A method and system for persistent encrypted storage of container data in a network orchestrator

Abstract

The present invention discloses a method and system for persistent encrypted storage of container data in a network orchestrator, the system comprising a network orchestrator, a cloud service cryptographic platform and a storage server, the network orchestrator comprising an orchestration controller, a CSI driver controller, a business container and a sidecar encryption and decryption service container, the CSI driver controller is used to inject the sidecar encryption and decryption service container into the business container, create an encrypted file system storage volume and register a hook callback function with the orchestration controller; the orchestration controller is responsible for binding the encrypted file system storage volume and the business container; the virtual cryptographic machine cluster in the cloud service cryptographic platform provides encryption and decryption, signature verification and key storage interfaces for the sidecar encryption and decryption service container; the storage server comprises a metadata engine and an object storage, which respectively persistently stores the metadata and encrypted data of the encrypted file system. The present invention can provide decoupled persistent encrypted storage of files for the network orchestrator container, and ensure the security of the entire life cycle of sensitive data in the container.

Description

Technical Field

[0001] The present invention relates to the field of container data security, and in particular to a method and system for persistent encrypted storage of container data in a network orchestrator. Background Art

[0002] With the popularity of cloud-native technology, more and more network applications are deployed in a containerized manner. Among the series of problems faced by the rapid development of network container orchestration technology, security issues are the most important. In particular, how to ensure the security of container data throughout its life cycle has become an unavoidable problem for network orchestrators. As a mainstream cloud-native container orchestration system, Kubernetes has powerful functions and complexity, but it only provides secret resources to store sensitive information. In fact, secret is not real data encryption, but encoding of original data. Attackers can easily decode ciphertext to obtain plaintext data, which poses a high security risk. In addition, some third-party storage systems provide storage-side encryption functions, but the connection is complex for existing application containers, and the data transmitted during the upload or download process is all plaintext, which is at risk of being illegally intercepted. Summary of the invention

[0003] The purpose of the present invention is to provide a method and system for persistent encrypted storage of container data in a network orchestrator, providing decoupled persistent encrypted storage of files for the network orchestrator container, and ensuring the security of sensitive container data throughout its life cycle.

[0004] To achieve the above object, the technical solution adopted by the present invention is:

[0005] A method for persistent encrypted storage of container data in a network orchestrator comprises the following steps:

[0006] S1, encrypted file system data initialization phase: In the network orchestrator based on Kubernetes secondary development, deploy the customized CSI driver controller, create the business container and encrypted file system, and inject the sidecar encryption and decryption service container into the business container. The sidecar encryption and decryption service container allocates the SM2 asymmetric key to the encrypted file system through the cloud service cryptographic platform, and then uploads the encrypted file system metadata to the metadata engine, and mounts the encrypted file system to the corresponding encrypted directory of the business container;

[0007] S2, data encryption stage: Place sensitive data files in the encryption directory, and the sidecar encryption and decryption service container divides and compresses the original data. Then, each data block is encrypted using the symmetric key and the initial vector IV to obtain ciphertext data. The symmetric key plaintext is signed using the SM2 private key, and the symmetric key plaintext and its signature value are encrypted to obtain the key ciphertext. The ciphertext data, key ciphertext, and initial vector IV are combined and uploaded to the object storage for persistent storage.

[0008] S3, data decryption phase: The sidecar encryption and decryption service container downloads the encrypted object and splits it, uses the asymmetric key to decrypt and verify the symmetric key ciphertext, uses the decrypted symmetric key and initial vector IV to decrypt the ciphertext data, and finally decompresses the plaintext data block. The business container can then access the encrypted sensitive data.

[0009] Furthermore, the S1 specifically includes:

[0010] S11. Register the webhook hook callback function to the orchestration controller through the CSI driver controller;

[0011] S12. The orchestration controller calls the webhook interface to create a business container and specifies the storage requirements of the business container.

[0012] S13. The CSI driver controller creates a corresponding persistent encrypted file system storage volume according to the storage requirements of the business container, and binds the encrypted file system storage volume to the corresponding business container storage requirements;

[0013] S14. After the CSI driver controller monitors the creation of the business container, it injects the sidecar encryption and decryption service container into the business container, and the encryption and decryption storage client runs in the sidecar encryption and decryption service container;

[0014] S15. After the sidecar encryption and decryption service container is started for the first time, it sends a request to the virtual cryptographic machine in the cloud service cryptographic platform to allocate the SM2 asymmetric key for the encrypted file system;

[0015] S16. After the encrypted file system is created, the encryption and decryption storage client in the sidecar encryption and decryption service container uploads the metadata information of the encrypted file system to the metadata engine of the storage server through TLS for storage;

[0016] S17. The sidecar encryption and decryption service container mounts the persistent encrypted file system storage volume under the corresponding encrypted directory of the business container bound to it, and the business container can access the encrypted file system.

[0017] Preferably, the storage requirement in S12 includes the required storage capacity and whether to use an encrypted file system preparer.

[0018] Preferably, the asymmetric key in S15 is managed by a virtual cryptographic machine, and the key is stored in a cryptographic card.

[0019] Furthermore, the S2 specifically includes:

[0020] S21. After the sensitive data files are placed in the encrypted directory, the sidecar encryption and decryption service container first divides the original data into blocks and compresses each data block;

[0021] S22, the sidecar encryption and decryption service container calls the virtual cipher key generation interface to generate a 16-byte symmetric key and a 16-byte initial vector IV for each data block;

[0022] S23, the sidecar encryption and decryption service container calls the virtual cipher interface to use the symmetric key and initial vector IV to encrypt each data block based on the SM4-GCM algorithm to obtain ciphertext data;

[0023] S24. The sidecar encryption and decryption service container calls the virtual cryptographic machine interface to use the SM2 private key of the encrypted file system to sign the symmetric key plaintext.

[0024] S25, encapsulate the symmetric key plaintext and signature value in a custom format and encrypt them using the SM2 public key of the encrypted file system to obtain the key ciphertext;

[0025] S26. The sidecar encryption and decryption service container combines the ciphertext data, key ciphertext and initialization vector IV to form an encrypted object, and uploads it to the object storage of the storage server for persistent encrypted storage.

[0026] Furthermore, the S3 specifically includes:

[0027] S31, the sidecar encryption and decryption service container downloads the entire encrypted object and splits it into ciphertext data, key ciphertext, and initial vector IV;

[0028] S32, the sidecar encryption and decryption service container uses the SM2 private key of the encrypted file system to decrypt the symmetric key plaintext and signature value;

[0029] S33. Use the SM2 public key to verify the plaintext of the symmetric key and the signature value to ensure that the symmetric key has not been tampered with;

[0030] S34, using the symmetric key and the initial vector IV to decrypt the ciphertext data based on the SM4-GCM algorithm to obtain a plaintext data block;

[0031] S35. Decompress the plaintext data block to obtain the original data, and the business container can access the encrypted sensitive data stored persistently in the corresponding encrypted directory without any awareness.

[0032] The present application also provides a persistent encrypted storage system for container data in a network orchestrator, which is used to implement the persistent encrypted storage method for container data in the network orchestrator. The encrypted storage system includes: a network orchestrator, a cloud service cryptographic platform, and a storage server.

[0033] The network orchestrator includes an orchestration controller, a CSI driver controller, a business container and a corresponding sidecar encryption and decryption service container. The CSI driver controller is used to inject the sidecar encryption and decryption service container into the business container, create an encrypted file system storage volume and register a hook callback function with the orchestration controller; the orchestration controller is responsible for binding the encrypted file system storage volume and the business container, and mounting the encrypted file system storage volume to the business container through the sidecar encryption and decryption service container;

[0034] The virtual cryptographic machine cluster in the cloud service cryptographic platform provides encryption and decryption, signature verification and key storage interfaces for the sidecar encryption and decryption service container through the cryptographic device API;

[0035] The storage server includes a metadata engine and object storage, which are used to persistently store the metadata and encrypted data of the user encrypted file system respectively. The metadata and encrypted data are uploaded and downloaded through the sidecar encryption and decryption service container.

[0036] By adopting the above technical solution, the present invention can achieve the following beneficial effects:

[0037] 1. The present invention is aimed at the secondary development of the network orchestrator for kubernetes, and adopts the form of injecting encryption and decryption service container into the business container in the sidecar mode to provide encryption and decryption services for it. The encryption and decryption storage service and the business container are completely decoupled. The existing business container itself does not need any transformation and upgrade. It only needs to inject the sidecar encryption and decryption service container. The mount point is completely transparent to the business container, that is, the encryption and decryption process will not affect the access to the file system. In terms of use, there is no need to perform interface docking for existing businesses, the deployment is lightweight, and the transformation and upgrade are simple and convenient.

[0038] 2. The present invention encrypts the object before uploading it and decrypts it after downloading it, which is completely transparent to the business container and the object storage side.

[0039] 3. The present invention uses an external cloud service cryptographic platform to provide key management and encryption and decryption capabilities for the orchestrator encryption and decryption services. The keys are stored in a hardware cryptographic card, which effectively ensures the security of the keys.

[0040] 4. The present invention divides the original data into blocks and compresses the data blocks before encryption, which effectively improves the encryption and decryption efficiency and reduces the storage resource overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a flow chart of the method for persistent encrypted storage of container data in the network orchestrator of the present invention;

[0042] Figure 2 This is a block diagram of a system for persistent encrypted storage of container data in a network orchestrator in the present invention. DETAILED DESCRIPTION

[0043] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0044] In order to cope with the security threats existing in the container data of existing network orchestrators and ensure the security of sensitive container data throughout its life cycle, the present invention proposes a method and system for persistent encrypted storage of container data in a network orchestrator, which adopts an encrypted data and metadata separation architecture to provide decoupled file persistent encrypted storage for the network orchestrator container.

[0045] A method for persistent encrypted storage of container data in a network orchestrator comprises the following steps:

[0046] S1, encrypted file system data initialization phase: In the network orchestrator based on Kubernetes secondary development, deploy a customized CSI driver controller to create a business container and an encrypted file system. The CSI driver controller registers a hook callback function with the orchestration controller. Before the orchestration controller creates a business container, it will first call the registered hook callback function and specify the encrypted file system preparer to be used. After the CSI driver controller monitors the creation of the business container, it injects the sidecar encryption and decryption service container into the business container. After the sidecar encryption and decryption service container is started, it will create an encrypted file system according to the storage requirements of the business container. The sidecar encryption and decryption service container allocates an SM2 asymmetric key to the encrypted file system through the virtual cryptographic machine of the cloud service cryptographic platform, then uploads the encrypted file system metadata to the metadata engine, and mounts the encrypted file system to the corresponding encrypted directory of the business container.

[0047] S2, data encryption stage: Place sensitive data files in the encrypted directory described in S1. The sidecar encryption and decryption service container divides and compresses the original data. Then, it uses the symmetric key and initial vector IV to encrypt each data block to obtain ciphertext data. The symmetric key plaintext is signed with the SM2 private key. The symmetric key plaintext and its signature value are encrypted to obtain the key ciphertext. The ciphertext data, key ciphertext and initial vector IV are combined and uploaded to the object storage for persistent storage.

[0048] S3, data decryption phase: The sidecar encryption and decryption service container downloads the encrypted object and splits it, uses the asymmetric key to decrypt and verify the symmetric key ciphertext, uses the decrypted symmetric key and initial vector IV to decrypt the ciphertext data, and finally decompresses the plaintext data block. The business container can then access the encrypted sensitive data.

[0049] Example 1

[0050] like Figure 1 As shown, the present application proposes a method for persistent encrypted storage of container data in a network orchestrator, which method includes an encrypted file system data initialization phase, a data encryption phase, and a data decryption phase.

[0051] The encrypted file system data initialization phase specifically includes:

[0052] S11. In the network orchestrator based on Kubernetes secondary development, deploy a customized CSI driver controller, and register the webhook hook callback function to the orchestration controller through the CSI driver controller; one of the main functions of webhook is to automatically inject the encryption and decryption service container into the business container created by the network orchestrator in the form of sidecar.

[0053] S12. The orchestration controller calls the webhook interface to create a business container and specifies the storage requirements of the business container; the storage requirements include the required storage capacity and whether to use an encrypted file system preparer, etc.

[0054] S13. The CSI driver controller creates a corresponding persistent encrypted file system storage volume according to the storage requirements of the business container, and binds the encrypted file system storage volume to the corresponding business container storage requirements;

[0055] S14. After the CSI driver controller monitors the creation of the business container, it injects the sidecar encryption and decryption service container into the business container, and the encryption and decryption storage client runs in the sidecar encryption and decryption service container;

[0056] S15. After the sidecar encryption and decryption service container is started for the first time, it sends a request to the virtual cryptographic machine in the cloud service cryptographic platform to allocate the SM2 asymmetric key for the encrypted file system; the asymmetric key is managed by the virtual cryptographic machine and the key is stored in the cryptographic card, so that the key does not leave the card, ensuring the security of key management.

[0057] S16. After the encrypted file system is created, the encryption and decryption storage client in the sidecar encryption and decryption service container uploads the metadata information of the encrypted file system to the metadata engine of the storage server through TLS for storage, so that the metadata and encrypted data are separated;

[0058] S17. The sidecar encryption and decryption service container mounts the persistent encrypted file system storage volume under the corresponding encrypted directory of the business container bound to it, and the business container can access the encrypted file system.

[0059] The data encryption stage specifically includes:

[0060] S21. After the sensitive data files are placed in the encrypted directory, the sidecar encryption and decryption service container first divides the original data into blocks and compresses each data block to reduce storage overhead;

[0061] S22, the sidecar encryption and decryption service container calls the virtual cipher key generation interface to generate a 16-byte symmetric key and a 16-byte initial vector IV for each data block, ensuring that each data block is encrypted once and for all;

[0062] S23, the sidecar encryption and decryption service container calls the virtual cipher interface to use the symmetric key and initial vector IV to encrypt each data block based on the SM4-GCM algorithm to obtain ciphertext data; the GCM mode can effectively protect the confidentiality and integrity of the ciphertext data.

[0063] S24. The sidecar encryption and decryption service container calls the virtual cryptographic machine interface to use the SM2 private key of the encrypted file system to sign the symmetric key plaintext.

[0064] S25. Encapsulate the symmetric key plaintext and signature value in a custom format and encrypt them using the SM2 public key of the encrypted file system to obtain the key ciphertext; effectively protecting the confidentiality and integrity of the user key.

[0065] S26. The sidecar encryption and decryption service container combines the ciphertext data, key ciphertext and initialization vector IV to form an encrypted object, and uploads it to the object storage of the storage server for persistent encrypted storage.

[0066] When the user needs to store the network orchestrator sensitive data in a persistent encrypted manner, execute the above steps S21 to S26.

[0067] The data decryption stage specifically includes:

[0068] S31, the sidecar encryption and decryption service container downloads the entire encrypted object and splits it into ciphertext data, key ciphertext, and initial vector IV;

[0069] S32, the sidecar encryption and decryption service container uses the SM2 private key of the encrypted file system to decrypt the symmetric key plaintext and signature value;

[0070] S33. Use the SM2 public key to verify the plaintext of the symmetric key and the signature value to ensure that the symmetric key has not been tampered with;

[0071] S34, using the symmetric key and the initial vector IV to decrypt the ciphertext data based on the SM4-GCM algorithm to obtain a plaintext data block;

[0072] S35. Decompress the plaintext data block to obtain the original data, and the business container can access the encrypted sensitive data stored persistently in the corresponding encrypted directory without any awareness.

[0073] In summary, when the business container is restarted and the encrypted file system is mounted, the sidecar encryption and decryption service container automatically downloads the encrypted object and decrypts it. The business container can access the encrypted sensitive data in persistent storage without any awareness.

[0074] Example 2

[0075] like Figure 2 As shown, the present application also provides a persistent encrypted storage system for container data in a network orchestrator, which is used to implement the above-mentioned persistent encrypted storage method for container data in the network orchestrator. The encrypted storage system includes: a network orchestrator, a cloud service cryptographic platform and a storage server.

[0076] The network orchestrator includes an orchestration controller, a CSI driver controller, a business container and a corresponding sidecar encryption and decryption service container, wherein the business container is a virtual network element, controller, etc. used by the network orchestrator for networking. The CSI driver controller is used to inject the sidecar encryption and decryption service container into the business container, create an encrypted file system storage volume and register a hook callback function with the orchestration controller; the orchestration controller is responsible for binding the encrypted file system storage volume and the business container, and mounting the encrypted file system storage volume to the business container through the sidecar encryption and decryption service container.

[0077] The virtual cryptographic machine cluster in the cloud service cryptographic platform provides encryption and decryption, signature verification and key storage interfaces for the sidecar encryption and decryption service container through the cryptographic device API.

[0078] The storage server includes a metadata engine and object storage, which are used to persistently store the metadata and encrypted data of the user encrypted file system respectively. The metadata and encrypted data are uploaded and downloaded through the sidecar encryption and decryption service container.

[0079] The encrypted storage system adopts an architecture that separates encrypted data and metadata. The object is encrypted before being uploaded, and the original data is divided into blocks and compressed before encryption to reduce capacity overhead. The business container is injected into the sidecar encryption and decryption service container, and the mount point is completely transparent to the business container. The business container can access the encrypted sensitive data in persistent storage without perception.

[0080] Finally, it should be noted that the parts of the present invention that are not described in detail are all prior art. Those of ordinary skill in the art can understand that the above are only preferred examples of the invention and are not intended to limit the invention. Although the invention is described in detail with reference to the aforementioned examples, those of ordinary skill in the art can still modify the technical solutions recorded in the aforementioned examples, or replace some of the technical features therein with equivalents. Any modifications, equivalent replacements, etc. made within the spirit and principles of the invention should be included in the scope of protection of the invention.

Claims

1. A method for persistent encrypted storage of container data in a network orchestrator, characterized in that: The following steps are involved: S1, encrypted file system data initialization phase: In the network orchestrator based on Kubernetes secondary development, deploy the customized CSI driver controller to create business containers and encrypted file systems; The CSI driver controller injects the sidecar encryption and decryption service container into the business container. The sidecar encryption and decryption service container allocates the SM2 asymmetric key for the encrypted file system through the cloud service cryptographic platform, uploads the encrypted file system metadata to the metadata engine, and mounts the encrypted file system to the corresponding encrypted directory of the business container. The S1 specifically includes: S11. Register the webhook hook callback function to the orchestration controller through the CSI driver controller; S12. The orchestration controller calls the webhook interface to create a business container and specifies the storage requirements of the business container. S13. The CSI driver controller creates a corresponding persistent encrypted file system storage volume according to the storage requirements of the business container, and binds the encrypted file system storage volume to the corresponding business container storage requirements; S14. After the CSI driver controller monitors the creation of the business container, it injects the sidecar encryption and decryption service container into the business container, and the encryption and decryption storage client runs in the sidecar encryption and decryption service container; S15. After the sidecar encryption and decryption service container is started for the first time, it sends a request to the virtual cryptographic machine in the cloud service cryptographic platform to allocate the SM2 asymmetric key for the encrypted file system; S16. After the encrypted file system is created, the encryption and decryption storage client in the sidecar encryption and decryption service container uploads the metadata information of the encrypted file system to the metadata engine of the storage server through TLS for storage; S17. The sidecar encryption and decryption service container mounts the persistent encrypted file system storage volume under the corresponding encrypted directory of the business container bound to it, so that the business container can access the encrypted file system. S2, data encryption stage: Place sensitive data files in the encryption directory, and the sidecar encryption and decryption service container divides and compresses the original data. Then, each data block is encrypted using the symmetric key and the initial vector IV to obtain ciphertext data. The symmetric key plaintext is signed using the SM2 private key, and the symmetric key plaintext and its signature value are encrypted to obtain the key ciphertext. The ciphertext data, key ciphertext, and initial vector IV are combined and uploaded to the object storage for persistent storage. S3, data decryption phase: The sidecar encryption and decryption service container downloads the encrypted object and splits it, uses the asymmetric key to decrypt and verify the symmetric key ciphertext, uses the decrypted symmetric key and initial vector IV to decrypt the ciphertext data, and finally decompresses the plaintext data block. The business container can then access the encrypted sensitive data.

2. According to the method for persistent encrypted storage of container data in a network orchestrator in claim 1, it is characterized in that: The storage requirement in S12 includes the required storage capacity and whether to use an encrypted file system preparer.

3. According to the method for persistent encrypted storage of container data in a network orchestrator in claim 1, it is characterized in that: The asymmetric key in S15 is managed by a virtual cryptographic machine, and the key is stored in a cryptographic card.

4. According to a method for persistent encrypted storage of container data in a network orchestrator in claim 1, it is characterized in that: The S2 specifically includes: S21. After the sensitive data files are placed in the encrypted directory, the sidecar encryption and decryption service container first divides the original data into blocks and compresses each data block; S22, the sidecar encryption and decryption service container calls the virtual cipher key generation interface to generate a 16-byte symmetric key and a 16-byte initial vector IV for each data block; S23, the sidecar encryption and decryption service container calls the virtual cipher interface to use the symmetric key and initial vector IV to encrypt each data block based on the SM4-GCM algorithm to obtain ciphertext data; S24. The sidecar encryption and decryption service container calls the virtual cryptographic machine interface to use the SM2 private key of the encrypted file system to sign the symmetric key plaintext. S25, encapsulate the symmetric key plaintext and signature value in a custom format and encrypt them using the SM2 public key of the encrypted file system to obtain the key ciphertext; S26. The sidecar encryption and decryption service container combines the ciphertext data, key ciphertext and initialization vector IV to form an encrypted object, and uploads it to the object storage of the storage server for persistent encrypted storage.

5. According to a method for persistent encrypted storage of container data in a network orchestrator in claim 1, it is characterized in that: The S3 specifically includes: S31, the sidecar encryption and decryption service container downloads the entire encrypted object and splits it into ciphertext data, key ciphertext, and initial vector IV; S32, the sidecar encryption and decryption service container uses the SM2 private key of the encrypted file system to decrypt the symmetric key plaintext and signature value; S33. Use the SM2 public key to verify the plaintext of the symmetric key and the signature value to ensure that the symmetric key has not been tampered with; S34, using the symmetric key and the initial vector IV to decrypt the ciphertext data based on the SM4-GCM algorithm to obtain a plaintext data block; S35. Decompress the plaintext data block to obtain the original data, and the business container can access the encrypted sensitive data stored persistently in the corresponding encrypted directory without any awareness.

6. A system for persistent encrypted storage of container data in a network orchestrator, used to implement a method for persistent encrypted storage of container data in a network orchestrator according to any one of claims 1 to 5, characterized in that: The encrypted storage system includes: a network orchestrator, a cloud service cryptographic platform and a storage server. The network orchestrator includes an orchestration controller, a CSI driver controller, a business container and a corresponding sidecar encryption and decryption service container. The CSI driver controller is used to inject the sidecar encryption and decryption service container into the business container, create an encrypted file system storage volume and register a hook callback function with the orchestration controller; the orchestration controller is responsible for binding the encrypted file system storage volume and the business container, and mounting the encrypted file system storage volume to the business container through the sidecar encryption and decryption service container; The virtual cryptographic machine cluster in the cloud service cryptographic platform provides encryption and decryption, signature verification and key storage interfaces for the sidecar encryption and decryption service container through the cryptographic device API; The storage server includes a metadata engine and object storage, which are used to persistently store the metadata and encrypted data of the user encrypted file system respectively. The metadata and encrypted data are uploaded and downloaded through the sidecar encryption and decryption service container.

Images