A method and system for realizing data transmission encryption of a signal creation environment container

Abstract

The present application relates to the technical field of cloud native Kubernetes container, in particular to a method and system for realizing data transmission encryption of a container in a national security environment, comprising the following steps: deploying a Calico VPP component and enabling an architecture design of an IPSec function to realize data transmission encryption of the container in the national security environment; using an IPIP mode by the Calico to deploy the Calico VPP through a mode of deploying a component in a cluster; enabling the IPSec function through parameter setting to enable the function of the IPSec, and then realizing the data transmission encryption of the container in the national security environment; the method and system for realizing the data transmission encryption of the container in the national security environment are unitary in data encryption in the national security environment, which is based on a data packet instead of an entire data stream, which is not only flexible but also helps to further improve the security of IP data packets, and can effectively prevent network attacks; in the national security environment, the data transmission encryption of the container is realized, the IPSec can carry all traffic by establishing a tunnel, and can support different TCP services.

Description

TECHNICAL FIELD

[0001] The application relates to the field of cloud-native Kubernetes container technology, and particularly relates to a method and system for realizing container data transmission encryption in a trustworthy environment. BACKGROUND

[0002] With the increasingly wide application of container technology in cloud-native and other fields, users have more perfect requirements for container data encryption. Under the influence of multiple factors such as trustworthy trend, digital transformation and business development, government and enterprise informatization departments undoubtedly face higher requirements and challenges in informatization and digital construction. The superposition of trustworthy and emerging information technologies such as cloud computing, big data and distributed computing not only opens up new ideas for the digital innovation construction of government and enterprise units, but also increases the complexity from the basic architecture to the application system. If you want to find a new way and stand out in the flood of the trustworthy era, users have more perfect requirements for container data encryption.

[0003] In the prior art, to realize container data transmission encryption, IPSec can be used to provide a mutual authentication method for end systems, and to protect one or more paths between hosts, between security gateways, between security gateways and hosts, and data in transmission from being stolen and attacked. IPSec can be used to establish a tunnel to carry all communication traffic, and can support different TCP services. IPSec can provide end-to-end security across IP networks. IKE (Internet Key Exchange) is supported, which can realize the automatic negotiation function of the key, and reduce the overhead of key negotiation. The service of establishing and maintaining SA can simplify the use and management of IPsec. All application systems and services using IP protocol for data transmission can use IPsec without any modification to the application systems and services themselves. The encryption of data is based on data packets, not the entire data stream, which is not only flexible but also helps to further improve the security of IP packets, and can effectively prevent network attacks.

[0004] Therefore, a method and system for realizing container data transmission encryption in a trustworthy environment are needed to realize container data transmission encryption in a trustworthy environment. SUMMARY

[0005] The application aims to provide a method and system for realizing container data transmission encryption in a trustworthy environment to solve the problems in the background technology.

[0006] To achieve the above-mentioned purpose, the application provides the following technical scheme: a method for realizing container data transmission encryption in a trustworthy environment, the method comprising the following steps:

[0007] Deploy Calico VPP components, and enable the architecture design of IPSec function, realize the encryption of container data transmission in the environment of Xinyuan;

[0008] Calico uses IPIP mode, deploys Calico VPP by deploying components in the cluster;

[0009] Enable IPSec function, enable IPSec function through parameter setting, and then realize the encryption of container data transmission in the environment of Xinyuan.

[0010] Preferably, the specific operation of deploying Calico VPP component includes:

[0011] Deploy cni plug-in before K8S cluster, and clear previous cni plug-in;

[0012] Deploy calico VPP, set the interface used by VPP and the network segment of service in the parameters of calico respectively, directly modify the configuration of ConfigMap in parameter setting, set the interface parameter used by VPP as the network card used by the current cluster, and set the network segment of service as the network segment of service of the current cluster; use calico VPP mode to expand to higher throughput, after deploying calico VPP, there is a calico-vpp-nodepod on each node, which is responsible for the configuration of VPP.

[0013] Preferably, VPP Manager is used to process VPP start configuration and life cycle, when Manager starts, check and configure its uplink port, that is, the physical network port of host; after starting, all network devices are taken over by VPP, and a tap0 interface is created on the host, representing the original host network card;

[0014] Calico VPP agent is used to be responsible for all VPP runtime configuration of calico, including CNI Server, connecting calico cni interface; Service load balancing, realizing service in k8s through NAT plug-in of VPP; Policies: responsible for realizing the policy of Felix.

[0015] Preferably, the specific operation of calico using IPIP mode includes:

[0016] In calico, increase the parameter calico_network_mode, set calico_network_mode to IPIP, and the parameter setting includes setting ipipMode in Ippool to Always and setting the parameter CALICO_IPV4POOL_IPIP in Calico-node Damonset to Always.

[0017] Preferably, the specific operation of enabling the IPSec function includes:

[0018] In the parameter configuration of calico, set IPSec to true, the parameter is created secret:calicovpp-ipsec-secret by default in namespace calico-vpp-dataplane, and two environment variables are configured in calico-vpp-node, CALICOVPP_IPSEC_ENABLED is true, and secretKeyRef in CALICOVPP_IPSEC_IKEV2_PSK is calicovpp-ipsec-secret.

[0019] A system for realizing data transmission encryption in a China creation environment container, the system comprises a Calico VPP component deployment module, a calico VPP component management module, and an IPSec enabling module;

[0020] The Calico VPP component deployment module is used to deploy a Calico VPP component and enable the architecture design of an IPSec function, so as to realize data transmission encryption in a China creation environment container;

[0021] The calico VPP component management module is used to deploy a calico VPP through the mode of deploying components in a cluster by using an IPIP mode.

[0022] The IPSec enabling module is used to enable an IPSec function, and the function of the IPSec is enabled through parameter setting, so as to realize data transmission encryption in a China creation environment container.

[0023] Preferably, the Calico VPP component deployment module deploys a cni plug-in before a K8S cluster and clears the previous cni plug-in.

[0024] Deploy calico VPP, set the interface used by VPP and the network segment of service in the parameters of calico respectively, the parameter setting directly modifies the configuration of ConfigMap, the interface parameter used by VPP is set to the network card used by the current cluster, and the network segment of service is set to the network segment of the service of the current cluster; using the calico VPP mode, the throughput is extended to be higher, after deploying calico VPP, there is a calico-vpp-nodepod on each node, which is responsible for the configuration of vpp.

[0025] Preferably, the Calico VPP component deployment module adopts VPP Manager to be responsible for processing VPP startup configuration and life cycle, when the Manager starts, the uplink port of the Manager, that is, the physical network port of the host, is checked and configured; after starting, all original network devices are taken over by VPP, and a tap0 interface is created on the host, representing the original host network card;

[0026] Calico VPP agent is adopted to be responsible for all VPP runtime configurations of calico, including CNI Server, connecting with the cni interface of calico; Service load balancing, implementing service in k8s through the NAT plug-in of vpp; Policies: responsible for implementing the policies of Felix.

[0027] Preferably, the calico VPP component management module increases the parameter calico_network_mode in calico, sets calico_network_mode as IPIP, and the parameter setting includes setting ipipMode in Ippool as Always and setting the parameter CALICO_IPV4POOL_IPIP in Calico-node Damonset as Always.

[0028] Preferably, the IPSec enabled module sets IPSec as true in the parameter configuration of calico, the parameter default creates secret: calicovpp-ipsec-secret in namespace calico-vpp-dataplane, and configures two environment variables in calico-vpp-node, CALICOVPP_IPSEC_ENABLED is true, and secretKeyRef in CALICOVPP_IPSEC_IKEV2_PSK, name is calicovpp-ipsec-secret, and key is psk.

[0029] Compared with the prior art, the present application has the beneficial effects that:

[0030] The method and system for realizing data transmission encryption of the signal creation environment container provided by the present application encrypt data in the signal creation environment in units of data packets instead of units of entire data streams, which is not only flexible but also helps to further improve the security of IP packets and can effectively prevent network attacks; in the signal creation environment, the use of IPSec can carry all communication traffic by establishing a tunnel and can support different TCP services. BRIEF DESCRIPTION OF DRAWINGS

[0031] Fig. 1 It is a calico VPP architecture diagram of the present application.

[0032] Fig. 2 It is an IPSec architecture diagram of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical scheme of the present application clear, complete and more clear and explicit, the embodiments of the present application are further described in detail below in combination with the drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present application, not all embodiments, and are only used to explain the embodiments of the present application, and do not limit the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0034] Embodiment one

[0035] Please refer to Figs. 1-2 The present application provides a technical scheme: a method for realizing data transmission encryption of a signal creation environment container, the method comprising the following steps:

[0036] Step 1: deploy Calico VPP components.

[0037] (1) If the CNI plugin has been deployed in the K8S cluster, the previous CNI plugin needs to be removed.

[0038] (2) Deploy Calico VPP. Calico is a deployment component of Inspur's cloud computing platform. The VPP interface and service network segment are set in the Calico parameters. These parameters can be directly modified by modifying the ConfigMap configuration. For the VPP interface parameter, `vpp_dataplane_interface` is set to the network interface card used by the current cluster, and the service network segment is set to the network segment of the current cluster's service. Using Calico VPP mode allows for scaling to higher throughput. After deploying Calico VPP, each node has a `calico-vpp-nodepod` responsible for VPP configuration.

[0039] VPP Manager is responsible for handling VPP startup configuration and lifecycle. When Manager starts, it checks and configures its uplink port, typically the host's physical network interface. After startup, all network devices will be taken over by VPP, and it will create a tap0 interface on the host, representing the original host's network card. Calico VPPagent is responsible for all Calico VPP runtime configurations, including CNI Server (interfacing with the Calico ni interface), Service load balancing (implementing NAT plugins within Kubernetes through VPP), and Policies (implementing Felix policies).

[0040] Step 2: Calico uses IPIP mode.

[0041] Add the parameter `calico_network_mode` to `calico` and set it to `IPIP`. This parameter setting includes setting `ipipMode` in `Ippool` to `Always` and setting the parameter `CALICO_IPV4POOL_IPIP` in `Calico-node Damonset` to `Always`.

[0042] Step 3: Enable IPSec.

[0043] IPSec is set to true in the parameter configuration of calico. This parameter will create secret: calicovpp-ipsec-secret in namespace calico-vpp-dataplane by default. And two environment variables are configured in calico-vpp-node, CALICOVPP_IPSEC_ENABLED is true, and in CALICOVPP_IPSEC_IKEV2_PSK, secretKeyRef is calicovpp-ipsec-secret, and key is psk.

[0044] IPsec is used to further improve the encryption performance. IPsec is a collection of protocols and services that provide security for IP networks, and it is a commonly used technology in VPN. Since IP packets do not integrate any security features, the main technical problem is that IP packets may face the risk of being forged, stolen or tampered with when transmitted in public networks such as the Internet. The communication parties establish an IPsec tunnel through IPsec, and the IP packets are encrypted and transmitted through the IPsec tunnel, effectively ensuring the security of data transmission in an insecure network environment such as the Internet.

[0045] The implementation method is to deploy a calico VPP architecture, set an interface used by the VPP and a network segment of a service in parameters of the calico, the parameter setting can be directly configured a ConfigMap, the interface parameter used by the VPP is set as a network card used by a current cluster, and the network segment of the service is set as a network segment of a service of the current cluster. A parameter calico_network_mode is added in the calico component, and the calico_network_mode is set as ipip. The parameter setting includes setting ipipMode in Ippool as Always and setting the parameter CALICO_IPV4POOL_IPIP in Calico-node Damonset as Always. Ipsec is set as true in the parameter configuration of the calico. The parameter will create secret:calicovpp-ipsec-secret in namespace:calico-vpp-dataplane by default. And two environment variables are configured in calico-vpp-node, CALICOVPP_IPSEC_ENABLED is true, and in secretKeyRef in CALICOVPP_IPSEC_IKEV2_PSK, name is calicovpp-ipsec-secret, and key is psk.

[0046] Embodiment two

[0047] On the basis of the embodiment one, an implementation of a data transmission encryption system in a China-inspired environment container is proposed, the system is composed of a Calico VPP component deployment module, a calico VPP component management module and an IPSec enabling module;

[0048] The Calico VPP component deployment module is used for deploying a Calico VPP component, enabling an architecture design of an IPSec function and realizing data transmission encryption in a China-inspired environment container. A cni plug-in is deployed before a K8S cluster, and a previous cni plug-in is cleared.

[0049] Deploy calico VPP, set the interface used by VPP and the network segment of service in the parameters of calico respectively, the parameter setting directly modifies the configuration of ConfigMap, the interface parameter used by VPP is set to the network card used by the current cluster, and the network segment of service is set to the network segment of the service of the current cluster; using the calico VPP mode, the throughput is extended to a higher level, after deploying calico VPP, there is a calico-vpp-nodepod on each node, which is responsible for the configuration of vpp.

[0050] VPP Manager is used to process VPP startup configuration and life cycle, when the Manager starts, the uplink port of itself is checked and configured, that is, the physical network port of the host; after starting, all original network devices are taken over by VPP, and a tap0 interface is created on the host, representing the original host network card;

[0051] Calico VPP agent is used to process all VPP runtime configurations of calico, including CNI Server, connecting with calico cni interface; Service load balancing, implementing k8s service through the NAT plug-in of vpp; Policies: responsible for implementing the policy of Felix.

[0052] The calico VPP component management module is used for calico to use the IPIP mode, to deploy the components of the cluster in the mode of deploying calico VPP; a parameter calico_network_mode is added in calico, and the calico_network_mode is set to IPIP, the parameter setting includes setting the ipipMode in Ippool to Always and setting the parameter CALICO_IPV4POOL_IPIP in Calico-nodeDamonset to Always.

[0053] An IPSec enabling module is configured to enable the IPSec function, and the IPSec function is enabled through parameter setting, thereby realizing the data transmission encryption of the China-specific environment container; in the parameter configuration of calico, the IPSec is set to true, the parameter is created by default in the namespace calico-vpp-dataplane secret: calicovpp-ipsec-secret, and two environment variables are configured in calico-vpp-node, CALICOVPP_IPSEC_ENABLED is true, and in CALICOVPP_IPSEC_IKEV2_PSK, secretKeyRef, name is calicovpp-ipsec-secret, and key is psk.

[0054] Although embodiments of the present application have been shown and described, it is to be understood that various modifications, substitutions, replacements and changes can be made to these embodiments without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for encrypting data transmission in a containerized environment under a domestically developed information technology application (ITA) framework, characterized in that: The method includes the following steps: An architecture design that deploys Calico VPP components and enables IPSec functionality is implemented to achieve encrypted data transmission in container environments using domestically developed IT solutions. Calico uses the IPIP mode, deploying Calico VPP by deploying components in a cluster. Enable IPSec functionality by configuring parameters to achieve encrypted data transmission within containers in a domestically developed IT environment. The specific steps for deploying Calico VPP components include: Deploy the CNI plugin before the Kubernetes cluster and remove the previous CNI plugin; To deploy Calico VPP, configure the interface used by VPP and the network segment of the service in the Calico parameters. These parameters are directly modified by altering the ConfigMap configuration. For the interface parameter, set `vpp_dataplane_interface` to the network interface used by the current cluster, and for the service network segment, set it to the network segment of the current cluster's service. Using Calico VPP allows for scaling to higher throughput. After deployment, each node will have a `calico-vpp-nodepod` responsible for VPP configuration. VPP Manager is responsible for handling VPP startup configuration and lifecycle. When Manager starts, it checks and configures its own uplink port, which is the host's physical network port. After startup, all network devices are taken over by VPP, and a tap0 interface is created on the host to represent the original host network card. The Calico VPP agent is used to handle all Calico VPP runtime configurations, including the CNI Server, which interfaces with the Calico VPP. Service load balancing is implemented through a NAT plugin within the VPP, connecting services within Kubernetes. Policies are responsible for implementing Felix policies. The specific operations of using IPIP mode in calico include: Add the parameter calico_network_mode to calico and set it to IPIP. Parameter settings include setting ipipMode in Ippool to Always and setting CALICO_IPV4POOL_IPIP in Calico-node Damonset to Always. The specific steps to enable IPSec functionality include: In the calico parameter configuration, set IPSec to true. By default, the parameter creates a secret named calicovpp-ipsec-secret in the namespace calico-vpp-dataplane. In calico-vpp-node, configure two environment variables: CALICOVPP_IPSEC_ENABLED is set to true, and in CALICOVPP_IPSEC_IKEV2_PSK, the secretKeyRef has the name calicovpp-ipsec-secret and the key psk.

2. A system for implementing encryption of container data transmission in a domestically developed information technology (IT) environment, as described in claim 1, characterized in that: The system consists of a Calico VPP component deployment module, a Calico VPP component management module, and an IPSec enabling module. The Calico VPP component deployment module is designed to deploy Calico VPP components and enable IPSec functionality, thereby achieving encrypted data transmission in container environments. The calico VPP component management module is used by calico in IPIP mode to deploy calico VPP by deploying components in a cluster. The IPSec enabling module is used to enable IPSec functionality. By setting parameters, IPSec can be enabled, thereby achieving encrypted data transmission within containers in a domestically developed environment. The Calico VPP component deployment module deploys the CNI plugin before the K8S cluster and removes the previous CNI plugin; To deploy Calico VPP, configure the interface used by VPP and the network segment of the service in the Calico parameters. Modify the ConfigMap configuration directly. Set the interface parameter used by VPP, vpp_dataplane_interface, to the network card used by the current cluster, and the service network segment to the network segment of the current cluster service. Using the calico VPP mode, you can scale to higher throughput. After deploying calico VPP, each node has a calico-vpp-nodepod responsible for VPP configuration. The Calico VPP component deployment module uses VPP Manager to handle VPP startup configuration and lifecycle. When Manager starts, it checks and configures its own uplink port, i.e., the host's physical network port. After startup, all network devices are taken over by VPP, and a tap0 interface is created on the host to represent the original host network card. The Calico VPP agent is used to handle all VPP runtime configurations for Calico, including the CNI Server, and interfaces with the Calico VPP. Service load balancing is implemented using a NAT plugin via VPP to handle services within Kubernetes; Policies are responsible for implementing Felix policies. The calico VPP component management module adds the parameter calico_network_mode to calico and sets calico_network_mode to IPIP. The parameter setting includes setting ipipMode in Ippool to Always and setting CALICO_IPV4POOL_IPIP in Calico-node Damonset to Always. The IPSec enabling module sets IPSec to true in the calico parameter configuration. By default, the parameter creates a secret named calicovpp-ipsec-secret in the namespace calico-vpp-dataplane. In calico-vpp-node, two environment variables are configured: CALICOVPP_IPSEC_ENABLED is set to true, and in CALICOVPP_IPSEC_IKEV2_PSK, the secretKeyRef has the name calicovpp-ipsec-secret and the key psk.

Images