Virtual cryptographic machine container image protection method based on cryptographic technology

Abstract

The application discloses a virtual cryptographic machine container image protection method based on a cryptographic technique, and belongs to the technical field of information security, and comprises the following steps: a VSM release image production preparation stage, a VSM release image production stage and a VSM release image import stage; after a conventional VSM container image is produced, the conventional VSM container image is encrypted by using a symmetric block cipher algorithm, the image ciphertext is signed by using a digital signature algorithm, the image ciphertext and the signature value are produced into a container image again, and finally, a VSM release image is obtained; then, the VSM release image import stage is carried out. The application can realize the confidentiality, integrity and source reliability protection of the VSM container image; the VSM release image can only be decrypted and used in a cryptographic machine matched with a key, can effectively prevent the image from being analyzed, tampered and counterfeited in the distribution and use process, and guarantees the operation safety of the cryptographic machine.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically, to a method for protecting virtual cryptographic machine container images based on cryptographic technology. Background Technology

[0002] Cryptography is a core technology for ensuring network information security, including symmetric cryptography algorithms, asymmetric cryptography algorithms, and hash cryptography algorithms. Symmetric cryptography is mainly used for data encryption and decryption to protect data confidentiality; hash cryptography and asymmetric cryptography algorithms are often used in combination to implement digital signature technology, which is used to protect data integrity and authenticate the source of data.

[0003] With the rapid development of cloud computing technology, container virtualization technology has gradually matured and become more widespread, and has also been widely used in cryptographic machines. Cryptographic machines using container technology no longer run cryptographic applications directly. Instead, they first create a Virtual Cryptographic Machine (VSM) based on a container image, and then run the cryptographic application within the VSM. A single cryptographic machine can provide the same key management and cryptographic service functions as multiple traditional cryptographic machines, better adapting to the application requirements of multi-tenancy and on-demand allocation in current cloud computing environments.

[0004] The container images used to create VSMs (Virtual Private Cloud) devices using conventional container virtualization technology are identical to ordinary container images. They consist of a compressed package containing the application and its dependent runtime environment, formatted according to relevant specifications. Their contents can be directly decompressed using compression tools, posing security risks such as tampering, counterfeiting, and unreliable origin. Since the cryptographic device is a critical foundational security infrastructure, importing an unauthorized VSM container image into the cryptographic device will affect its stable operation, increase the risk of key leakage, and thus reduce the system's reliability and security. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method for protecting virtual machine container images based on cryptographic technology. This method can protect the confidentiality, integrity, and reliability of the source of VSM container images; it can effectively prevent the images from being analyzed, tampered with, and counterfeited during distribution and use, and ensure the operational security of the cryptographic machine.

[0006] The objective of this invention is achieved through the following solution:

[0007] A method for protecting a Virtual Machine (VSM) container image based on cryptographic technology includes the following steps: VSM image creation preparation step S1, VSM image creation stage step S2, and VSM image import stage step S3. After completing the creation of a regular VSM container image in the VSM image creation preparation step S1, the regular VSM container image is encrypted using a symmetric block cipher algorithm in the VSM image creation stage step S2, and the image ciphertext is signed using a digital signature algorithm. The image ciphertext and the signature value are then used to create a container image again, finally obtaining the VSM release image. Then, the VSM image import stage step S3 is executed.

[0008] Furthermore, step S1 of the VSM release image creation preparation phase includes the following sub-steps:

[0009] S11, Create an asymmetric key pair for signing VSM container images;

[0010] S12, Use the public key of the asymmetric key pair generated in step S11 to create a certificate request file, and submit the certificate request file to the certificate management system to issue a mirror protection certificate;

[0011] S13, Create a symmetric key for encrypting VSM container images;

[0012] S14, import the symmetric key generated in step S13 into the cryptographic machine and store it in ciphertext form;

[0013] S15, pre-install the certificate chain and certificate revocation list (CRL) of the certificate management system into the cryptographic machine.

[0014] Furthermore, step S2 in the VSM release image creation phase includes the following sub-steps:

[0015] S21, using cryptographic applications and their dependent runtime environments to create regular VSM container images;

[0016] S22, use the symmetric block cipher algorithm and the symmetric key generated in preparation step S1 to encrypt the VSM container image to obtain the VSM ciphertext image;

[0017] S23, use the digital signature algorithm and the private key in the asymmetric key pair generated in preparation step S1 to sign the VSM ciphertext image to obtain the VSM ciphertext signature;

[0018] S24. Using the VSM encrypted image, VSM encrypted signature, and image protection certificate generated in preparation step S1, create a VSM container image for external distribution in accordance with the conventional container creation method, i.e., the VSM release image.

[0019] Furthermore, step S3 in the VSM release image import phase includes the following sub-steps:

[0020] S31, upload or download VSM published images to the cipher machine through the local management system of the cipher machine;

[0021] S32, the cryptographic machine parses the VSM ciphertext image, VSM ciphertext signature and image protection certificate from the VSM release image;

[0022] S33, the cryptographic machine uses a pre-built certificate chain and CRL to verify the validity of the image protection certificate;

[0023] S34: The cryptographic machine uses the mirror protection certificate to verify whether the VSM ciphertext signature matches the VSM ciphertext image;

[0024] S35: The cryptographic machine uses the symmetric key imported in preparation step S1 to decrypt the VSM ciphertext image to obtain the plaintext VSM local image. At this point, the VSM local image can be imported, stored, and used like a regular container image.

[0025] Furthermore, in step S14, the storage includes secure storage in encrypted form or storage using micro-electrical protection.

[0026] Furthermore, an asymmetric key pair for mirror signing is created in the hardware cryptography module.

[0027] The beneficial effects of this invention are:

[0028] By encrypting and signing regular VSM container images using cryptographic techniques, the confidentiality, integrity, and reliability of the source of VSM container images can be protected. VSM published images can only be decrypted and used in cryptographic machines with matching keys, which can effectively prevent images from being analyzed, tampered with, and counterfeited during distribution and use, and ensure the operational security of cryptographic machines.

[0029] The method of this invention targets cryptographic machine devices implemented based on container virtualization technology. It uses cryptographic technologies such as digital signatures and symmetric encryption to protect the confidentiality, integrity and authenticity of the container image of the virtual cryptographic machine, thereby ensuring the security of the container image of the virtual cryptographic machine. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a schematic diagram illustrating the composition of a VSM publishing image according to an embodiment of the present invention;

[0032] Figure 2 A schematic diagram illustrating the steps involved in creating a VSM deployment image according to an embodiment of the present invention;

[0033] Figure 3 This is a schematic diagram illustrating the steps involved in creating a VSM publishing image according to an embodiment of the present invention.

[0034] Figure 4 This is a schematic diagram illustrating the steps of importing a VSM publishing image according to an embodiment of the present invention. Detailed Implementation

[0035] All features disclosed in all embodiments of this specification, or steps in all methods or processes implied in the disclosure, may be combined and / or extended or replaced in any way, except for mutually exclusive features and / or steps.

[0036] The following is based on the appendix Figures 1-4 The present invention will be further described in detail regarding the technical concept, working principle, efficacy, and working process of the present invention.

[0037] Example 1

[0038] This invention addresses the security issues of conventionally used VSM container images by proposing a virtual cryptographic machine (VCM) container image protection method based on cryptographic technology. The technical solution includes: a VSM deployment image creation preparation stage (step S1), a VSM deployment image creation stage (step S2), and a VSM deployment image import stage (step S3). After creating a conventional VSM container image in the preparation stage (step S1), the conventional VSM container image is encrypted using a symmetric block cipher algorithm in the creation stage (step S2), and the ciphertext is signed using a digital signature algorithm. The ciphertext and signature value are then combined to create another container image, resulting in the final VSM deployment image. Finally, the VSM deployment image import stage (step S3) is executed.

[0039] like Figure 1 As shown, VSM publishes an image (IMG). VSM ) by VSM ciphertext mirror C VSM ciphertext signature S VSM and Mirror Protection Certificate Cert IS Composition. Among them, the ciphertext mirror C VSM It is obtained by encrypting the VSM local image using a symmetric encryption algorithm and a symmetric key CK: C VSM =Enc(CK,VSM) RAW ); Ciphertext Signature S VSMIt is obtained by signing the ciphertext mirror using a digital signature algorithm and the private key SK of an asymmetric key pair: S VSM =Sig(SK,C VSM ); Mirror protection certificate Cert IS It is issued by a certificate management system, and the public key in the certificate is the public key PK of an asymmetric key pair.

[0040] Example 2

[0041] Based on Example 1, such as Figure 2 As shown, the steps in the preparation phase of creating a VSM deployment image are as follows:

[0042] Step 1: Create an asymmetric key pair for mirror signing in a dedicated hardware cryptographic module, including a public key PK and a private key SK;

[0043] Step 2: Use the PK generated in Step 1 to create a certificate request file, and submit the certificate request file to the CA system to issue the certificate (Certificate). IS ;

[0044] Step 3: Create a symmetric key CK for mirror encryption in the dedicated hardware cryptographic module;

[0045] Step 4: Import the CK generated in Step 3 into the cryptographic machine and store it securely in encrypted form or with micro-electronic protection.

[0046] Step 5: Pre-install the CA system's Certificate Chain (Certificate Chain) and Certificate Revocation List (CRL) into the cryptographic machine.

[0047] Example 3

[0048] Based on Example 1, such as Figure 3 As shown, the steps for creating a VSM deployment image are as follows:

[0049] Step 1: Create a regular local VSM container image (IMG) using the cryptographic application and its dependent runtime environment. RAW ;

[0050] Step 2: Encrypt the local VSM container image using a symmetric block cipher algorithm and CK to obtain the ciphertext VSM image: C VSM =Enc(CK,IMG RAW );

[0051] Step 3: Use the digital signature algorithm and SK to check C VSM Obtain the encrypted signature by signing: S VSM =Sig(SK,C VSM );

[0052] Step 4: Use CertIS C VSM and S VSM Create a VSM container image (IMG) for external distribution using standard container creation methods. VSM .

[0053] The final VSM deployment image IMG VSM It can only be used normally in cryptographic machines with matching keys.

[0054] Example 4

[0055] Based on Example 1, such as Figure 4 As shown, the steps for importing a VSM deployment image are as follows:

[0056] Step 1: Upload or download the VSM publishing image IMG from the image repository via the local management system. VSM into the cipher machine;

[0057] Step 2: The cipher machine from IMG VSM C is parsed from VSM S VSM and Cert IS ;

[0058] Step 3: The cipher machine verifies the Cert using the pre-set CertChain and CRL. IS If the validity of the verification is successful, proceed to the next step; otherwise, end the process.

[0059] Step 4: The cipher machine uses Cert IS Verify S VSM Is it related to C? VSM If a match is found and the verification passes, proceed to the next step; otherwise, end the process.

[0060] Step 5: The cipher machine uses the symmetric key CK imported during the preparation phase to decrypt C. VSM Obtain the plaintext local image of VSM: IMG RAW =Dec(CK,C VSM ).

[0061] If the functions of this invention are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium, and all or part of the steps of the methods described in the various embodiments of this invention are executed in a computer device (which may be a personal computer, server, or network device, etc.) and the corresponding software. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, or optical discs. Test data or actual data resides in read-only memory (RAM), random access memory (RAM), etc., during program implementation.

Claims

1. A method for protecting virtual cryptographic machine container images based on cryptographic technology, characterized in that, The process includes the following steps: VSM deployment image preparation stage step S1, VSM deployment image creation stage step S2, and VSM deployment image import stage step S3. After completing the creation of a regular VSM container image in VSM deployment image preparation stage step S1, the regular VSM container image is encrypted using a symmetric block cipher algorithm in VSM deployment image creation stage step S2, and the ciphertext image is signed using a digital signature algorithm. The ciphertext image and the signature value are then used to create a container image again, resulting in the VSM deployment image. Then, the VSM deployment image import stage step S3 is executed. Step S1 in the VSM deployment image preparation phase includes the following sub-steps: S11, Create an asymmetric key pair for signing VSM container images; S12, Use the public key of the asymmetric key pair generated in step S11 to create a certificate request file, and submit the certificate request file to the certificate management system to issue a mirror protection certificate; S13, Create a symmetric key for encrypting VSM container images; S14, import the symmetric key generated in step S13 into the cryptographic machine and store it in ciphertext form; S15, Pre-install the certificate chain and certificate revocation list (CRL) of the certificate management system into the cryptographic machine; Step S2 in the VSM deployment image creation phase includes the following sub-steps: S21, using cryptographic applications and their dependent runtime environments to create regular VSM container images; S22, use the symmetric block cipher algorithm and the symmetric key generated in preparation step S1 to encrypt the VSM container image to obtain the VSM ciphertext image; S23, use the digital signature algorithm and the private key in the asymmetric key pair generated in preparation step S1 to sign the VSM ciphertext image to obtain the VSM ciphertext signature; S24. Using the VSM encrypted image, VSM encrypted signature, and image protection certificate generated in preparation step S1, create a VSM container image for external release in accordance with the conventional container creation method, i.e., VSM release image; Step S3 in the VSM deployment image import phase includes the following sub-steps: S31, upload or download VSM published images to the cipher machine through the local management system of the cipher machine; S32, the cryptographic machine parses the VSM ciphertext image, VSM ciphertext signature and image protection certificate from the VSM release image; S33, the cryptographic machine uses a pre-built certificate chain and CRL to verify the validity of the image protection certificate; S34: The cryptographic machine uses the mirror protection certificate to verify whether the VSM ciphertext signature matches the VSM ciphertext image; S35: The cryptographic machine uses the symmetric key imported in preparation step S1 to decrypt the VSM ciphertext image to obtain the plaintext VSM local image. At this point, the VSM local image can be imported, stored, and used like a regular container image.

2. The method for protecting virtual cryptographic machine container images based on cryptographic technology according to claim 1, characterized in that, In step S14, the storage includes secure storage in encrypted form or storage with micro-electrical protection.

3. The method for protecting virtual cryptographic machine container images based on cryptographic technology according to claim 1, characterized in that, Create an asymmetric key pair for mirror signing in the hardware cryptography module.

Images