想查看他上传的照片或其他内容的页面。在云计算中，信息泄露的风险更高，因此必须采取更多措施来保护敏感信息。

Wiki实际上有一个很好的例子:

In matters concerning information security, whether public or private sector, compartmentalization is the limiting of access to information to persons or other entities who have a need to know it in order to perform certain tasks. The concept originated in the handling of classified information in military and intelligence applications. The basis for compartmentalization was the idea that, if fewer people know the details of a mission or task, the risk or likelihood that such information could be compromised or fall into the hands of the opposition is decreased. Hence, varying levels of clearance within organizations exist. Yet, even if someone has the highest clearance, certain "compartmentalized" information, identified by codewords referring to particular types of secret information, may still be restricted to certain operators, even with a lower overall security clearance. Information marked this way is said to be codeword–classified. One famous example of this was the Ultra secret, where documents were marked "Top Secret Ultra": "Top Secret" marked its security level, and the "Ultra" keyword further restricted its readership to only those cleared to read "Ultra" documents.1

服务的划分只是将这个概念应用到应用程序的移动部分中。如果有太多零件在同一个地方移动，那么如果这些零件中的任何一个发生故障，就会增加风险。你的服务器人员可能会建议你在一台服务器上有电子邮件，在另一台服务器上有数据库，在另一台服务器上有缓存等等。他们赚更多的钱，如果这些服务器中的任何一个出现故障，你的应用程序就会“更安全”。