Automatic encryption system for data in containers

Abstract

A system for automatic encryption of data in containers. A method of managing sensitive data. A computer system identifies sensitive data for a set of application containers using configuration information for the set of application containers. The computer system encrypts the identified sensitive data for the set of application containers to form encrypted sensitive data. The computer system saves the encrypted sensitive data to shared storage used by the set of application containers when the set of application containers is deployed.

Description

Technical Field

[0001] This disclosure generally relates to an improved computer system, and more specifically to methods, apparatus, computer systems, and computer program products for automatically encrypting data in containers. Background Technology

[0002] Containers are decoupled from the underlying infrastructure. Containers virtualize processor units, memory, storage, and network resources at the operating system level. In other words, containers use operating system virtualization, allowing multiple containers to run on the same operating system kernel.

[0003] Sensitive data is a critical consideration for customers using cloud platforms. Sensitive data can include information such as passwords, authentication tokens, and Secure Shell Protocol (SSH) information. Containers can use this information to perform operations, including accessing other systems or resources. It is undesirable to store this information in plaintext within the container. Sensitive information can be encrypted. Sensitive data should be manually encrypted in the deployment code used by application developers and containers.

[0004] For example, sensitive data can be encrypted using cryptographic sensitive data stored in objects (such as a secret in Kubernetes). Kubernetes is an open-source container orchestration system that can be used to automate the deployment, scaling, and management of computer applications. Kubernetes was developed by the Cloud Native Computing Foundation (CNCF). The deployment code of a container includes references to secrets and keys to decrypt encrypted sensitive data.

[0005] This sensitive data can be changed. For example, a parameter's value can be changed, or a new parameter can be added. With these changes, the modified sensitive information needs to be manually encrypted in the deployment code. For instance, the container is encoded to reference a secret that stores encrypted sensitive data. If the sensitive data changes, the changes to the sensitive data are encrypted and placed in another secret. In this case, the container's deployment code is modified to reference a new secret containing the updated encrypted sensitive data.

[0006] Furthermore, the application developer and the sensitive data manager can be different entities. When sensitive data is modified by the sensitive data manager, the application developer is often unaware that the change has occurred until they encounter a problem and report it to the application's container. As a result, the application may not function correctly until the deployment code is changed and the container used for the application is redeployed. Summary of the Invention

[0007] According to one illustrative embodiment, a computer implements a method for managing sensitive data. The computer system identifies sensitive data of a set of application containers using configuration information of those containers. The computer system encrypts the identified sensitive data of the set of application containers to form encrypted sensitive data. When deploying the set of application containers, the computer system saves the encrypted sensitive data to a shared storage device used by the set of application containers. According to other illustrative embodiments, a computer system and computer program product for managing sensitive data are provided.

[0008] Therefore, by enabling the automatic encryption of sensitive data using shared encryption services and supporting customization when encrypting sensitive data, the illustrative embodiments provide technical effects and practical applications in the field of sensitive data management.

[0009] The illustrative embodiment also determines whether the sensitive data of the group of application containers has changed after it has been encrypted to form encrypted sensitive data, and in response to determining that such a change has occurred, re-encrypts the sensitive data using the change to form updated encrypted sensitive data. The encrypted sensitive data is then updated with the updated encrypted sensitive data. The updated encrypted sensitive data can then be used by the group of application containers. Therefore, the illustrative embodiment ensures that sensitive data remains up-to-date for use by application containers, thereby reducing problems when containers operate using expired sensitive data. Furthermore, the illustrative embodiment avoids the need to modify the container's programming and restart the container when the encrypted sensitive data changes. Attached Figure Description

[0010] Figure 1 It is a diagram illustrating a cloud computing environment in which illustrative embodiments can be implemented;

[0011] Figure 2 It is a diagram illustrating the abstract model layer according to an illustrative embodiment;

[0012] Figure 3 It is a graphical representation of a data processing system network that can implement the illustrative embodiments;

[0013] Figure 4 This is a block diagram of an application management environment according to an illustrative embodiment;

[0014] Figure 5 This is an illustration of a container manager according to an exemplary embodiment;

[0015] Figure 6 This is a message flow diagram illustrating the steps performed to manage sensitive data in an application container according to an exemplary embodiment.

[0016] Figure 7This is a data flow diagram for managing sensitive data according to an exemplary embodiment;

[0017] Figure 8 This is a diagram illustrating configuration information according to an illustrative embodiment;

[0018] Figure 9 This is a flowchart of a process for creating an application deployment according to an illustrative embodiment;

[0019] Figure 10 This is a flowchart of a process for managing sensitive data according to an illustrative embodiment;

[0020] Figure 11 This is a flowchart of a process for obtaining encrypted sensitive data of an application container according to an exemplary embodiment;

[0021] Figure 12 This is a flowchart of a process for accessing encrypted sensitive data in an application container, according to an exemplary embodiment.

[0022] Figure 13 This is a flowchart of a process for managing sensitive data according to an exemplary embodiment;

[0023] Figure 14 This is a flowchart of a process for managing sensitive data according to an exemplary embodiment;

[0024] Figure 15 This is a flowchart of a process for determining whether sensitive data has been changed, according to an exemplary embodiment.

[0025] Figure 16 This is a flowchart of a process for managing sensitive data according to an illustrative embodiment;

[0026] Figure 17 This is a flowchart of a process for identifying sensitive data according to an exemplary embodiment;

[0027] Figure 18 This is a flowchart of a process for encrypting sensitive data according to an exemplary embodiment;

[0028] Figure 19 This is a flowchart of a process for encrypting sensitive data according to an exemplary embodiment;

[0029] Figure 20 This is a flowchart illustrating a process for storing encrypted sensitive data according to an exemplary embodiment; and

[0030] Figure 21 This is a block diagram of a data processing system according to an illustrative embodiment. Detailed Implementation

[0031] This invention can be a system, method, and / or computer program product at any possible level of integrated technical detail. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to execute aspects of the invention.

[0032] Computer-readable storage media can be tangible devices capable of retaining and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital universal disk (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or protrusions in slots having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through fiber optic cables), or electrical signals transmitted through wires.

[0033] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device or to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the corresponding computing / processing device.

[0034] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as a standalone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet through an Internet service provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may execute computer-readable program instructions by personalizing the electronic circuitry with state information utilizing the computer-readable program instructions in order to perform aspects of this invention.

[0035] This document describes various aspects of the invention with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0036] These computer-readable program instructions may be provided to a computer processor or other programmable data processing apparatus to produce a machine, such that these instructions, which execute via the computer processor or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, wherein the computer-readable storage medium storing the instructions comprises an article of manufacture containing instructions that implement aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0037] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other apparatus to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other apparatus to produce a computer-implemented process, such that the instructions executed on the computer, other programmable apparatus, or other apparatus implement the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0038] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than indicated in the figures. For example, two consecutively shown blocks may actually be completed as a single step, executed simultaneously, substantially simultaneously, or with partial or complete temporal overlap, or the blocks may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0039] Therefore, illustrative embodiments provide methods, apparatus, systems, and computer program products for automatically encrypting sensitive data. In the illustrative embodiments, sensitive data can be obtained from a location identified in configuration information. The sensitive data can be automatically encrypted using the configuration information and stored during the deployment of an application's container. The illustrative embodiments also recognize and consider that changes to the sensitive data can be detected, wherein the sensitive data can be automatically encrypted and automatically deployed for use by the application's container. Such detection of changes to the sensitive data can be used using checksums.

[0040] It should be understood that although this disclosure includes a detailed description of cloud computing, the implementation of the teachings set forth herein is not limited to a cloud computing environment. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0041] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services), which can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0042] The characteristics are as follows:

[0043] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power, such as server time and network storage, as needed, without requiring human interaction with the service provider.

[0044] Extensive network access: Capabilities are available through the network and accessed via standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0045] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. There is a sense of location independence because consumers typically do not have control or knowledge of the exact location of the resources provided, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0046] Rapid flexibility: The ability to provide capacity quickly and flexibly, automatically scaling down and up rapidly in some situations to scale up rapidly. For consumers, the available supply capacity often appears unlimited and can be purchased in any quantity at any time.

[0047] Measurable services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0048] The service model is as follows:

[0049] Software as a Service (SaaS): This provides consumers with the ability to use a provider's applications running on cloud infrastructure. These applications can be accessed from different client devices via a thin client interface such as a web browser (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities, with possible exceptions such as limited user-specific application configuration settings.

[0050] Platform as a Service (PaaS): This provides consumers with the ability to deploy applications created or acquired by the consumer using programming languages ​​and tools supported by the provider onto cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the deployed applications and the configuration of any application hosting environment.

[0051] Infrastructure as a Service (IaaS): This provides consumers with the capability to offer processing, storage, networking, and other basic computing resources that enable consumers to deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but rather have control over the operating system, storage, deployed applications, and potentially limited control over selected networking components (e.g., host firewalls).

[0052] The deployment model is as follows:

[0053] Private cloud: A cloud infrastructure that operates solely for an organization. It can be managed by the organization or a third party and can exist on-site or off-site.

[0054] Community cloud: A cloud infrastructure shared by several organizations and supporting a specific community with shared concerns (e.g., tasks, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can exist on-site or off-site.

[0055] Public cloud: Cloud infrastructure that is made available to the public or large industry groups and is owned by an organization that sells cloud services.

[0056] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain a single entity but are bound together by standardized or proprietary technologies that enable data and applications to be ported together (e.g., cloud bursts for load balancing between clouds).

[0057] Cloud computing environments are service-oriented, focusing on statefulness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure that includes a network of interconnected nodes.

[0058] See now Figure 1 The diagram illustrates a cloud computing environment that can implement illustrative embodiments. In this illustrative example, the cloud computing environment 100 includes a collection of one or more cloud computing nodes 110 to which local computing devices used by cloud consumers can communicate, such as, for example, personal digital assistants or smartphones 120A, desktop computers 120B, laptop computers 120C, and / or automotive computer systems 120N.

[0059] Cloud computing nodes 110 can communicate with each other and can be physically or virtually grouped into one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds or combinations thereof as described above. This allows cloud computing environment 100 to provide infrastructure, platform, and / or software as a service without requiring cloud consumers to maintain resources on local computing devices (such as local computing devices 120A-120N). It should be understood that the types of local computing devices 120A-120N are intended to be illustrative only, and cloud computing nodes 110 and cloud computing environment 100 can communicate with any type of computerized device, for example, using a web browser via any type of network and / or network-addressable connection.

[0060] See now Figure 2 A diagram illustrating an illustrative abstract model layer according to an illustrative embodiment is provided. The set of functional abstract layers shown in this illustrative example can be provided by a cloud computing environment, such as... Figure 1 The cloud computing environment in the context of 100. It should be understood beforehand that... Figure 2 The components, layers, and functions shown are intended to be illustrative only, and embodiments of the invention are not limited thereto. As described, the following layers and corresponding functions are provided.

[0061] The abstraction layer of the cloud computing environment 200 includes a hardware and software layer 202, a virtualization layer 204, a management layer 206, and a workload layer 208. The hardware and software layer 202 includes the hardware and software components of the cloud computing environment. Hardware components may include, for example, a mainframe 210, servers 212 and 214 based on a RISC (Reduced Instruction Set Computer) architecture, blade servers 216, storage devices 218, and networks and network components 220. In some illustrative embodiments, software components may include, for example, network application server software 222 and database software 224.

[0062] The virtualization layer 204 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 226; virtual storage 228; virtual network 230, including virtual private network; virtual application and operating system 232; and virtual client 234.

[0063] In one example, management layer 206 can provide the functions described below. Resource provisioning 236 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and pricing 238 provides cost tracking as resources are utilized within the cloud computing environment and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 240 provides access to the cloud computing environment for consumers and system administrators. Service level management 242 provides cloud resource allocation and management to ensure that required service levels are met. Service level agreement (SLA) planning and fulfillment 244 provides pre-scheduling and procurement of cloud resources based on anticipated future needs according to the SLA.

[0064] Workload layer 208 provides examples of functionalities that can leverage a cloud computing environment. Example workloads and functionalities that may be provided by workload layer 208 may include mapping and navigation 246, software development and lifecycle management 248, virtual classroom education delivery 250, data analytics and processing 252, transaction processing 254, and container orchestration 256.

[0065] In this example, container orchestration 256 provides a means for management. Figure 1 Deployment or access of applications in a cloud computing environment 100 Figure 1 The cloud computing environment 100 provides services for the network in the physical location of the cloud. In the illustrative example, container orchestration 256 can provide automated application deployment scaling and management. For example, container orchestration 256 can automate the deployment, scaling, and operation of application containers across different host clusters. An application container is a container used for at least one of the processes or functions of an application.

[0066] See now Figure 3 This image depicts a graphical representation of a data processing system network in which illustrative embodiments can be implemented. The network data processing system 300 is a computer network in which illustrative embodiments can be implemented. The network data processing system 300 includes a network 302, which is a medium for providing communication links between different devices and computers connected together within the network data processing system 300. The network 302 may include connections such as wired, wireless communication links, or fiber optic cables.

[0067] In the depicted example, server computers 304 and 306 are connected to network 302 along with storage unit 308. Additionally, client device 310 is connected to network 302. As described, client device 310 includes client computers 312, 314, and 316. Client device 310 can be, for example, a computer, workstation, or network computer. In the depicted example, server computer 304 provides information such as boot files, operating system images, and applications to client device 310. Furthermore, client device 310 may also include other types of client devices, such as mobile phone 318, tablet computer 320, and smart glasses 322. In this illustrative example, server computer 304, server computer 306, storage unit 308, and client device 310 are network devices connected to network 302, where network 302 is the communication medium for these network devices. Some or all of client devices 310 can form an Internet of Things (IoT) network, where these physical devices can connect to network 302 and exchange information with each other through network 302.

[0068] In this example, client device 310 is a client of server computer 304. Network data processing system 300 may include additional server computer, client computer, and other devices not shown. Client device 310 is connected to network 302 using at least one of a wired connection, a fiber optic connection, or a wireless connection.

[0069] The program code located in the network data processing system 300 can be stored on a computer-recordable storage medium and downloaded to the data processing system or other devices for use. For example, the program code can be stored on a computer-recordable storage medium on a server computer 304 and downloaded to a client device 310 via network 302 for use on the client device 310.

[0070] In the depicted example, network data processing system 300 is the Internet, where network 302 represents a global collection of networks and gateways that communicate with each other using the Transmission Control Protocol / Internet Protocol (TCP / IP) protocol suite. The core of the Internet is the backbone of high-speed data communication lines between master nodes or host computers, which consist of thousands of other computer systems used for business, government, education, and routing data and messages. Of course, network data processing system 300 can also be implemented using many different types of networks. For example, network 302 can include at least one of the following: the Internet, intranet, local area network (LAN), metropolitan area network (MAN), or wide area network (WAN). Figure 3 This is intended as an example, not as an architectural limitation for different illustrative embodiments.

[0071] As used in this article, "multiple" when referring to a project means one or more projects. For example, "multiple different types of networks" means one or more different types of networks.

[0072] Furthermore, when the phrase "at least one" is used with a list of items, it means that different combinations of one or more of the listed items can be used, and it is possible that only one of each item in the list is needed. In other words, "at least one" means that any combination of items and multiple items in the list can be used, but not all items in the list. Items can be specific objects, things, or categories.

[0073] For example, but not limited to, "at least one of Item A, Item B, or Item C" can include Item A, Item A and Item B, or Item B. The example could also include Item A, Item B and Item C, or Item B and Item C. Of course, any combination of these items can exist. In some illustrative examples, "at least one" can be, for example, but not limited to, two Item A; one Item B; and ten Item C; four Item B and seven Item C; or other suitable combinations.

[0074] The container orchestration platform 330 can be, for example... Architecture, environment, etc. However, it should be understood that the description using illustrative examples of Kubemetes is merely an example architecture and not a limitation of the illustrative embodiments. The container orchestration platform 330 can also be referred to as a container orchestration system.

[0075] The container orchestration platform 330 provides a platform for automating the deployment, scaling, and operation of customer applications. The container orchestration platform 330 also provides automated deployment, scaling, and operation of Pods 331. Each Pod in Pod 331 comprises multiple containers 332 running customer application workloads 333 across a cluster of worker nodes 334. These worker nodes are also referred to as host nodes or microcomponents. While the term "Pod" is commonly used in the Kubernetes paradigm, the term "Pod" as used herein is not limited to this environment but refers to any grouping of multiple containers 332 where workloads are deployed and keep running applications, libraries, and their dependencies.

[0076] Containers are standard units of software for applications, packaging program instructions and all their dependencies so that the application can run on multiple computing environments. Containers isolate software from the environment in which they run and ensure that the container functions uniformly across different environments. An application's container can share the operating system kernel on the machine with other containers used for other applications. Therefore, not every container running on a machine needs its own operating system.

[0077] Controller node 336 corresponds to the cluster of worker nodes 334 that execute client application workloads. Controller node 336 receives and tracks service requests from client device users that correspond to the execution of services by client application 333. Controller node 336 is the master control unit of the cluster of worker nodes 334, managing the client applications in the cluster and orchestrating communication across the cluster. Worker nodes in worker nodes 334 are physical or virtual machines where containers for applications are deployed. While the terms "controller node" and "worker node" are commonly used in the Kubernetes paradigm, these terms are not limited to this environment and refer to any type of node capable of controlling and running client application 333.

[0078] In this illustrative example, container orchestration platform 330 manages sensitive data 338, which is used by multiple containers 332 within Pods 331 running on worker nodes 334. Management of sensitive data 338 can be performed in a manner that increases protection for sensitive data 338 while providing flexibility in updating the sensitive data 338 used by containers 332.

[0079] See now Figure 4 A block diagram depicts an application management environment according to an illustrative embodiment. In this illustrative example, a container environment 400 includes components that can be managed on hardware (such as...). Figure 1 The hardware and cloud computing environment 100 shown in the figure Figure 3 The component implemented in the network data processing system 300.

[0080] In this illustrative example, container environment 400 includes computer system 404 and container manager 406. As shown, container manager 406 resides within computer system 404. In this illustrative example, container manager 406 can operate on a group of application containers 408 for managing multiple applications 410. Container manager 406 can operate to manage sensitive data 412 used by the application container group 408 for the multiple applications 410.

[0081] As used in this article, when referring to a project, "a set" means one or more projects. For example, a set of application containers 408 is one or more application containers.

[0082] The container manager 406 can be implemented in software, hardware, firmware, or a combination thereof. When software is used, the operations performed by the container manager 406 can be implemented in program instructions configured to run on hardware such as a processor unit. When firmware is used, the operations performed by the container manager 406 can be implemented in program instructions and data and stored in persistent memory for execution on a processor unit. When hardware is used, the hardware may include circuitry that operates to perform the operations in the container manager 406.

[0083] In the illustrative examples, the hardware may take the form of at least one of the following: a circuit system, an integrated circuit, an application-specific integrated circuit (ASIC), a programmable logic device, or some other suitable type of hardware configured to perform multiple operations. Using a programmable logic device, the device can be configured to perform multiple operations. The device can be reconfigured later or can be permanently configured to perform multiple operations. Programmable logic devices include, for example, programmable logic arrays, programmable array logic, field-programmable logic arrays, field-programmable gate arrays, and other suitable hardware devices. Furthermore, the process can be implemented in organic components integrated with inorganic components and can consist entirely of organic components other than human-made ones. For example, these methods can be implemented as circuits in organic semiconductors.

[0084] Computer system 404 is a physical hardware system and includes one or more data processing systems. When more than one data processing system exists in computer system 404, those data processing systems communicate with each other using a communication medium. The communication medium may be a network. The data processing systems may be selected from at least one of a computer, a server computer, a tablet computer, or some other suitable data processing system.

[0085] In this illustrative example, container manager 406 manages sensitive data 412 used by a group of application containers 408 in a way that reduces errors and increases the speed at which changes to sensitive data 412 can propagate to application containers 408. Container manager 406 can identify sensitive data 412 of application container group 408 using configuration information 414 of application container group 408. Configuration information 414 may include the location 416 of sensitive data 412, an identifier 418 for encrypting sensitive data 412, and an encryption algorithm 420 for encrypting sensitive data 412.

[0086] Location 416 can be, for example, a secret, a configuration diagram, a database, a data storage, a file, or some other location where sensitive data 412 can reside. Furthermore, location 416 can identify multiple objects in which sensitive data 412 can reside. For example, location 416 can identify a first secret, a second secret, and a configuration diagram, with the configuration diagram being an object in which sensitive data 412 can reside. In other words, sensitive data 412 can exist in more than one object identified by location 416.

[0087] Identifier 418 identifies sensitive data 412 from other sensitive data or information that may exist at location 416. Encryption algorithm 420 identifies the type of encryption that can be performed on sensitive data 412 to generate encrypted sensitive data 422. For example, encryption algorithm 420 may be, for example, Advanced Encryption Standard (AES), Advanced Encryption Standard 256, Rivest-Shamir-Adleman (RSA), Data Encryption Standard (DES), and other suitable encryption methods. Thus, using configuration information 414, container manager 406 can identify what sensitive data 412 is to be used by application container group 408 and location 416 of sensitive data 412.

[0088] This display of configuration information 414 is not intended to limit the invention to these types of information used to manage sensitive data 412. For example, in some implementations, encryption algorithm 420 may be omitted. For example, standard encryption methods and encryption levels may be set to default values. In another example, location 416 may be an extended location where sensitive data 412 can be found.

[0089] In this illustrative example, container manager 406 can encrypt sensitive data 412 identified for the group of application containers 408 to form encrypted sensitive data 422. When encrypting sensitive data 412 to form encrypted sensitive data 422, container manager 406 can use an encryption algorithm 420 specified by configuration information 414 for the group of application containers 408 to encrypt sensitive data 412 to form encrypted sensitive data 422.

[0090] Container manager 406 can save encrypted sensitive data 422 to shared storage device 424 used by the group of application containers 408 when deploying the group of application containers 408. In this illustrative example, shared storage device 424 can be any storage device accessible by the group of application containers 408.

[0091] For example, shared storage device 424 could be a volume within a Pod 426 where a group of application containers 408 reside. In an exemplary example, shared storage device 424 could be an emptyDir volume that is first created when Pod 426 is assigned a node and exists as long as Pod 426 is running on that node. In the example depicted herein, the emptyDir volume is initially empty, and all containers in Pod 426 can read and write the same file. The volume is managed on the same or different paths for each container in Pod 426. Therefore, when shared storage device 424 takes the form of a volume, container manager 406 can store encrypted sensitive data 422 as a volume used by that group of application containers 408.

[0092] In this illustrative example, container manager 406 may consider that sensitive data 412 may change over time while a set of application containers 408 of applications in multiple applications 410 are running. For example, container manager 406 may periodically or in response to potentially non-periodic events to determine whether a change to sensitive data 412 has occurred. For example, a non-periodic event could be a user-initiated check for a change. As another example, a non-periodic event could be access to the storage where sensitive data 412 is located.

[0093] As depicted, container manager 406 can determine whether sensitive data 412 has been modified after it was encrypted to form encrypted sensitive data 422 for the group of application containers 408. Container manager 406 can, in response to determining that a change has occurred to sensitive data 412, re-encrypt the modified sensitive data 412 to form updated encrypted sensitive data 428. Container manager 406 can utilize the updated encrypted sensitive data 422. In this example, the updated encrypted sensitive data 428 is used by the group of application containers 408. As a result, the group of application containers 408 does not use the version of sensitive data 412.

[0094] Determining whether an alteration has occurred can be done in several different ways. For example, sensitive data 412 has a first checksum 430 generated before or during the encryption of sensitive data 412 to form encrypted sensitive data 422. Container manager 406 can generate a second checksum 432 of sensitive data 412 after the generation of the first checksum 430. Using these two checksums, container manager 406 can compare the first checksum 430 with the second checksum 432 to form a comparison 434. Container manager 406 can use the comparison of checksums to determine whether an alteration has occurred in sensitive data 412.

[0095] If the 434 indicator checksums are the same, then no change has occurred. If the 434 indicator checksums are different and a change has occurred, then the sensitive data 412 can be encrypted to generate updated encrypted sensitive data 428 for use by the group of application containers 408.

[0096] In the illustrative example, changes to sensitive data 412 can occur in many different ways. For example, new sensitive data can be added to sensitive data 412. For instance, new sensitive data can be added to sensitive data 412 by adding a new secret to the secret currently containing sensitive data 412. This new sensitive data could be an additional password for a new resource. In another illustrative example, this change can occur as a name change to an attribute name in sensitive data 412. For example, the attribute name "dbPassword" can be changed to "dbKeyPassword". As another example, sensitive data values ​​can be changed. For example, the database password in sensitive data 412 can be changed. These changes can be handled by updating configuration information 414. In this way, no changes to the deployment and container code are required. Furthermore, changes can be made without restarting the application container.

[0097] In the illustrative example, container manager 406 can automatically handle these different types of changes to sensitive data 412 without additional work. In different illustrative examples, changes to sensitive data 412 can be handled based on updated configuration information 414.

[0098] Next, turn to Figure 5 The illustration depicts a container manager according to an illustrative embodiment. In this figure, an example of one implementation of container manager 406 is shown. As described, container manager 406 may include orchestration tool 500, cryptographic service 502, and configuration container 504.

[0099] Orchestration Tool 500 is a software component that manages the deployment and operation of containers. Orchestration Tool 500 executes container (such as...) Figure 4 The orchestration tool 500 is responsible for the automatic configuration, coordination, and management of a group of application containers 408. The orchestration tool 500 can be used in any environment where the group of application containers 408 can run. The orchestration tool 500 can take many different forms. For example, the orchestration tool 500 can be, for example, Google Kubemetes Engine (GKE), Helm, Carrier, Docker Swam, and other suitable tools.

[0100] Encryption service 502 is a service that can be deployed by orchestration tool 500. Configuration container 504 can be used as a container for applications using this set of applications, container 408. Figure 4This is part of the deployment of multiple applications 410. In this illustrative example, a configuration container 504 may be added as part of the deployment of containers and other resources for the application being deployed. Figure 4 Pod 426 in the configuration. Container 504 can start running before the application container to obtain encrypted sensitive data and store that encrypted sensitive data in a local shared storage device that the application container can use.

[0101] In the illustrative example, the container 504 operation is configured for purchasing and management. Figure 4 The encrypted sensitive data 422 in the container. Configuration container 504 is the opposite of the application containers in this group of application containers 408, which are used to operate and execute the application's workload. Configuration container 504 can take many different forms. For example, when container manager 406 uses a container orchestration platform such as Kubernetes, configuration container 504 can be one of an init container and a sidecar container.

[0102] Using this example, the configuration container 504 is deployed in Figure 4 It runs in Pod 426 and before the application containers in that group within Pod 426. Container 504 can call encryption service 502 to obtain encrypted sensitive data 422 and store the encrypted sensitive data 422. Figure 4 In the shared storage device 424. Encryption service 502 can identify and encrypt sensitive data 412 in response to a request for encrypted sensitive data 422 received from configuration container 504.

[0103] Figure 4 The computer system 404 can be configured to perform at least one of the steps, operations, or actions described in various illustrative examples using software, hardware, firmware, or a combination thereof. Therefore, the computer system 404 operates as a dedicated computer system, wherein the container manager 406 in the computer system 404 implements improved protection for sensitive data used by the application container 408 compared to current techniques for processing sensitive data.

[0104] For example, compared to a currently available general-purpose computer system without container manager 406, container manager 406 transforms computer system 404 into a dedicated computer system. In an illustrative example, container manager 406 in computer system 404 implements sensitive data protection with greater automation and reduced errors. In one illustrative example, container manager 406 provides flexibility in selecting sensitive data to use with application containers. Furthermore, container manager 406 is also able to update encrypted sensitive data stored in Pods in response to changes in the sensitive data used to generate encrypted sensitive data.

[0105] Therefore, when sensitive data or specific notifications change, one or more illustrative items can increase application automation and reduce application container issues. Furthermore, one or more illustrative examples can automatically update the encrypted sensitive data accessed by the application container in response to changes in the sensitive data from which encrypted sensitive data is derived.

[0106] Furthermore, one or more illustrative examples enhance security by placing encrypted sensitive data in a shared storage device, protecting the sensitive data without exposing it to environmental variables. In one or more illustrative examples, the encryption of sensitive data can be automatically configured within the container. Furthermore, one or more illustrative examples increase compatibility along with the ability to automatically handle changes to sensitive data that occur during upgrades.

[0107] Figure 4 and Figure 5 The depiction of container environment 400 and its various components does not imply any physical or architectural limitations on the manner in which the illustrative embodiments can be implemented. Other components may be used in addition to or in place of the illustrated components. Some components may be unnecessary. Furthermore, boxes are presented to illustrate functional components. When implemented in the illustrative embodiments, one or more of these boxes may be combined, divided, or combined and divided into different boxes.

[0108] For example, container manager 406 can be used to manage sensitive data for multiple applications involved. As another example, when more than one application container exists alongside application container 408, each application container may contain information in encrypted sensitive data 422. As yet another example, application container group 408 may be more than one application container for applications in multiple applications 410.

[0109] See now Figure 6This document describes a message flow diagram illustrating the steps performed to manage sensitive data in an application container according to an illustrative embodiment. In this illustrative example, the orchestration tool 600, the encryption service 602, and the configuration container 604 are respectively... Figure 5 Instances of orchestration tool 500, encryption service 502, and configuration container 504, for example Figure 4 and Figure 5 The implementation of container manager 406 in [the context of the document].

[0110] In this illustrative example, orchestration tool 600 initiates the cryptographic deployment of encryption service 602, making encryption service 602 available for managing sensitive data (step m1). In step m1, deployment is the process of managing Pods in which one or more containers run. Deployment can be a management tool for Pods. While deployment is described in this example, other illustrative examples may use other types of management tools. For example, a stateful button could also be used, which is a similar management tool to deployment but is particularly well-suited for stateful applications.

[0111] The orchestration tool 600 requests the checksum of the deployment of application 606 (step m2). This message is received by the checksum calculator 608 in the cryptographic service 602.

[0112] Conversely, encryption service 602 reads configuration metadata 610 (step m3). Configuration metadata 610 is Figure 4 Example of configuration information 414. Configuration metadata 610 enables encryption service 602 to identify which fields or data fragments of sensitive data will be encrypted, and the location of these fields for the data fragments.

[0113] Encryption service 602 reads sensitive data from location 612 (step m4). Location 612 can point to an object, such as a secret, a configuration graph, or some other suitable data structure. In the illustrative example, location 612 can be more than one object. For example, location 612 could be three secrets and one configuration graph.

[0114] After reading the sensitive data in location 612, encryption service 602 uses checksum calculator 608 to generate a checksum for the identified sensitive data, which can be, for example... Figure 4 The first checksum is 430. This checksum is returned to the orchestration tool 600 (step m5).

[0115] In this illustrative example, orchestration tool 600 initiates application deployment and sets a checksum in the metadata used for application deployment (step m6). In this illustrative example, the checksum is stored in the application deployment managing application 606. This checksum can be used for comparison to later determine whether sensitive data has been altered.

[0116] The application deployment creates Pod 614 for application 606, and configuration container 604 begins running in Pod 614. Configuration container 604 is initialized as part of the deployment of application 606. Configuration container 604 invokes encryption service 602 to obtain encrypted sensitive data (step m7). In the example depicted herein, the invocation is received by encryption algorithm 616 in encryption service 602.

[0117] Encryption algorithm 616 encrypts sensitive data in location 612 identified by configuration metadata 610. The type of encryption algorithm used to encrypt the sensitive data can be determined from the configuration metadata 610. In this illustrative example, encryption algorithm 616 can perform encryption of sensitive data. Optionally, encryption algorithm 616 can invoke external encryption algorithm 618 to encrypt sensitive data (step m8). Encryption algorithm 616 returns the encrypted sensitive data to configuration container 604 in Pod 614 (step m9).

[0118] As depicted, container 604 can save encrypted sensitive data to volume 620 (step m10). This encrypted sensitive data can be stored in a local properties file in volume 620, which is available to other containers in Pod 614, such as application container 622.

[0119] In this illustrative example, application container 622 can load a local properties file from volume 620 (step m11). The local properties file can be exported as an environment variable or installed for use by application container 622. As shown, container 604 can be configured to use encrypted sensitive data because application container 622 has the key required to decrypt the encrypted sensitive data. The key used to decrypt the encrypted sensitive data can be included as part of application container 622 deployed in Pod 614.

[0120] In this illustrative example, the orchestration tool 600 can request checksums periodically (step m12). This request can be made to the checksum calculator 608 in the encryption service 602. The checksum is a new checksum, such as... Figure 4 The second checksum is 432.

[0121] If checksums are exchanged between the first and second checksums, sensitive information stored in volume 620 can be updated. In this illustrative example, orchestration tool 600 can invoke configuration container 604 to perform a rolling update of encrypted sensitive information (step m13). This rolling update may involve configuration container 604 making another request to encryption service 602 to obtain updated encrypted sensitive data, wherein configuration container 604 stores the updated encrypted sensitive information in volume 620 instead of the current encrypted sensitive data.

[0122] Therefore, orchestration tool 600 can create encryption service 602 and periodically request checksums to determine if changes to sensitive data have occurred. In an illustrative example, encryption service 602 can read configuration metadata 610, use the configuration metadata 610 to read sensitive data, calculate a checksum, and encrypt the sensitive data in response to a call from at least one of orchestration tool 600 or configuration container 604. Moreover, in this example, configuration container 604 can invoke encryption service 602 to obtain corrected sensitive data and save the encrypted sensitive data to a shared storage device (such as volume 620).

[0123] Using these components, application container 622 can read encrypted sensitive data for use in performing application operations. In this illustrative example, these components automatically provide encrypted sensitive data to Pod 614 for use by application container 622. Furthermore, these components also update the encrypted sensitive data stored in volume 620 in response to changes detected in the sensitive data. Further, additional flexibility can be employed by encrypting the sensitive data using an external encryption algorithm 618.

[0124] See now Figure 7 This illustration depicts a data flow diagram for managing sensitive data according to an illustrative embodiment. In this illustrative example, the same reference numerals may be used in more than one drawing. This reuse of reference numerals in different drawings indicates the same elements in different drawings.

[0125] In this illustrative example, encryption service 602 reads configuration metadata 610 of sensitive data 700 from identification location 612. Encryption service 602 generates and returns a checksum 702 to orchestration tool 600. As depicted, orchestration tool 600 can send checksum 702 to application deployment 704, which manages containers in pods used for the application. In this example, checksum 702 is stored in application deployment 704 and can be used later to determine whether sensitive data 700 has been altered.

[0126] As depicted, in response to a request for encrypted sensitive data 706 received from configuration container 604, encryption service 602 encrypts sensitive data 700 to form encrypted sensitive data 706 and sends encrypted sensitive data 706 to configuration container 604. Configuration container 604 stores encrypted sensitive data 706 in volume 620. In this example, application container 622 has access to volume 620 and can load and use encrypted sensitive data 706.

[0127] Turning Figure 8 This illustration depicts configuration information according to an illustrative embodiment. In this illustrative example, configuration information 800 is... Figure 4 Configuration information 414 and Figure 6 This is an example of an implementation of configuration metadata 610. As depicted, configuration information 800 defines objects in sections 802 and 804. These objects are locations where sensitive data can be found.

[0128] In this illustrative example, line 805 in section 802 identifies the sensitive data as residing in an object in secret form. Line 806 indicates the path to the secret. The attribute in line 808 identifies the type of sensitive data residing in the secret. Line 810 identifies the variable name used for the type of sensitive data used by the application container. Line 812 identifies the encryption algorithm used to encrypt the sensitive data. In this example, the encryption algorithm is AES.

[0129] Section 804 identifies another object in the form of the configuration diagram in line 814. This object is accessed using the path in line 816. The list of attributes in line 818 identifies the type of sensitive data. Line 820 identifies the encryption algorithm. In this example, the encryption algorithm is hashing.

[0130] Configuration information 800 is merely an example and is not intended to limit how configuration information can be implemented in other embodiments. For example, configuration information 800 may reference one, three, seven, or some other number of objects in which sensitive data may reside for encryption and use by the application container. In another illustrative example, configuration information 800 may be in the form of a table in a database.

[0131] Turning Figure 9 A flowchart depicting a process for creating an application deployment according to an illustrative embodiment is provided. Figure 9 The process can be implemented in hardware, software, or both. When implemented in software, the process can take the form of program instructions executed by one or more processor units in one or more hardware devices located in one or more computer systems. For example, the process can be implemented in... Figure 5 The 500 editing tools in the middle and Figure 6The orchestration tool 600 is implemented in the system. This process can be initiated periodically or in response to events.

[0132] The process begins by invoking an encryption service and obtaining a checksum of the sensitive data (step 900). The process then determines if an application deployment exists (step 902). If no application deployment exists, the process creates an application deployment with the checksum (step 904). The process waits for a period of time (step 906) and then returns to step 900.

[0133] Referring again to step 902, if the application deployment exists, the process determines whether the checksum has changed (step 908). In step 908, the process has previously obtained the checksum and compares it with the checksum obtained in step 902.

[0134] If the checksum has changed, the process updates the checksum in the application deployment (step 910). The process updates the encrypted sensitive data (step 912) and proceeds to step 906. Referring again to step 908, if the checksum has not changed, the process waits for a period of time (step 906).

[0135] See Figure 10 The document describes a flowchart of a process for managing sensitive data according to an illustrative embodiment. Figure 10 The process can be implemented in hardware, software, or both. When implemented in software, the process can take the form of program instructions executed by one or more processor units in one or more hardware devices located in one or more computer systems. For example, the process can be implemented in... Figure 5 Encryption services 502 and Figure 6 The encryption service is implemented in 602.

[0136] The process begins by reading configuration information (step 1000). Sensitive data defined in the configuration information is then processed (step 1002). The process receives a request (step 1004) and determines the type of request (step 1006). If the request type is to obtain encrypted data, the process invokes an encryption service to encrypt the sensitive data (step 1008). The process then returns the encrypted sensitive data to the caller who made the request (step 1012). The process then terminates.

[0137] Referring again to step 1006, if the request is to obtain a checksum, the process generates a checksum using the sensitive data (step 1014). The process returns the checksum to the caller who made the request (step 1016), after which the process terminates.

[0138] Turn now Figure 11The diagram depicts a flowchart of a process for obtaining encrypted sensitive data of an application container according to an illustrative embodiment. Figure 11 The process can be implemented in hardware, software, or both. When implemented in software, the process can take the form of program instructions executed by one or more processor units in one or more hardware devices located in one or more computer systems. For example, it can be implemented in... Figure 5 In the configuration container 504 and in Figure 6 The process is implemented in configuration container 604.

[0139] The process begins by invoking the encryption service (step 1100). In step 1100, the process sends a request to the encryption service to obtain encrypted sensitive data. The process receives the encrypted sensitive data as a response from the encryption service (step 1102). The process saves the encrypted sensitive data to a local properties file on the volume (step 1104). The process then terminates.

[0140] See next. Figure 12 The diagram depicts a flowchart of a process for accessing encrypted sensitive data for an application program container, according to an illustrative embodiment. Figure 12 The process can be implemented in hardware, software, or both. When implemented in software, the process can take the form of program instructions executed by one or more processor units in one or more hardware devices located in one or more computer systems. For example, the process can be implemented in... Figure 4 Application container 408 in the application container and Figure 6 It is implemented in application container 622.

[0141] The process begins by reading and loading encrypted sensitive data from a local properties file on the volume (step 1200). The process then installs the encrypted sensitive data as environment variables into the container and file paths (step 1202). The process then terminates.

[0142] Next turn Figure 13 The document describes a flowchart of a process for managing sensitive data according to an illustrative embodiment. Figure 13 The process can be implemented in hardware, software, or both. When implemented in software, the process can take the form of program instructions executed by one or more processor units in one or more hardware devices located in one or more computer systems. For example, the process can be implemented in... Figure 4 Implemented in the container manager 406 of the computer system 404.

[0143] The process begins by identifying sensitive data for a set of application containers using their configuration information (step 1300). The process then encrypts the identified sensitive data for the set of application containers to form encrypted sensitive data (step 1302).

[0144] When the group of application containers is deployed, the process saves encrypted sensitive data to a shared storage device used by the group of application containers (step 1304). The process then terminates.

[0145] See Figure 14 The document describes a flowchart of a process for managing sensitive data according to an illustrative embodiment. Figure 14 The processing in the middle is available. Figure 13 This is an example of an additional step performed as shown in the flowchart. A step in this flowchart can be performed after step 1304.

[0146] The process determines whether the sensitive data has changed after it was encrypted to form encrypted sensitive data in the group of application containers (step 1400). Then, in response to determining that a change has occurred, the sensitive data is re-encrypted with the change to form updated encrypted sensitive data (step 1402).

[0147] The process updates the encrypted sensitive data with the updated encrypted sensitive data, which is then used by the group of application containers (step 1404). The process then terminates.

[0148] Referring again to step 1400, if no changes have been made to the sensitive data, the process terminates. These steps can be repeated to update the encrypted sensitive data used by that group of application containers.

[0149] Turning Figure 15 A flowchart illustrating a process for determining whether sensitive data has been altered, according to an illustrative embodiment, is provided. The process in this flowchart is... Figure 14 An example of how step 1400 is implemented. In this illustrative example, a first checksum is generated for the sensitive data before encrypting it.

[0150] The process generates a second checksum for the sensitive data (step 1500). The process compares the first checksum with the second checksum to form a comparison (step 1502).

[0151] The process determines whether changes have occurred in the sensitive data based on this comparison (step 1504). The process then terminates.

[0152] See Figure 16The document describes a flowchart of a process for managing sensitive data according to an illustrative embodiment. Figure 16 The process can be utilized Figure 13 An example of additional steps performed in the flowchart described above. In this example, these steps can be performed by... Figure 5 Configuration container 504 and Figure 6 The configuration container in the Pod returned a 604 error. The configuration container can reside in the same Pod where the application container is deployed.

[0153] The process begins with a configuration container in the computer system requesting encrypted sensitive data from an encryption service, where the configuration container is used by the group of application containers (step 1600). The process then receives the encrypted sensitive data from the encryption service (step 1602). The configuration container saves the encrypted sensitive data received in step 1602 to a shared storage device for use by the group of application containers. The process then terminates.

[0154] See Figure 17 A flowchart depicts a process for identifying sensitive data according to an illustrative embodiment. Figure 17 The processing in is Figure 13 An example of an embodiment of step 1300 in the example.

[0155] The process uses configuration information to identify what sensitive data is (step 1700). The process uses configuration information to identify the location of sensitive data (step 1702). The process then terminates.

[0156] See Figure 18 The diagram depicts a flowchart of a process for encrypting sensitive data according to an illustrative embodiment. Figure 18 The process is Figure 13 An example of the embodiment of 1302 in the example.

[0157] The process encrypts the sensitive data of the group of application containers using an encryption algorithm specified by the configuration information of the group of application containers to form encrypted sensitive data (step 1800). The process then terminates.

[0158] See Figure 19 The diagram depicts a flowchart of a process for encrypting sensitive data according to an illustrative embodiment. Figure 19 The process is Figure 13 An example of the embodiment of 1302 in the example.

[0159] The process uses an encryption service to encrypt the sensitive data of the identified group of application containers to form encrypted sensitive data (step 1900). The process then terminates.

[0160] Next turn Figure 20The diagram depicts a flowchart of a process for storing encrypted sensitive data according to an illustrative embodiment. Figure 20 The process is Figure 13 An example of the implementation of step 1304 in the example.

[0161] When the group of application containers is deployed, the process saves encrypted sensitive data to a volume used by the group of application containers (step 2000). The process then terminates.

[0162] The flowcharts and block diagrams depicting the various embodiments illustrate the architecture, functionality, and operation of some possible implementations of the devices and methods in the illustrative embodiments. In this regard, each block in a flowchart or block diagram may represent at least one of a module, segment, function, or operation or step. For example, one or more blocks may be implemented as program instructions, hardware, or a combination of program instructions and hardware. When implemented in hardware, the hardware may, for example, take the form of an integrated circuit manufactured or configured to perform one or more operations in the flowchart or block diagram. When implemented as a combination of program instructions and hardware, the implementation may take the form of firmware. Each block in a flowchart or block diagram may be implemented using a dedicated hardware system performing different operations or a combination of dedicated hardware and program instructions executed by the dedicated hardware.

[0163] In some alternative implementations of the illustrative embodiments, one or more functions indicated in the boxes may not occur in the order shown in the figures. For example, in some cases, depending on the functions involved, two boxes shown consecutively may be executed substantially simultaneously, or these boxes may sometimes be executed in reverse order. Furthermore, additional boxes may be added besides those shown in the flowcharts or block diagrams.

[0164] Turn now Figure 21 A block diagram of a data processing system according to an illustrative embodiment is depicted. The data processing system 2100 can be used to implement... Figure 1 Cloud computing node 110 Figure 1 The personal digital assistant (PDA) or smartphone 120A, desktop computer 120B, laptop computer 120C, and / or automotive computer system 120N are included. The data processing system 2100 can be used to implement... Figure 2 The computer in the hardware and software layer 202 and Figure 3 The data processing system 2100 includes server computer 304, server computer 306, and client device 310. It can also be used to implement... Figure 4The computer system 404 is shown. In this illustrative example, the data processing system 2100 includes a communication framework 2102 that provides communication between the processor unit 2104, memory 2106, persistent memory 2108, communication unit 2110, input / output (I / O) unit 2112, and display 2114. In this example, the communication framework 2102 takes the form of a bus system.

[0165] Processor unit 2104 is used to execute instructions for software that can be loaded into memory 2106. Processor unit 2104 includes one or more processors. For example, processor unit 2104 may be selected from at least one of a multi-core processor, a central processing unit (CPU), a graphics processing unit (GPU), a physical processing unit (PPU), a digital signal processor (DSP), a network processor, or some other suitable type of processor. Furthermore, processor unit 2104 may be implemented using one or more heterogeneous processor systems, in which the primary and secondary processors reside on a single chip. As another illustrative example, processor unit 2104 may be a symmetric multiprocessor system containing multiple processors of the same type on a single chip.

[0166] Memory 2106 and persistent storage device 2108 are examples of storage device 2116. A storage device is any hardware capable of storing information, such as, but not limited to, data, program instructions in the form of functions, or at least other suitable information on a temporary, permanent, or both temporary and permanent basis. In these illustrative examples, storage device 2116 may also be referred to as a computer-readable storage device. In these examples, memory 2106 may be, for example, random access memory or any other suitable volatile or non-volatile storage device. Persistent storage 2108 may take various forms depending on the specific implementation.

[0167] For example, persistent storage 2108 may include one or more components or devices. For example, persistent storage 2108 may be a hard disk drive, a solid-state drive (SSD), flash memory, a rewritable optical disk, a rewritable magnetic tape, or a combination of the above. The media used in persistent storage 2108 may also be removable. For example, a removable hard disk drive may be used for persistent storage 2108.

[0168] In these illustrative examples, communication unit 2110 provides communication with other data processing systems or devices. In these exemplary examples, communication unit 2110 is a network interface card.

[0169] The input / output unit 2112 allows data input and output to other devices that can be connected to the data processing system 2100. For example, the input / output unit 2112 can provide a connection for user input via at least one of a keyboard, mouse, or some other suitable input device. Furthermore, the input / output unit 2112 can send output to a printer. The display 2114 provides a mechanism for displaying information to the user.

[0170] Instructions for at least one of an operating system, application, or program may be located in a storage device 2116 that communicates with the processor unit 2104 via a communication frame 2102. Processes in different embodiments may be executed by the processor unit 2104 using computer-implemented instructions that may be located in memory (such as memory 2106).

[0171] These instructions are referred to as program instructions, computer-usable program instructions, or computer-readable program instructions that can be read and executed by a processor in processor unit 2104. The program instructions in different embodiments may be embedded on different physical or computer-readable storage media, such as memory 2106 or persistent memory 2108.

[0172] Program instructions 2118 are functionally located on a computer-readable medium 2120, which is selectively removable and can be loaded onto or transferred to a data processing system 2100 for execution by a processor unit 2104. In these illustrative examples, program instructions 2118 and computer-readable medium 2120 form a computer program product 2122. In the illustrative examples, computer-readable medium 2120 is a computer-readable storage medium 2124.

[0173] Computer-readable storage medium 2124 is a physical or tangible storage device for storing program instructions 2118, and not a medium for propagating or transmitting program instructions 2118. As used herein, computer-readable storage medium 2124 should not be construed as a transient signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0174] Alternatively, a computer-readable signal medium can be used to transfer program instructions 2118 to the data processing system 2100. The computer-readable signal medium is a signal and can be, for example, a propagated data signal containing program instructions 2118. For example, the computer-readable signal medium can be at least one of an electromagnetic signal, an optical signal, or any other suitable type of signal. These signals can be transmitted via a connection (such as a wireless connection, fiber optic cable, coaxial cable, wire, or any other suitable type of connection).

[0175] Furthermore, as used herein, "computer-readable medium 2120" can be singular or plural. For example, program instructions 2118 may be located in computer-readable medium 2120 in the form of a single storage device or system. In another instance, program instructions 2118 may be located in computer-readable medium 2120 distributed across multiple data processing systems. In other words, some instructions in program instructions 2118 may be located in one data processing system, while other instructions in program instructions 2118 may be located in another data processing system. For example, a portion of program instructions 2118 may be located in computer-readable medium 2120 in a server computer, while another portion of program instructions 2118 may be located in computer-readable medium 2120 in a group of client computers.

[0176] The different components shown for data processing system 2100 do not imply an architectural limitation on how different embodiments can be implemented. In some illustrative examples, one or more components may be incorporated into or otherwise formed part of another component. For example, in some exemplary examples, memory 2106 or a portion thereof may be incorporated into processor unit 2104. Different illustrative embodiments may be implemented in data processing systems that include components other than or in lieu of those shown for data processing system 2100. Figure 21 Other components shown may differ from the illustrative example shown. Different embodiments can be implemented using any hardware device or system capable of executing program instructions 2118.

[0177] Therefore, illustrative embodiments provide a computer-implemented method, computer system, and computer program product for managing sensitive data used by containers and applications. In one illustrative example, configuration information identifies sensitive data used by application containers within a Pod. This configuration information is used to locate and encrypt the sensitive data to form encrypted sensitive data. The encrypted sensitive data is stored in a shared storage device within the Pod, which can be accessed by the application container.

[0178] In an illustrative example, a configuration container is included in the deployment of a Pod. The configuration container starts running to obtain cryptographically sensitive data and stores it in shared storage. This process can occur before the application is ready to run.

[0179] Furthermore, in some illustrative examples, the sensitive data used to form the encrypted sensitive data can be examined to determine if it has changed. In response to changes in the sensitive data, the sensitive data can be re-encrypted to form updated encrypted sensitive data. This updated encrypted sensitive data can then be used to update the encrypted sensitive data in the shared storage device.

[0180] Therefore, one or more illustrative examples enable the automation of sensitive data management in a way that reduces or avoids the need to modify the code used to deploy application containers. Furthermore, one or more illustrative examples allow sensitive data to be updated when changes occur while the application container is running. In the illustrative examples, the update can occur without restarting or redeploying the application container. As a result, sensitive data can be managed automatically, thereby reducing the errors and problems involved in current techniques that require recoding application deployments.

[0181] Furthermore, by placing encrypted sensitive data within a shared storage device, the illustrative example enhances security by protecting sensitive data without exposing it to environmental variables. Furthermore, encryption of sensitive data can occur automatically using a configuration container. Furthermore, increased compatibility occurs alongside the ability to automatically handle changes to sensitive data that occur during upgrades. The illustrative example can also use sophisticated logic code to handle key encryption keys, algorithms, and multiple sensitive data values ​​to reduce the error rate of current technologies.

[0182] Descriptions of various illustrative embodiments have been presented for purposes of illustration and description and are not intended to be exhaustive or limited to the embodiments disclosed. The various illustrative examples describe components that perform actions or operations. In the illustrative embodiments, components may be configured to perform the described actions or operations. For example, a component may have a configuration or design that provides the component with the ability to perform actions or operations described in the illustrative examples as being performed by the component. Furthermore, within the scope of the terms “comprising,” “including,” “having,” “containing,” and variations thereof used herein, these terms are intended to be inclusive in a manner similar to the term “comprising” as an open-ended transitional term, without excluding any additional or other elements.

[0183] Various embodiments of the invention have been described for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Not all implementations will include all features described in the illustrative examples. Furthermore, different illustrative embodiments may provide different features compared to other illustrative embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, their practical application, or technical improvements to technologies found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. A computer-implemented method for managing sensitive data, the method comprising: The computer system uses the configuration information of a set of application containers to identify the sensitive data of that set of application containers; The computer system encrypts the sensitive data of the identified group of application containers to form encrypted sensitive data; When deploying this group of application containers, the computer system saves the encrypted sensitive data to a shared storage device used by the group of application containers; After the sensitive data in the group of application containers is encrypted to form the encrypted sensitive data, the computer system determines whether the sensitive data has been changed. In response to determining that the change in the sensitive data has occurred, the computer system uses the change to re-encrypt the sensitive data to form updated encrypted sensitive data; as well as The computer system uses the updated encrypted sensitive data to update the encrypted sensitive data, wherein the updated encrypted sensitive data is used by the group of application containers.

2. The computer-implemented method according to claim 1, wherein, The sensitive data has a first checksum generated before encrypting the sensitive data to form the encrypted sensitive data, and wherein, after the sensitive data in the set of application containers is encrypted to form the encrypted sensitive data, the computer system determines whether the change has occurred in the sensitive data by: The computer system generates a second checksum for the sensitive data; and The computer system compares the first checksum with the second checksum to form a comparison; and Determining whether the change has occurred in the sensitive data based on the comparison, wherein, in response to determining that the change in the sensitive data has occurred, the computer system re-encrypts the sensitive data using the change to form updated encrypted sensitive data includes: In response to determining that the change in the sensitive data has occurred using the comparison, the computer system re-encrypts the sensitive data of the group of application containers using the comparison to form the updated encrypted sensitive data.

3. The computer-implemented method according to claim 1, further comprising: The encrypted sensitive data is requested from an encryption service by a configuration container in the computer system, wherein the configuration container is used for the group of application containers; and The configuration container in the computer system receives the encrypted sensitive data from the encryption service, and the configuration container saves the encrypted sensitive data to the shared storage device for use by the group of application containers.

4. The computer-implemented method according to claim 1, further comprising: The computer system loads the encrypted sensitive data from the shared storage device for use by the application containers within the group of application containers.

5. The method according to claim 1, wherein, The sensitive data used by the computer system to identify the group of application containers using configuration information includes: The computer system uses the configuration information to identify what the sensitive data is; and The computer system uses the configuration information to identify the location of the sensitive data.

6. The computer-implemented method according to claim 1, wherein, The encryption of the sensitive data of the group of application containers by the computer system to form the encrypted sensitive data further includes: The computer system encrypts the sensitive data of the group of application containers using an encryption algorithm specified by the configuration information of the group of application containers to form the encrypted sensitive data.

7. The computer-implemented method according to claim 1, wherein, The encryption of the sensitive data of the group of application containers by the computer system to form the encrypted sensitive data further includes: The computer system uses an encryption service to encrypt the sensitive data of the identified group of application containers to form the encrypted sensitive data.

8. The computer-implemented method according to claim 1, wherein, When deploying the group of application containers, the computer system saving the encrypted sensitive data to the shared storage device used by the group of application containers includes: When the group of application containers is deployed, the computer system saves the encrypted sensitive data to a volume used by the group of application containers.

9. The computer-implemented method according to claim 1, wherein, The configuration information includes the location of the sensitive data, the identifier of the sensitive data to be encrypted, and the encryption algorithm used to encrypt the sensitive data.

10. A computer system, comprising: Storage device, the storage device storing program instructions; as well as A plurality of processor units communicating with the storage device, wherein the plurality of processor units execute program instructions to implement the steps of the method of any one of claims 1-9.

11. A computer program product for managing sensitive data, the computer program product comprising: Program instructions that can be executed by a computer system to cause the computer system to perform the steps of the method of any one of claims 1-9.

Images