Computing cluster system, security authentication method, node device and storage medium

Abstract

Embodiments of the present application provide a computing cluster system, a secure authentication method, a node device and a storage medium. In the embodiments of the present application, a service mesh system for implementing an identity-based authentication and authorization mechanism between at least two services is added in the computing cluster system. In the system, a plurality of diversified identity data corresponding to a first service is reported to a management and control component by an identity registration component; the management and control component generates a security policy and a digital certificate corresponding to the first service according to the diversified identity data, and delivers them to a corresponding authorized proxy component; the authorized proxy component performs identity authentication on the corresponding service according to the security policy and the digital certificate, and after the identity authentication is passed, the authorized proxy component proxies the communication between the at least two services. With the cooperation of the management and control component, the identity registration component and the authorized proxy component, the identity-based authentication and authorization mechanism can be implemented between the services without affecting the service running, thereby solving the communication security problem between the services.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of distributed computing, and particularly relates to a computing cluster system, a security authentication method, a node device and a storage medium. BACKGROUND

[0002] Microservice (or microservice architecture) is a cloud native architecture method, which can divide a single application into a group of small services, each service runs in an independent process, and the services coordinate and cooperate with each other to provide complete application functions. The services can communicate with each other by using a lightweight communication mechanism. How to solve the communication security problem between services is a technical problem faced by the computing cluster system using the microservice architecture. SUMMARY

[0003] The present application provides a computing cluster system, a security authentication method, a node device and a storage medium to solve the communication security problem between services.

[0004] The present application provides a computing cluster system, which comprises: at least one computing cluster, the at least one computing cluster is used to carry services, and in the case of at least two services, the services communicate based on an identity-based authentication and authorization mechanism; the system further comprises: a service mesh system used to implement the identity-based authentication and authorization mechanism, the service mesh system comprises a management and control component, an identity registration component and an authorization proxy component, and the authorization proxy component is distributed in the at least one computing cluster; the identity registration component is used to provide an identity registration service and an identity customization service for each service, obtain diversified identity metadata corresponding to a first service based on the identity registration service and the identity customization service, and report the diversified identity metadata to the management and control component; the management and control component is used to generate a security policy and a digital certificate of the first service according to the diversified identity metadata corresponding to the first service, and deliver the security policy and the digital certificate to a corresponding authorization proxy component in a computing cluster where the first service is located; and the authorization proxy component is used to, in the case that the first service needs to communicate with a second service, perform identity authentication on the first service according to the security policy and the digital certificate of the first service, and in the case that the identity authentication is passed, proxy the first service to communicate with the second service; wherein the first service is any one of the at least two services, and the second service is another service different from the first service.

[0005] The embodiment of the application further provides a service mesh system for implementing an identity-based authentication and authorization mechanism, which comprises a management and control component, an identity registration component and an authorization agent component, the authorization agent component is distributed in at least one computing cluster in a computing cluster system; the identity registration component is used for providing an identity registration service and an identity customization service for services in the computing cluster system, and obtains diversified identity metadata corresponding to a first service based on the identity registration service and the identity customization service and reports the diversified identity metadata to the management and control component; the management and control component is used for generating a security policy and a digital certificate of the first service according to the diversified identity metadata corresponding to the first service, and delivering the security policy and the digital certificate to a corresponding authorization agent component in a computing cluster where the first service is located; the authorization agent component is used for, in the case that the first service needs to communicate with a second service, performing identity authentication on the first service according to the security policy and the digital certificate of the first service, and proxying the first service to communicate with the second service in the case that the identity authentication is passed; wherein the first service is any service in the computing cluster system, and the second service is another service different from the first service.

[0006] The embodiment of the application further provides an identity authentication method applied to a service mesh system, the service mesh system being used for implementing an identity-based authentication and authorization mechanism, the method comprising: obtaining diversified identity metadata corresponding to a first service based on an identity registration service and an identity customization service provided for each service in a computing cluster system; generating a security policy and a digital certificate of the first service according to the diversified identity metadata corresponding to the first service; in the case that the first service needs to communicate with a second service, performing identity authentication on the first service according to the security policy and the digital certificate of the first service; and in the case that the first service passes the identity authentication, proxying the first service to communicate with the second service by an authorization agent component in the service mesh system; wherein the first service is any service in the computing cluster system, and the second service is another service different from the first service.

[0007] The embodiment of the application further provides a node device, comprising a memory and a processor; the memory is used for storing a computer program, and the processor is coupled with the memory and is used for executing the computer program to: obtain diversified identity metadata corresponding to a first service based on an identity registration service and an identity customization service provided for each service in a computing cluster system; generate a security policy and a digital certificate of the first service according to the diversified identity metadata corresponding to the first service; in the case that the first service needs to communicate with a second service, perform identity authentication on the first service according to the security policy and the digital certificate of the first service; and in the case that the first service passes the identity authentication, proxy the first service to communicate with the second service by an authorization agent component in the service mesh system; wherein the first service is any service in the computing cluster system, and the second service is another service different from the first service.

[0008] The embodiment of the present application further provides a computer readable storage medium storing a computer program, when the computer program is executed by a processor, the processor is caused to implement the steps in the above identity authentication method.

[0009] In the embodiment of the present application, a service mesh system for implementing an identity-based authentication and authorization mechanism between at least two services is added in the computing cluster system, and the service mesh system at least includes a management and control component, an identity registration component and an authorization proxy component. The identity registration component reports the diversified identity data corresponding to the first service to the management and control component; the management and control component generates a security policy and a digital certificate corresponding to the first service according to the diversified identity data, and delivers them to the corresponding authorization proxy component; the authorization proxy component performs identity authentication on the corresponding service according to the security policy and the digital certificate, and proxies the communication between the at least two services after the identity authentication is passed. Under the cooperation of the management and control component, the identity registration component and the authorization proxy component, the identity-based authentication and authorization mechanism can be implemented between the services without affecting the service running, thereby solving the communication security problem between the services. BRIEF DESCRIPTION OF DRAWINGS

[0010] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application, illustrate the exemplary embodiments of the present application and their description serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0011] Figure 1a A structural schematic diagram of a computing cluster system is provided for an exemplary embodiment of the present application;

[0012] Figure 1b A structural schematic diagram of a computing cluster system is provided for another exemplary embodiment of the present application;

[0013] Figure 2 A structural schematic diagram of a service mesh system for implementing an identity-based authentication and authorization mechanism is provided for another exemplary embodiment of the present application;

[0014] Figure 3 A flowchart of an identity authentication method is provided for another exemplary embodiment of the present application;

[0015] Figure 4 A structural schematic diagram of a node device is provided for still another exemplary embodiment of the present application. DETAILED DESCRIPTION

[0016] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below in combination with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0017] In order to solve the technical problem of how to solve the communication security problem between services in microservices, in some embodiments of the present application, a service mesh system for implementing an identity-based authentication and authorization mechanism between at least two services is added in a computing cluster system, and the service mesh system at least includes a management and control component, an identity registration component and an authorization proxy component. The identity registration component reports the diversified identity data corresponding to the first service obtained by the identity registration component to the management and control component; the management and control component generates a security policy and a digital certificate corresponding to the first service according to the diversified identity data, and delivers them to the corresponding authorization proxy component; the authorization proxy component performs identity authentication on the corresponding service according to the security policy and the digital certificate, and proxies the communication between at least two services after the identity authentication is passed. With the cooperation of the management and control component, the identity registration component and the authorization proxy component, the identity-based authentication and authorization mechanism can be implemented between services without affecting the running of the services, thereby solving the communication security problem between services

[0018] The technical solutions provided by the embodiments of the present application will be described in detail below in combination with the drawings.

[0019] Figure 1a A structural schematic diagram of a computing cluster system is provided for an exemplary embodiment of the present application. As shown in the figure, Figure 1a The computing cluster system 100 includes at least one computing cluster, and these computing clusters are used to carry services under a microservices architecture, but are not limited to services under the microservices architecture. In the embodiments of the present application, the services are used to implement part of the functions in an application, that is, the services can be implemented as functional modules of the application, or can also implement all the functions of an application, that is, the services can be implemented as an application. Among them, each service carried in the computing cluster can also be referred to as a workload in the computing cluster.

[0020] In the embodiment, the computing cluster system 100 can include one or more computing clusters, each of which includes various physical devices such as servers, computers, terminal devices, gateway devices, etc., and also includes physical lines for network interconnection between the physical devices, and the services or workloads can be carried by the physical devices, i.e., various services can run on the physical devices. It should be noted that the scale, resource amount, and cluster type of different computing clusters can be the same or different. In addition, the manner in which different computing clusters carry services can be the same or different. For example, some computing clusters can use container technology to carry various services, i.e., services are deployed and run in a container environment; some computing clusters can use traditional virtual machine technology to carry various services, i.e., services are deployed and run in a virtual machine environment. Among them, Docker technology can be used, and a Pod is deployed on the physical device in the computing cluster to manage the services in the computing cluster in the granularity of a Pod. Among them, one or more services can be deployed in each Pod, and in addition, the same service can be deployed in one Pod or distributed to multiple Pods, which can be determined according to application requirements, and the embodiments of the present application do not limit this. As shown in FIG. 8, the computing cluster system 100 is illustrated by taking computing cluster 1 and computing cluster 2 as examples, the services in the computing cluster 1 are deployed and run in a virtual machine environment, and the computing cluster 1 can be an ECS-based virtual machine cluster; the services in the computing cluster 2 are deployed and run in a container environment, and the computing cluster 2 can be a Kubernetes-based container cluster. Figure 1a

[0021] In the embodiments of the present application, different services belonging to the same application can need to coordinate and cooperate with each other to provide complete application functions to the outside, and in order to realize coordination and cooperation, communication is needed between the services. It should be noted that in addition to the communication between different services belonging to the same application, different services belonging to different applications can also need to communicate due to service sharing or other reasons. In the embodiments of the present application, it is not limited whether the two services that need to communicate belong to the same application. In addition, the two services that need to communicate can be deployed in the same computing cluster or in different computing clusters. In order to realize communication between services, a service mesh system is deployed in the computing cluster system 100, which can serve as an infrastructure layer for inter-service communication, and is used to proxy communication between services, so that services do not need to concern each other's deployment address information to complete data transmission between each other.

[0022] ​In addition, in order to ensure the security of communication between services, in the embodiment of the present application, the service network system can also implement an identity-based authentication and authorization mechanism between services. Alternatively, the identity-based authentication and authorization mechanism implemented by the service mesh system in the embodiment can be a zero-trust security mechanism, that is, a security concept that should not automatically trust any service regardless of whether it is in the same network or security domain, that is, any two services communicating with each other need to be authenticated and authorized based on identity, and only after passing the identity-based authentication and authorization can data communication be carried out.

[0023] In the embodiment of the present application, the service mesh system, as an infrastructure layer for processing service-to-service communication, is responsible for constructing complex service topologies of modern cloud-native applications to reliably deliver requests; in addition, by providing an identity-based authentication and authorization mechanism, it can also reduce the attack area in the cloud-native environment and provide the basic framework required for a zero-trust application network. Through the service mesh system provided in the embodiment, the security of service-to-service can be ensured, and end-to-end encryption of the service mesh, service-level identity authentication, and fine-grained authorization policies can be ensured.

[0024] In the embodiment, the service mesh system is composed of a control plane and a data plane. The control plane is used to provide policies and / or configurations for the data plane. Specifically, the control plane is a set of services running in a dedicated namespace. These services perform some control management functions, including aggregating telemetry data, providing user-oriented APIs, providing control data to data plane agents, etc., which collectively drive the behavior of the data plane. In other words, the control plane is used to control the behavior of the agents on the entire service mesh system. Service routing rules, identity verification policies, or collecting metrics and configuring parameters of the data plane can be specified on the control plane. Generally, the communication between the data plane and the control plane is specified by API definitions. The data plane is composed of a series of transparent agents running beside each service instance. The data plane enables each service to communicate with other services not directly through network calls, but by calling its local agent component to communicate with the agent component in other services. The agent component encapsulates the complex logic of service-to-service exchange. A set of interconnected agent components in the service mesh constitutes the entire data plane. Based on the service mesh system provided in the embodiment of the present application, at least one computing cluster can support the following functions:

[0025] 1. Implement bidirectional identity-based authentication authorization or service-oriented identity-based authentication authorization between services, support automatic rotation of digital certificates and other life cycle management, and all communications between services are authenticated and encrypted. In the identity-based authentication authorization mechanism of the embodiments of the present application, the authentication mechanism can be a secure transmission layer protocol (TLS) authentication mechanism, but is not limited thereto. 2. Enable more fine-grained authorization based on identity, and authorization based on other dimension parameters. Based on role-based access control (RBAC), support the "least privilege" position, that is, only authorized services can communicate with each other according to the allow (ALLOW) / deny (DENY) rule. The implementation structure of the service mesh system provided in the embodiments of the present application is described in detail as follows:

[0026] As shown in Figure 1a , the service mesh system 10 provided in the embodiments of the present application includes a management and control component 11, an identity registration component 12, and an authorization proxy component 13. The management and control component 11 is a component of the control plane, and the identity registration component 12 and the authorization proxy component 13 are components of the data plane. In the embodiments of the present application, the management and control component 11 can be independently deployed, for example, independently deployed in the cloud, or can be deployed in a certain computing cluster; the identity registration component 12 can also be independently deployed, or deployed in a certain computing cluster; and the authorization proxy component 13 can be deployed in each computing cluster.

[0027] The identity registration component 12 is configured to provide identity registration services and identity customization services for each service carried by the computing cluster system 100, and based on the identity registration services and the identity customization services, the identity registration component 12 can obtain diversified identity metadata corresponding to each service and report the diversified identity metadata to the management and control component 11. In the embodiments of the present application, the service mesh system processes each service in the same or similar manner, and for the sake of description, the first service is taken as an example for description. The first service is any one of the services carried by the computing cluster system 100. For the first service, the identity registration component can obtain diversified identity metadata corresponding to the first service based on the identity registration services and the identity customization services provided to the outside and report the diversified identity metadata to the management and control component.

[0028] The management and control component 11 is configured to receive the diversified identity information of the first service provided by the identity registration component, generate a security policy and a digital certificate of the first service according to the diversified identity metadata of the first service, and deliver the security policy and the digital certificate to the corresponding authorization proxy component in the computing cluster where the first service is located.

[0029] The authorization agent component 13 is configured to receive and store the security policy and the digital certificate of the first service issued by the management component 11 locally, and in the case that the first service needs to communicate with a second service, perform identity authentication on the first service according to the security policy and the digital certificate of the first service, and in the case that the identity authentication is passed, proxy the first service to communicate with the second service; wherein the first service is any one of the at least two services carried in the computing cluster system, and the second service is another service different from the first service.

[0030] Further, the identity registration component 12 can also be referred to as an identity registrar, which can automatically monitor services in the computing cluster system, and can support both application services running in the form of Pod containers in the Kubernetes cluster and application services running on virtual machines or physical machines, and does not limit whether the services are mounted with service accounts. The application services in the form of Pod containers and running on virtual machines or physical machines can all be taken as examples of the services in the embodiments of the present application, but are not limited thereto. In addition, the identity registration component also provides identity registration services for these services, that is, allows these services to initiate registration to the identity registration component, and in addition, the identity registration component also provides identity customization services for these services, that is, allows users to customize identity metadata for these services, so as to realize the diversification of the identity metadata. Based on this, when the identity registration component obtains diversified identity metadata corresponding to the first service based on the identity registration services and the identity customization services, the following steps can be implemented:

[0031] receiving an identity registration request initiated for the first service, obtaining first identity metadata corresponding to the first service from the identity registration request, and obtaining second identity metadata customized by a user for the first service from a specified metadata storage object; the first identity metadata and the second identity metadata form diversified identity metadata corresponding to the first service.

[0032] In this embodiment, the initiation form of the identity registration request is various, for example, the first service can automatically send the identity registration component when a set trigger event is monitored; or the user can initiate the registration through the service management page according to the registration requirement, and the embodiment is not limited to this. The first identity metadata can include at least one of the identification information of the computing cluster where the first service is located, the user account or service account associated with the first service, and the identification information of the physical node where the first service is located. The second identity metadata includes the running environment identifier of the first service, for example, if the first service is a Pod dependent on a container environment, the second identity metadata can include the identifier of the container image on which the first service depends (referred to as identity metadata based on container image tag). Further, the second identity metadata can also include the geographical location where the first service is deployed (referred to as identity metadata based on geographical location), the information of the physical node (referred to as identity metadata based on node) where the first service is located, and identity metadata based on other hardware attribute information, and the embodiment is not limited to this.

[0033] In some optional embodiments of the present application, the management component 11 can provide a declarative API to the user, and the essence of the declarative API is that when the user submits a description of an API object to the management component, the management component will be responsible for ensuring that the state of each resource in the entire cluster is consistent with the requirements described in the API object. Accordingly, when the management component 11 generates the security policy of the first service according to the diversified identity metadata corresponding to the first service, it is specifically used for: receiving security policy requirement description information submitted by the user through the declarative API; and generating the security policy of the first service according to the security policy requirement description information and the diversified identity metadata.

[0034] In the embodiments of the present application, the internal implementation structure of the management component is not limited. In an optional embodiment, as shown in FIG. 6, the management component 11 can include a security policy generation component 1101 and a security policy enforcement component 1102. Figure 1bAs shown, an internal implementation structure of the management and control component 11 includes a policy control module 111, an identity management module 112, and a certificate issuing module 113. Among them, the declarative API is provided by the policy control module 111; the identity management module 112 is configured to receive the diversified identity metadata of the first service reported by the identity registration component, and store the diversified identity metadata of the first service into an identity information base after standardization processing; the policy control module 111 is configured to receive the security policy requirement description information submitted by the user through the declarative API, generate the security policy of the first service according to the security policy requirement description information and the diversified identity metadata of the first service, and deliver the security policy to the corresponding authorization agent component in the computing cluster where the first service is located. The certificate issuing module 113 is configured to, in the case of receiving the certificate issuing request sent by the authorization agent component corresponding to the first service, obtain the diversified identity metadata of the first service from the identity information base through the identity management module, generate the digital certificate of the first service according to the diversified identity metadata of the first service, and deliver the digital certificate to the authorization agent component corresponding to the first service.

[0035] Further, when generating the security policy of the first service according to the security policy requirement description information and the diversified identity metadata of the first service, the policy control module 111 is specifically configured to: select first target identity metadata from the diversified identity metadata of the first service; and generate the security policy of the first service according to the security policy requirement description information and the first target identity metadata; wherein the first target identity metadata is part of the diversified identity metadata, or can also be all of the diversified identity metadata.

[0036] Correspondingly, when generating the digital certificate of the first service according to the diversified identity metadata of the first service, the certificate issuing module 113 is specifically configured to: select second target identity metadata from the diversified identity metadata of the first service, and generate the digital certificate of the first service according to the second target identity metadata; wherein the first target identity metadata and the second target identity metadata are at least partially the same. Similarly, the second target identity metadata is part of the diversified identity metadata, or can also be all of the diversified identity metadata.

[0037] In this embodiment, the internal implementation structure of the authorization agent component 13 is not limited. For example, as shown in FIG. 2, the internal implementation structure of the authorization agent component 13 includes a policy enforcement module 131 and a certificate verification module 132. Among them, the policy enforcement module 131 is configured to receive the security policy of the first service delivered by the policy control module 111, and implement the security policy of the first service; the certificate verification module 132 is configured to receive the digital certificate of the first service delivered by the certificate issuing module 113, and verify the digital certificate of the first service. Figure 1bAs shown, an internal implementation structure of the authorization agent component 13 provided by the embodiment of the application includes a policy engine module 131 and a service mesh agent component 132. For each policy engine module 131, it is configured to receive a security policy for a service in the computing cluster where the policy engine module 131 is located and perform identity authentication. Taking the policy engine module in the computing cluster where the first service is located as an example, the policy engine module 131 is configured to receive, in the case of being located in the computing cluster where the first service is located, a security policy of the first service issued by a policy control module in the management component. Correspondingly, for each service mesh agent component 132, on the one hand, it is configured to send a certificate issuance request to a certificate issuing module in the management component for a service that the service mesh agent component 132 is proxying and receive a digital certificate returned by the certificate issuing module, and on the other hand, it is configured to initiate an identity authentication request to the policy engine module when the service that the service mesh agent component 132 is proxying needs to communicate with other services and, in the case that the identity authentication is passed, proxy the service that the service mesh agent component 132 is proxying to communicate with the other services. Still taking the service mesh agent component in the computing cluster where the first service is located as an example, the service mesh agent component is configured to send a certificate issuance request to the certificate issuing module in the management component for the first service in the case of being located in the computing cluster where the first service is located and corresponding to the first service (where corresponding to the first service means that the service mesh agent component is a transparent proxy of the first service and is responsible for proxying the first service to perform identity authentication and communication, etc.), and receive a digital certificate of the first service returned by the certificate issuing module; and in the case that the first service needs to communicate with a second service, send an identity authentication request to the policy engine module, the identity authentication request including the digital certificate of the first service; and when receiving an authorization message sent by the policy engine module, proxy the first service to communicate with the second service. Wherein, the policy engine module is further configured to perform identity authentication on the first service according to the digital certificate of the first service included in the identity authentication request sent by the service mesh agent component and the security policy of the first service saved locally, and return an authorization message to the service mesh agent component in the case that the identity authentication is passed, indicating that the first service communicating with the second service is safe, and the service mesh agent component can proxy the first service to communicate with the second service.

[0038] Wherein, there can be multiple security policies for the first service, and then when performing identity authentication on the first service, the digital certificate of the first service can be matched with the multiple security policies one by one, and the identity information of the first service is included in each security policy, and if the identity information of the first service contained in the digital certificate of the first service is matched, it means that the first service passes the identity authentication.

[0039] Further, the embodiment of the application does not limit the internal implementation structure of the service mesh agent component 132, for example, Figure 1bAs shown, one internal implementation structure of the service mesh agent component 132 includes a service agent module 1321 and a certificate management module 1322. Further optionally, the service mesh agent component 132 further includes an agent management module 1323 for managing the life cycle of the service agent module 1321, responsible for starting, stopping, etc. of the service mesh agent binary program or the service mesh agent container. The certificate management module is configured to, in the case that the service mesh agent component to which the certificate management module belongs is located in the computing cluster where the first service is located and corresponds to the first service, send a certificate issuance request to the certificate issuing module in the management component, and receive the digital certificate of the first service returned by the certificate issuing module and save the digital certificate of the first service. The service agent module is configured to listen to the communication needs of the first service, in the case that the first service needs to communicate with the second service, obtain the digital certificate of the first service from the certificate management module, send an authorization request to the policy engine module, and when receiving the authorization message sent by the policy engine module, proxy the first service to communicate with the second service.

[0040] In this embodiment, the computing cluster can be multiple, the first service and the second service can be deployed in different computing clusters, and the first service can be deployed in a virtual machine and the second service can be deployed in a container.

[0041] For ease of understanding, the technical solution of this embodiment will be described in detail below by taking the example of the first service being deployed in a virtual machine and the second service being deployed in a container. Herein, in the case that the first service is deployed in a virtual machine environment, the service mesh agent component corresponding to the first service can be specifically implemented as a service mesh agent binary program, and in the case that the second service is deployed in a container environment, the service mesh agent component corresponding to the second service can be specifically implemented as a service mesh agent container. In the following embodiments, whether the first service or the second service is collectively referred to as a workload.

[0042] 1. The computing cluster system can automatically listen to the workloads in the environment through the workload-oriented identity registration component, which can support both the workloads in the form of Pod containerization running in the Kubernetes cluster and the workloads running in the virtual machine or the physical machine, whether these workloads are mounted with a service account or not.

[0043] 2. The identity registration component reads the identity metadata in the system, sends the identity registration request of the listened workload to the identity management module, and allows the user to customize the identity metadata of the workload through the identity registration component. The identity metadata customized by the user for the workload is also sent to the identity management module. The user-customized identity metadata can support any form of metadata, including the following forms:

[0044] Based on the container image tag, that is, taking the container image tag relied on by the workload as the identity metadata of the workload, to identify the workload;

[0045] Based on the geographical location, that is, taking the geographical location where the workload is deployed as the identity metadata of the workload, to identify the workload, which can correspond to multiple workloads, but one workload can only correspond to one geographical location;

[0046] Based on the host information, that is, taking the information of the host where the workload is located, such as the name, IP address, etc., as the identity metadata of the workload, to identify the workload;

[0047] Based on other software and hardware attributes and other identity metadata.

[0048] 3, The identity management module stores the standardized conversion of the identity metadata registered by each workload into identity information into the identity information library, which can support but not limited to the SPIFFE (Secure Production Identity Framework for Everyone) standard.

[0049] 4, The policy control module provides a cloud-native declarative API for users to define security policies, specifically by obtaining the security policy requirement description information submitted by the user through the API, generating the security policy of the workload according to the security policy requirement description information and the diversified identity information in the identity information library, and issuing these security policies to the policy engine module.

[0050] 5, The certificate issuing module in the management and control component can obtain the identity information of each workload by calling the identity management module, and based on these identity information, when receiving the certificate signing request sent by the certificate management module in the service mesh proxy component, it can generate the security certificate of the workload and issue it to the certificate management module.

[0051] 6, The certificate management module in the service mesh proxy container or service mesh proxy binary program sends a certificate signing request to the certificate issuing module in the management and control component, requesting the certificate issuing module to issue a digital certificate for the corresponding workload, and receives the digital certificate issued by the certificate issuing module.

[0052] 7, When two workloads located in virtual machines and containers need to communicate, the service mesh proxy binary program and the service mesh proxy container access the policy engine module, and the policy engine module performs identity-based authentication and authorization on the two workloads based on the issued security policy. Wherein, when accessing the policy engine module, the digital certificate of the workload is provided to the policy engine module, and the digital certificate includes the identity information of the workload.

[0053] 8、The service mesh agent component of the service mesh system of the embodiment further includes an agent management module for managing the life cycle of the service mesh agent binary program or the service mesh agent container, and is responsible for starting, stopping, and the like of the service mesh agent binary program or the service mesh agent container.

[0054] The service mesh system provided by the embodiment of the application can realize communication based on zero-trust security in a proxy service, and provides a declarative API method to allow definition of a security policy, deploys and installs the service mesh agent component into the data plane through a centralized control plane, and provides corresponding life cycle management; further, the declarative authorization service as a policy control plane can issue a security policy to a specified agent component without affecting a service application; further, the identity-based authentication and authorization mechanism supports listening to an existing workload through an identity registration component, and registers the workload based on identity metadata.

[0055] Figure 2 A structural schematic diagram of a service mesh system provided by another exemplary embodiment of the application is shown. The system is used to implement an identity-based authentication and authorization mechanism, as shown in Figure 2 The service mesh system 20 includes a management and control component 21, an identity registration component 22, and an authorized agent component 23. The service mesh system of the embodiment can be applied to any computing system, as shown in Figure 2 The authorized agent component is distributed in at least one computing cluster in the computing cluster system, but is not limited thereto.

[0056] The identity registration component 22 is used to provide an identity registration service and an identity customization service for a service in the computing cluster system, obtains diversified identity metadata corresponding to the first service based on the identity registration service and the identity customization service, and reports the identity metadata to the management and control component; the management and control component 21 is used to generate a security policy and a digital certificate of the first service according to the diversified identity metadata corresponding to the first service, and issues the security policy and the digital certificate to the corresponding authorized agent component in the computing cluster where the first service is located; the authorized agent component 23 is used to perform identity authentication on the first service according to the security policy and the digital certificate of the first service in the case that the first service needs to communicate with a second service, and proxies the first service to communicate with the second service in the case that the identity authentication is passed; the first service is any service in the computing cluster system, and the second service is another service different from the first service.

[0057] In an optional embodiment, as shown in Figure 2 The internal implementation structure of the management and control component 21 includes a policy control module 211, an identity management module 212, and a certificate issuing module 213. Accordingly, as shown in Figure 2An internal implementation structure of the authorization agent component 23 is shown, which includes a policy engine module 231 and a service mesh agent component 232. As shown in Figure 2 An internal implementation structure of the service mesh agent component 232 is shown, which includes a service agent module 2321 and a certificate management module 2322.

[0058] For detailed implementation and internal implementation structure of the above components, please refer to the foregoing embodiments, which will not be described here.

[0059] Figure 3 A flowchart of an identity authentication method provided by another exemplary embodiment of the present application is shown. The method is applied to a service mesh system, which is used to implement an identity-based authentication and authorization mechanism, as shown in Figure 3 The method includes:

[0060] 301. Based on the identity registration service and the identity customization service provided by each service in the computing cluster system, obtain diversified identity metadata corresponding to a first service;

[0061] 302. Generate a security policy and a digital certificate of the first service according to the diversified identity metadata corresponding to the first service;

[0062] 303. In the case that the first service needs to communicate with a second service, perform identity authentication on the first service according to the security policy and the digital certificate of the first service; and

[0063] 304. In the case that the first service passes the identity authentication, proxy the first service to communicate with the second service by an authorization agent component in the service mesh system; wherein the first service is any service in the computing cluster system, and the second service is another service different from the first service.

[0064] Further, based on the identity registration service and the identity customization service provided by each service in the computing cluster system, obtaining diversified identity metadata corresponding to a first service can be achieved by the following steps:

[0065] Receiving an identity registration request initiated for the first service, obtaining first identity metadata corresponding to the first service from the identity registration request, and obtaining second identity metadata customized by a user for the first service from a specified metadata storage object; the first identity metadata and the second identity metadata form diversified identity metadata corresponding to the first service.

[0066] Further, the method further includes providing a declarative API for a user; and generating a security policy of the first service according to the diversified identity metadata corresponding to the first service can be achieved by the following process:

[0067] receive security policy requirement description information submitted by a user through a declarative API; and generate a security policy of a first service according to the security policy requirement description information and diversified identity metadata.

[0068] Further optionally, the generating of the security policy of the first service according to the security policy requirement description information and the diversified identity metadata comprises: selecting first target identity metadata from the diversified identity metadata; and generating the security policy of the first service according to the security policy requirement description information and the first target identity metadata.

[0069] Correspondingly, the generating of the digital certificate of the first service according to the diversified identity metadata corresponding to the first service comprises: selecting second target identity metadata from the diversified identity metadata, and generating the digital certificate of the first service according to the second target identity metadata; wherein the first target identity metadata is at least partially identical to the second target identity metadata.

[0070] The above method of the embodiment can be applied to Figure 1a or Figure 2 the service network system shown in Figure 1a or Figure 2 the implementation structure of the service grid system, and the detailed implementation process of each step can be referred to the foregoing embodiments, which will not be described here.

[0071] Figure 4 A structural schematic diagram of a node device is provided for another exemplary embodiment of the present application. As shown in Figure 4 the device comprises a memory 44 and a processor 45; the memory 44 is configured to store a computer program, and the processor 45 is coupled to the memory 44 and configured to execute the computer program to be used for:

[0072] obtaining diversified identity metadata corresponding to a first service based on identity registration services and identity customization services provided by each service in a computing cluster system;

[0073] generating a security policy and a digital certificate of the first service according to the diversified identity metadata corresponding to the first service;

[0074] in a case where the first service needs to communicate with a second service, performing identity authentication on the first service according to the security policy and the digital certificate of the first service; and

[0075] in a case where the first service passes the identity authentication, proxying, by an authorized agent component in a service grid system, the first service to communicate with the second service; wherein the first service is any service in a computing cluster system, and the second service is another service different from the first service.

[0076] Further, the processor 45, in obtaining the diversified identity metadata corresponding to the first service based on the identity registration service and the identity customization service provided by each service in the computing cluster-oriented system, is specifically configured to:

[0077] receive an identity registration request initiated for the first service, obtain first identity metadata corresponding to the first service from the identity registration request, and obtain second identity metadata customized by a user for the first service from the specified metadata storage object; the first identity metadata and the second identity metadata form the diversified identity metadata corresponding to the first service.

[0078] Further, the node device can also provide a declarative API for a user; then, the processor 45, in generating the security policy of the first service according to the diversified identity metadata corresponding to the first service, is specifically configured to:

[0079] receive security policy requirement description information submitted by the user through the declarative API; and generate the security policy of the first service according to the security policy requirement description information and the diversified identity metadata.

[0080] Further optionally, the processor 40b, in generating the security policy of the first service according to the security policy requirement description information and the diversified identity metadata, is specifically configured to: select first target identity metadata from the diversified identity metadata; and generate the security policy of the first service according to the security policy requirement description information and the first target identity metadata.

[0081] Correspondingly, the processor 45, in generating the digital certificate of the first service according to the diversified identity metadata corresponding to the first service, is specifically configured to: select second target identity metadata from the diversified identity metadata, and generate the digital certificate of the first service according to the second target identity metadata; wherein the first target identity metadata and the second target identity metadata are at least partially the same.

[0082] Further, as shown in Figure 4 The node device of the embodiment can also include a power supply component 47 and a communication component 46. Figure 4 Some components are only schematically shown in the figure, and it does not mean that the node device only includes Figure 4 the components shown in the figure. In addition, Figure 4 Each component in the node device shown in the figure can be distributedly deployed or centrally deployed, and no limitation is made thereto.

[0083] The node device of the embodiment can be implemented as the aforementioned service mesh system, and the detailed internal implementation structure thereof can be referred to the aforementioned service mesh system embodiment, which will not be described herein again.

[0084] Accordingly, the embodiments of the present application also provide a computer readable storage medium storing a computer program, the computer program being executed to implement the steps performed by the method embodiments.

[0085] Accordingly, the embodiments of the present application also provide a computer program product, comprising computer programs / instructions, which when executed by a processor, cause the processor to implement the steps performed by the method embodiments.

[0086] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer usable program code.

[0087] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems) and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and combinations of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus generate means for implementing the functions specified in one or more flows in the flowcharts and / or one or more blocks in the block diagrams.

[0088] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including instruction means, which implement the functions specified in one or more flows in the flowcharts and / or one or more blocks in the block diagrams.

[0089] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, so that a series of operational steps are performed on the computer or other programmable data processing apparatus to generate a computer-implemented process, so that the instructions executed on the computer or other programmable data processing apparatus provide steps for implementing the functions specified in one or more flows in the flowcharts and / or one or more blocks in the block diagrams.

[0090] In a typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0091] Memory can include non-persistent memory, Random Access Memory (RAM), and / or non-volatile memory, such as Read Only Memory (ROM) or flash memory, in computer readable media. Memory is an example of computer readable media.

[0092] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0093] It should also be noted that the terms "comprising", "containing", or any other variant thereof, are intended to encompass a non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not include only those elements in the list, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus including the certificate issuing module element.

[0094] The above certificate issuing module is only an embodiment of the present application and is not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A computing cluster system, comprising: The system comprises: at least one computing cluster for carrying services, and in the case of at least two services, a communication between the at least two services is based on an identity-based authentication and authorization mechanism; the system further comprises a service mesh system for implementing the identity-based authentication and authorization mechanism, the service mesh system comprising a management component, an identity registration component, and an authorization agent component, the authorization agent component being distributed in the at least one computing cluster; the identity registration component is configured to provide an identity registration service and an identity customization service for each service, obtain diversified identity metadata corresponding to a first service based on the identity registration service and the identity customization service, and report the diversified identity metadata to the management component, wherein the diversified identity metadata comprises identity metadata customized by a user for the first service; the management component is configured to obtain security policy requirement description information submitted by the user, and generate a security policy and a digital certificate of the first service according to the security policy requirement description information and the diversified identity metadata corresponding to the first service, and deliver the security policy and the digital certificate to a corresponding authorization agent component in a computing cluster where the first service is located; the authorization agent component is configured to, in the case that the first service needs to communicate with a second service, perform identity authentication on the first service according to the security policy and the digital certificate of the first service, and in the case that the identity authentication is passed, proxy the first service to communicate with the second service; wherein the first service is any one of the at least two services, and the second service is another service different from the first service.

2. The system of claim 1, wherein, When the identity registration component obtains the diversified identity metadata corresponding to the first service based on the identity registration service and the identity customization service, the identity registration component specifically comprises: receiving an identity registration request initiated for the first service, obtaining first identity metadata corresponding to the first service from the identity registration request, and obtaining second identity metadata customized by a user for the first service from a specified metadata storage object; the first identity metadata and the second identity metadata form the diversified identity metadata corresponding to the first service.

3. The system of claim 1, wherein, The management component provides a declarative API for the user, and before the management component generates the security policy of the first service according to the security policy requirement description information and the diversified identity metadata corresponding to the first service, the management component specifically comprises: receiving security policy requirement description information submitted by the user through the declarative API.

4. The system of claim 3, wherein, The management component comprises a policy control module, an identity management module, and a certificate issuing module; the declarative API is provided by the policy control module; the identity management module is configured to receive the diversified identity metadata reported by the identity registration component, store the diversified identity metadata into an identity information database after standardizing the diversified identity metadata. The policy control module is configured to receive security policy requirement description information submitted by a user through a declarative API, generate a security policy of the first service according to the security policy requirement description information and the diversified identity metadata, and deliver the security policy to a corresponding authorization agent component in a computing cluster where the first service is located. The certificate issuing module is configured to, in a case where a certificate issuing request is received from the authorization agent component corresponding to the first service, obtain the diversified identity metadata from the identity information library through the identity management module, generate a digital certificate of the first service according to the diversified identity metadata, and deliver the digital certificate to the authorization agent component corresponding to the first service.

5. The system of claim 4, wherein, When generating the security policy of the first service according to the security policy requirement description information and the diversified identity metadata, the policy control module is specifically configured to: select first target identity metadata from the diversified identity metadata, and generate the security policy of the first service according to the security policy requirement description information and the first target identity metadata; Accordingly, when generating the digital certificate of the first service according to the diversified identity metadata, the certificate issuing module is specifically configured to: select second target identity metadata from the diversified identity metadata, and generate the digital certificate of the first service according to the second target identity metadata. The first target identity metadata and the second target identity metadata are at least partially the same.

6. The system of claim 1, wherein, Each authorization agent component includes a policy engine module and a service mesh agent component. The policy engine module is configured to, in a case where the policy engine module is located in a computing cluster where the first service is located, receive the security policy of the first service delivered by the management and control component. The service mesh agent component is configured to, in a case where the service mesh agent component is located in the computing cluster where the first service is located and corresponds to the first service, send a certificate issuing request to the management and control component, and receive a digital certificate of the first service returned by the management and control component; and in a case where the first service needs to communicate with a second service, send an identity authentication request to the policy engine module, the identity authentication request including the digital certificate of the first service; and in a case where an authorization message is received from the policy engine module, proxy the first service to communicate with the second service. The policy engine module is further configured to: perform identity authentication on the first service according to the digital certificate of the first service included in the identity authentication request and the security policy of the first service, and return the authorization message to the service mesh agent component in a case where the identity authentication is passed.

7. The system of claim 6, wherein, The service mesh agent component includes a service agent module and a certificate management module. The certificate management module is configured to, in a case where the service mesh agent component to which the certificate management module belongs is located in the computing cluster where the first service is located and corresponds to the first service, send a certificate issuing request to the management and control component, and receive a digital certificate of the first service returned by the management and control component. The service proxy module is configured to, in the case that the first service needs to communicate with a second service, acquire the digital certificate of the first service from the certificate management module, send an authorization request to the policy engine module, and proxy the first service to communicate with the second service upon receiving an authorization message sent by the policy engine module.

8. The system according to any one of claims 1-7, characterized in that, The first service is deployed in a virtual machine, and the second service is deployed in a container.

9. A service mesh system for implementing an identity-based authentication authorization mechanism, characterized in that, Comprise: A management component, an identity registration component, and an authorization proxy component, wherein the authorization proxy component is distributed in at least one computing cluster in the computing cluster system; The identity registration component is configured to provide an identity registration service and an identity customization service for services in the computing cluster system, acquire diversified identity metadata corresponding to a first service based on the identity registration service and the identity customization service, and report the diversified identity metadata to the management component, wherein the diversified identity metadata includes identity metadata customized by a user for the first service; The management component is configured to acquire security policy requirement description information submitted by a user, generate a security policy and a digital certificate of the first service based on the security policy requirement description information and the diversified identity metadata corresponding to the first service, and distribute the security policy and the digital certificate to a corresponding authorization proxy component in a computing cluster where the first service is located; The authorization proxy component is configured to, in the case that the first service needs to communicate with a second service, perform identity authentication on the first service based on the security policy and the digital certificate of the first service, and proxy the first service to communicate with the second service in the case that the identity authentication is passed, wherein the first service is any service in the computing cluster system, and the second service is another service different from the first service.

10. An identity authentication method applied to a service mesh system, the service mesh system being used to implement an identity-based authentication and authorization mechanism, characterized in that, The method comprises: Acquiring diversified identity metadata corresponding to a first service based on an identity registration service and an identity customization service provided for each service in a computing cluster system; Acquiring security policy requirement description information submitted by a user, and generating a security policy and a digital certificate of the first service based on the security policy requirement description information and the diversified identity metadata corresponding to the first service; In the case that the first service needs to communicate with a second service, performing identity authentication on the first service based on the security policy and the digital certificate of the first service; and In the case that the first service passes the identity authentication, proxying, by an authorization proxy component in the service mesh system, the first service to communicate with the second service, wherein the first service is any service in the computing cluster system, and the second service is another service different from the first service.

11. The method of claim 10, wherein, Acquiring diversified identity metadata corresponding to a first service based on an identity registration service and an identity customization service provided for each service in a computing cluster system comprises: receiving an identity registration request initiated for a first service, obtaining first identity metadata corresponding to the first service from the identity registration request, and obtaining second identity metadata customized by a user for the first service from a specified metadata storage object; the first identity metadata and the second identity metadata form diversified identity metadata corresponding to the first service.

12. The method according to claim 10 or 11, characterized in that, Also comprising providing a declarative API for users; Then, before generating the security policy of the first service according to the security policy requirement description information and the diversified identity metadata corresponding to the first service, the method further comprises: receiving security policy requirement description information submitted by the user through the declarative API.

13. A node device, characterized by comprise: a memory and a processor; the memory is configured to store a computer program, and the processor is coupled to the memory and configured to execute the computer program, so as to: based on the identity registration service and the identity customization service provided for each service in the computing cluster system, obtain diversified identity metadata corresponding to a first service; generate a security policy and a digital certificate of the first service according to the diversified identity metadata corresponding to the first service; in the case that the first service needs to communicate with a second service, perform identity authentication on the first service according to the security policy and the digital certificate of the first service; and in the case that the first service passes the identity authentication, proxy the first service to communicate with the second service by an authorization agent component in the service mesh system; wherein the first service is any service in the computing cluster system, and the second service is another service different from the first service.

14. A computer readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, the processor is caused to implement the steps in the method of any one of claims 10-12.

Images