Information processing method and device, equipment, storage medium and program product

Abstract

The invention provides an information processing method and device, equipment, a storage medium and a program product, and the information processing method comprises the steps: obtaining a confidential resource instance creation request of a target application, the confidential resource instance creation request comprising initial assembly information of a confidential resource instance requested to be created; generating encryption parameter information based on the confidential resource instance creation request, and reassembling initial assembly information of the confidential resource instance based on the encryption parameter information to obtain reassembling information of the confidential resource instance; and creating the confidential resource instance based on the recombination assembly information of the confidential resource instance, wherein the confidential resource instance comprises the encryption parameter information. According to the embodiment of the invention, the encryption parameter generation and operation and maintenance efficiency can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to an information processing method and apparatus, equipment, storage medium, and program product. Background Art

[0002] In actual applications, in order to ensure the security of data communication between applications, applications are required to provide Hypertext Transfer Protocol Secure (HTTPS) interface services. HTTPS mainly uses digital certificates, encryption algorithms, asymmetric keys and other technologies to encrypt Internet data transmission. At present, in the process of managing application certificates (including generation, use and maintenance), it is necessary to provide containerized deployment service clusters using new resource types. Summary of the invention

[0003] The present disclosure provides an information processing method and apparatus, a device, a storage medium, and a program product to improve the management efficiency of encryption parameters.

[0004] In a first aspect, the present disclosure provides an information processing method, the method comprising:

[0005] Obtaining a confidential resource instance creation request of a target application, wherein the confidential resource instance creation request includes initial assembly information of the confidential resource instance requested to be created;

[0006] Generate encryption parameter information based on the confidential resource instance creation request, and reassemble the initial assembly information of the confidential resource instance based on the encryption parameter information to obtain the reassembled assembly information of the confidential resource instance;

[0007] The confidential resource instance is created based on the reassembly information of the confidential resource instance, wherein the confidential resource instance includes the encryption parameter information.

[0008] In a second aspect, the present disclosure provides an information processing device, the device comprising:

[0009] An acquisition module, configured to acquire a confidential resource instance creation request of a target application, wherein the confidential resource instance creation request includes initial assembly information of the confidential resource instance requested to be created;

[0010] An assembly module, configured to generate encryption parameter information based on the confidential resource instance creation request, and reassemble the initial assembly information of the confidential resource instance based on the encryption parameter information to obtain the reassembled assembly information of the confidential resource instance;

[0011] A creation module is used to create the confidential resource instance based on the reassembly information of the confidential resource instance, wherein the confidential resource instance includes the encryption parameter information.

[0012] In a third aspect, the present disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores at least one computer program executable by the at least one processor, and the at least one computer program is executed by the at least one processor so that the at least one processor can execute the information processing method as described in the first aspect.

[0013] In a fourth aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the information processing method as described in the first aspect.

[0014] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer-readable code, or a non-volatile computer-readable storage medium carrying a computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the information processing method as described in the first aspect.

[0015] The embodiments provided by the present disclosure, when it is necessary to generate encryption parameters for a target application, obtain a confidential resource instance creation request of the target application, generate encryption parameter information for the confidential resource creation request, reassemble the initial assembly information of the confidential resource instance based on the encryption parameter information, obtain the reassembled assembly information of the confidential resource instance, and create the confidential resource instance based on the reassembled assembly information of the confidential resource instance, so that a confidential resource instance including encryption parameters can be generated for the application by creating a confidential resource instance, without adding new resource types or separately generating encryption parameter code for application development, thereby reducing the difficulty of application development, improving the efficiency of encryption parameter generation, reducing implementation complexity, and improving the efficiency of encryption parameter generation, use, and maintenance.

[0016] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. The above and other features and advantages will become more apparent to those skilled in the art by describing detailed example embodiments with reference to the accompanying drawings. In the accompanying drawings:

[0018] Figure 1 A schematic diagram of a process for generating a certificate for a cluster in a related technology;

[0019] Figure 2 A flowchart of an information processing method provided by an embodiment of the present disclosure;

[0020] Figure 3 A schematic diagram of a process of generating and updating certificates for an application in a Kubernetes cluster provided in an embodiment of the present disclosure;

[0021] Figure 4 A block diagram of an information processing device provided by an embodiment of the present disclosure;

[0022] Figure 5 A block diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, the exemplary embodiments of the present disclosure are described below in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0024] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0025] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0026] The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a" and "the" are also intended to include plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "including" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof is not excluded. "Connected" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0027] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined as such herein.

[0028] The inventors discovered during the process of implementing the present disclosure that:

[0029] Usually, it is necessary to issue certificates for applications to verify the identity of users accessing the applications. The generation and secure storage of certificates will incur additional development and maintenance costs for application developers and operators. If each application generates its own certificates, the root certificates will be inconsistent, which will result in the need to configure multiple root certificates for trust during access. In addition, the expiration and renewal of certificates used by applications will also bring additional workload to application operators.

[0030] The current more mature cluster certificate generation and storage solution is to deploy the Cert-manager open source project in the cluster, that is, the certificate lifecycle management system, and generate the certificate Secret by creating a user resource (CustomerResource, CR) of the certificate type, and then the application uses the certificate by mounting the Secret. Figure 1 The figure shows the process of generating a certificate for a cluster in the related technology. The open source project Cert-manager is deployed to the cluster. The application creates a resource instance of the certificate type by using the Customer Resource Definition (CRD) provided by cert-manager, thereby generating a secure transport layer protocol (TLS) certificate. This certificate is then mounted as a file to the pod to which the application belongs, and the application uses the certificate file to provide HTTPS interface services.

[0031] Cert-manager is an open source certificate management service. It is bulky and occupies a lot of resources. It needs to add a new CRD resource type (Certificate) to the cluster, which increases cluster overhead. When creating a certificate, the cluster will create two CRs (Certificate resource instance and Secret resource instance) at the same time, which increases the cluster burden. At the same time, the certificate and private key generated by Cert-manager are saved in Secret in base64 encoding storage. Attackers can obtain the original data information through a simple base64 de-encoding tool.

[0032] Based on this, an embodiment of the present disclosure provides an information processing method, in which the encryption parameters generated and stored may be parameters required for secure transmission of applications such as certificates, and the method does not require deployment of the Cert-manager open source project.

[0033] First, some concepts involved in the embodiments of the present disclosure are described as follows:

[0034] Kubernetes, referred to as K8S, is a service cluster and an open source container scheduling platform across host clusters. It can automate the deployment, expansion and operation of application containers and provide a container-centric infrastructure. Kubernetes can package applications into containers and deploy these containers to a cluster, automatically handling operations such as container lifecycle management and automatic expansion, allowing users to focus more on application development and business logic.

[0035] API Server, also known as the application programming interface service component, is one of the most important core components of K8S. It is the API gateway of the entire K8S cluster control plane. It provides communication and management interfaces between various components in the Kubernetes cluster. Operations need to be initiated and processed through the API Server.

[0036] Etcd is a distributed key-value storage system developed by CoreOS based on the Raft protocol. It can be used for service discovery, shared configuration, and consistency assurance. It is one of the key components of the K8S cluster and is used to store cluster resource information.

[0037] Admission Webhook, also known as admission controller plugin, is a type of admission control plugin that intercepts all requests sent to the API Server and can modify or reject requests. Admission Webhook provides developers with a very flexible plugin mode. Before Kubernetes resources are persisted, the program can verify, modify, and perform other operations on the specified resources. Mutating Admission Webhook is a type of Admission Webhook that can monitor and modify any request processed by the API Server.

[0038] Pod, also known as a can, is the smallest computing unit of a Kubernetes cluster. A pod encapsulates one or more containers. The containers in the pod share network, storage and other resources.

[0039] Secret resource instances, also known as confidential resource instances, are used in K8S to store and manage sensitive data, such as passwords, tokens, keys, and other sensitive information.

[0040] Base64 is one of the encoding methods used to transmit 8-bit bytecode. Base64 is a method of representing binary data based on 64 printable characters.

[0041] AES256, short for Advanced Encryption Standard, where 256 means the key length is 256 bits, is a symmetric block cipher algorithm used to encrypt sensitive data.

[0042] RSA2048 is an asymmetric key encryption algorithm.

[0043] A certificate, also known as a digital certificate, is an electronic document that is usually issued by an authoritative third-party organization - a certificate authority (CA center). The purpose of a digital certificate is to verify the identity of a user on the Internet or other computer networks. A digital certificate contains information about the subject of the behavior and the digital signature of the certificate authority, which helps to confirm the identity and authority of the sender. In addition, a digital certificate also contains a public key, which allows the recipient to verify the identity of the sender through the public key and communicate securely when necessary. In the interface service of the HTTPS application, a digital certificate is used to provide confidentiality and data integrity for the communication between the two applications. In this process, in addition to using a digital certificate, a private key used for encryption of the digital certificate is also required.

[0044] Cert-manager, a certificate lifecycle management system, is an all-round certificate management tool for K8S that supports access to third-party certificate authorities.

[0045] The hook function callback service module, also called the Webhook callback service module, is defined in the embodiment of the present disclosure as a program that is called back by the Admission Webhook plug-in and is used to generate a service for certificates.

[0046] Figure 2 The figure shows a flow chart of an information processing method provided by an embodiment of the present disclosure, which is applied to a service cluster, and is exemplarily applied to an API Server component of a service cluster. In the embodiment of the present disclosure, the service cluster is a Kubernetes cluster as an example for explanation. Of course, it can be understood that the information processing method in the embodiment of the present disclosure is not limited to the Kubernetes cluster, and can also be applied to other similar service clusters. The protection scope of the embodiment of the present disclosure is not limited to the Kubernetes cluster. The service cluster provided in the embodiment of the present disclosure includes an API Server component and a hook function callback service module for generating encryption parameters.

[0047] See also Figure 2 As shown, the information processing method in the embodiment of the present disclosure mainly includes the following steps:

[0048] Step 201: Obtain a confidential resource instance creation request of a target application, wherein the confidential resource instance creation request includes initial assembly information of the confidential resource instance requested to be created.

[0049] A confidential resource instance is an object instance used to store confidential data, generally used to store passwords, tokens, keys, etc. The confidential resource instance created in the embodiment of the present disclosure is used to store encryption parameters.

[0050] The initial assembly information includes the various components of the confidential resource instance and the data structure of each component. The initial assembly information includes encryption parameter application information, which is stored in the data structure of the initial assembly information. The encryption parameter application information includes information required to generate encryption parameters.

[0051] In some embodiments, the target application may be any application that provides HTTPS service.

[0052] In some embodiments, taking the encryption parameter as a certificate as an example, the encryption parameter application information includes at least one of the following: certificate algorithm (such as RSA, ECC, etc.), certificate common name, additional domain name, certificate validity period (or certificate life), certificate user information (such as certificate organization, certificate department), address information. In addition to the above listed content, the encryption parameter application information may also include other content related to applying for certificate generation and using certificates, which are not listed here one by one.

[0053] In some embodiments, the certificate algorithm includes any one of an asymmetric encryption algorithm RSA, an elliptic curve encryption algorithm (Elliptic Curves Cryptography, ECC), and the like.

[0054] In some embodiments, the initial assembly information also includes an encryption key, which is used to encrypt the private key of the generated encryption parameters to improve the security of private key storage and use. Exemplarily, the encryption key supports 256-bit Advanced Encryption Standard (AES, AES256) AES256 and RSA2048. Of course, other encryption standards can also be supported, which are not listed here one by one.

[0055] In an exemplary embodiment, the initial assembly information of the Secret resource instance includes carrying encryption parameter application information and encryption keys in annotations of the metadata of the Secret resource instance.

[0056] In some embodiments, the initial assembly information includes an encryption parameter confidentiality tag, such as a certificate-secret tag, to indicate the required Secret resource instance for storing encryption parameter information. By carrying the encryption parameter confidentiality tag in the initial assembly information, it is possible to quickly identify which Secret resource instance creation requests need to generate encryption parameters, thereby improving processing efficiency.

[0057] For example, before the Admission Webhook plugin calls the Webhook callback service module, it first determines whether the initial assembly information carries the encryption parameter confidentiality tag. If not, it stops calling the Webhook callback service module. If it carries, it continues to call the Webhook callback service module. It can be seen that the Webhook callback service module can quickly identify which Secret resource instance creation requests need to generate encryption parameters through the encryption parameter confidentiality tag, thereby improving processing efficiency.

[0058] In an exemplary embodiment, the key management service module of the Kubernetes cluster generates a request to create a Secret resource instance according to the encryption parameter generation request initiated by the target application, and includes the initial assembly information of the Secret resource instance to be created in the Secret resource instance creation request, and adds an encryption parameter confidentiality label. Among them, the key management service module, as a basic component of the Kubernetes cluster, is the core of key management in the cluster. It has high requirements for communication security and generally requires the provision of HTTPS protocol services. Therefore, the generation, update and secure storage of encryption parameters are issues of concern during the development and operation and maintenance of the key management service module.

[0059] In an exemplary embodiment, an API Server component of a Kubernetes cluster obtains a confidential resource instance creation request of a target application.

[0060] Step 202: Generate encryption parameter information based on the confidential resource instance creation request, and reassemble the initial assembly information of the confidential resource instance based on the encryption parameter information to obtain the reassembled assembly information of the confidential resource instance.

[0061] In some embodiments, the reassembly information of the confidential resource instance includes the encryption parameter information.

[0062] The reassembly information includes the components of the reassembled confidential resource and the data structure of each component. The reassembly information includes encryption parameter information. The encryption parameter information is stored in the data structure of the reassembly information.

[0063] In an exemplary embodiment, the API Server component calls a hook function callback service module for generating encryption parameters to transmit the confidential resource instance creation request to the hook function callback service module; the hook function callback service module generates the encryption parameter information based on the confidential resource instance creation request, and reassembles the initial assembly information of the confidential resource instance based on the encryption parameter information, obtains the reassembled assembly information of the confidential resource instance and returns it to the API Server component.

[0064] Specifically, the API Server component calls the hook function callback service module through the callback operation of the admission controller plug-in to transmit the confidential resource instance creation request to the hook function callback service module, and the hook function service module generates confidential resource information for the confidential resource creation request, and returns the reassembly information of the confidential resource instance to the API Server component, and the reassembly information of the confidential resource instance includes the information of the encryption parameter. By utilizing the callback operation of the admission controller plug-in, the information interaction between the hook function callback service module and the API Server component is realized, so that the function of generating encryption parameters by the hook function callback service module can be used to generate the required encryption parameter information and return it to the API Server component, which is simple to implement.

[0065] In some embodiments, generating the encryption parameter information based on the confidential resource instance creation request includes:

[0066] Generate a public-private key pair according to the encryption parameter algorithm in the encryption parameter application information of the confidential resource instance creation request, the public-private key pair including a public key and a private key;

[0067] Assembling encryption parameter user information (subjuct) according to the encryption parameter user information in the encryption parameter application information;

[0068] Assemble encryption parameter template;

[0069] Use the private key in the public-private key pair to sign the assembled encryption parameter template;

[0070] The signed encryption parameter template is encoded to obtain the encryption parameter.

[0071] In the exemplary embodiment, it is assumed that the encryption parameter is a certificate, the certificate algorithm is an RSA algorithm, and the programming language is go language as an example. The process of generating a certificate is illustrated as follows. The process includes: generating a public-private key pair, including an RSA public key and a private key; assembling certificate user information and assembling a certificate template, using the private key in the public-private key pair to sign the certificate template, and encoding the signed certificate with Privacy Enhancement Message (PEM) to obtain a certificate.

[0072] In an exemplary embodiment, the process of the hook function callback service module generating a private key encrypted ciphertext of encryption parameters according to the confidential resource instance creation request includes: using the set encryption algorithm to calculate the encryption key to obtain an intermediate value, using the intermediate value to encrypt the private key in the public-private key pair to obtain the private key encrypted ciphertext.

[0073] In an exemplary embodiment, the hook function callback service module uses the AES256 symmetric encryption algorithm to calculate the SHA256 value of the encryption key. The SHA256 value is the intermediate value. The SHA256 value is used to perform AES-CBC-PKCS7Padding encryption on the private key in the public-private key pair to obtain the private key encrypted ciphertext.

[0074] In some embodiments, the initial assembly information includes an encryption key; the encryption parameter information includes encryption parameters and private key encrypted ciphertext of the encryption parameters, and the private key encrypted ciphertext of the encryption parameters is obtained by encrypting the private key of the encryption parameters using the encryption key; the reassembly information includes the encryption parameters and the private key encrypted ciphertext of the encryption parameters; the reassembly of the initial assembly information of the confidential resource instance based on the encryption parameter information to obtain the reassembly information of the confidential resource instance includes: reassembling the data structure under the first target path in the initial assembly information of the confidential resource instance to assemble the encryption parameters and the private key encrypted ciphertext of the encryption parameters under the first target path to obtain the reassembly information of the confidential resource instance.

[0075] Specifically, the hook function callback service module reassembles the data structure under the first target path in the initial assembly information of the confidential resource instance to assemble the encryption parameters and the private key encrypted ciphertext of the encryption parameters to the first target path of the confidential resource instance to obtain the reorganized assembly information of the confidential resource instance.

[0076] Among them, the encryption parameters are used by the target application to provide HTTPS services after being obtained. The private key encrypted ciphertext of the encryption parameters is used to provide the private key required to obtain the encryption parameters in a secure manner to improve security. The certificate and the private key encrypted ciphertext of the certificate provide a basis for the target application to safely use the certificate.

[0077] In an exemplary embodiment, the initial assembly information of the confidential resource instance includes the certificate application information and the encryption key carried in the annotations of the metadata of the confidential resource instance.

[0078] The hook function callback service module obtains encryption parameter application information and encryption key from the annotation of the metadata of the confidential resource instance.

[0079] In some embodiments, the encryption parameter information also includes the expiration time of the encryption parameter and the encrypted ciphertext of the encryption key; the reassembly information also includes the expiration time of the encryption parameter and the encrypted ciphertext of the encryption key; the reassembly of the initial assembly information of the confidential resource instance based on the encryption parameter information to obtain the reassembly information of the confidential resource instance includes: reassembling the data structure under the second target path in the initial assembly information of the confidential resource instance to assemble the expiration time of the encryption parameter and the encrypted ciphertext of the encryption key to the second target path to obtain the reassembly information of the confidential resource instance.

[0080] The expiration time of the encryption parameter is used to provide a judgment basis for the update of the encryption parameter, and the encrypted ciphertext of the encryption key provides a basis for the security of updating the encryption parameter.

[0081] In an exemplary embodiment, the hook function callback service module reassembles the data structure under the second target path in the initial assembly information of the confidential resource instance to assemble the expiration time of the encryption parameter and the encrypted ciphertext of the encryption key to the second target path of the confidential resource instance to obtain the reorganized assembly information of the confidential resource instance.

[0082] By saving the encryption parameters and private key encrypted ciphertext used for HTTPS service to the first target path, and saving the expiration time of the encryption parameters and the encrypted ciphertext of the encryption key used to update the encryption parameters to the second target path, the two parts of the content are made relatively independent, which provides convenience for subsequent use.

[0083] In an exemplary embodiment, the first target path is " / data" in the confidential resource instance.

[0084] The hook function callback service module assembles the data structure under " / data" in the confidential resource instance, and assembles the generated encryption parameters and the private key encrypted ciphertext of the encryption parameters into a map structure of data. Specifically, the PathOperation structure is adopted, the structure type is replace, the path is " / data", and the value is the encryption parameters and the private key encrypted ciphertext of the encryption parameters.

[0085] In an exemplary embodiment, the second target path is " / metadata / annotations" in the confidential resource instance.

[0086] The hook function callback service module assembles the data structure under " / metadata / annotations" in the confidential resource instance, deletes the original encryption parameter application information and encryption key under " / metadata / annotations", and adds the expiration time of the current encryption parameter and the encrypted ciphertext of the encryption key. The encrypted ciphertext of the encryption key is obtained by encrypting the encryption key using the key built into the hook function callback service module. The encrypted ciphertext of the encryption key is used in the encryption parameter update process. Specifically, the PathOperation structure is used, the structure type is replace, the path is " / metadata / annotations", and the value is the encryption parameter application information and the encrypted ciphertext of the encryption key.

[0087] In some embodiments, the reassembly information of the confidential resource instance includes an encryption parameter confidentiality tag, and the encryption parameter confidentiality tag is used to indicate that the confidential resource instance to be created stores the encryption parameter information. By including the encryption parameter confidentiality tag in the reassembly information, the confidential resource instance storing the encryption parameter can be quickly identified during the process of monitoring the generated encryption parameter, thereby improving processing efficiency.

[0088] In an exemplary embodiment, the target application initiates a confidential resource instance creation request to the Kubernetes cluster, and the resource creation request includes encryption parameter application information and an encryption key; the API Server component in the Kubernetes cluster obtains the confidential resource instance creation request, and other functional modules in the Kubernetes cluster (such as the key management service module) add an encryption parameter confidentiality tag to the confidential resource instance to be created when they recognize that the confidential resource instance creation request obtained by the API Server component is used to request the generation of encryption parameters.

[0089] Among them, other functional modules in the Kubernetes cluster used to add confidentiality labels for encryption parameters can also be other functional modules, which can be selected according to design requirements and are not limited here.

[0090] Step 203: Create the confidential resource instance based on the reassembly information of the confidential resource instance, wherein the confidential resource instance includes the encryption parameter information.

[0091] In some embodiments, the method further includes: mounting the encryption parameter information in the confidential resource instance to a scheduling unit of the target application for use by the target application.

[0092] In an exemplary embodiment, the API Server component creates and saves the confidential resource based on the reassembly information of the confidential resource instance to mount the information of the encryption parameters in the resource instance into the scheduling unit (e.g., pod) of the target application for use by the target application.

[0093] In an exemplary embodiment, the hook function callback service module returns the reassembly information to the API Server component via Admission Response, that is, the data of the PathOperation structure of " / metadata / annotations" and " / data" are returned to the API Server component via Admission Response.

[0094] In some embodiments, creating the confidential resource instance based on the reassembly information of the confidential resource instance includes: creating the confidential resource instance based on the reassembly information of the confidential resource instance, and saving the confidential resource instance to the distributed key-value memory of the service cluster. Saving the confidential resource instance to the distributed key-value memory enables persistent storage of encryption parameter information.

[0095] In an exemplary embodiment, the API Server component creates a CR resource based on the reassembly information of the Secret resource instance returned by the hook function callback service module. The CR resource is of Secret type, creates a corresponding Secret resource instance in the CR resource, and saves the Secret resource instance to the Etcd database.

[0096] In some embodiments, the method further includes: monitoring the confidential resource instance, obtaining the expiration time of the encryption parameter in the confidential resource instance, and updating the encryption parameter information in the confidential resource instance based on the expiration time of the encryption parameter when the conditions for updating the encryption parameter are met.

[0097] In an exemplary embodiment, the hook function callback service module monitors the confidential resource instance, obtains the expiration time of the encryption parameter in the confidential resource instance, and updates the encryption parameter information in the confidential resource instance when determining that the conditions for updating the encryption parameter are met based on the expiration time of the encryption parameter.

[0098] In an exemplary embodiment, it is assumed that the encryption parameter is a certificate, and the expiration time of the certificate refers to the end time of the certificate validity period or the time when the certificate life expires. The expiration time of the certificate is assembled under " / metadata / annotations" in the Secret resource instance.

[0099] In an exemplary embodiment, assuming that the encryption parameter is a certificate, determining whether a condition for updating the certificate is met is based on the expiration time of the certificate, including: comparing the expiration time of the certificate with the current time to obtain the difference between the expiration time of the certificate and the current time; when the difference is less than a set time threshold, determining that the condition for updating the certificate is met; when the difference is not less than the set time threshold, determining that the condition for updating the certificate is not met.

[0100] The duration threshold is set as required, and may be an integer in days or hours. For example, the duration threshold is set to 30 days.

[0101] In some embodiments, updating the encryption parameter information in the confidential resource instance includes:

[0102] Obtaining the encryption parameter and the encrypted ciphertext of the encryption key of the encryption parameter from the confidential resource instance;

[0103] Parsing the encryption parameter to obtain the encryption parameter application information;

[0104] Decrypting the encrypted ciphertext of the encryption key to obtain the encryption key;

[0105] Generate new information of the encryption parameter based on the encryption parameter application information and the encryption key;

[0106] The original encryption parameter information in the confidential resource instance is updated based on the new encryption parameter information.

[0107] The encryption parameter expiration time of the new encryption parameter information is calculated from the current time.

[0108] In an exemplary embodiment, the hook function callback service module obtains the encrypted ciphertext of the encryption parameter and the encryption key of the encryption parameter from the confidential resource instance; the hook function callback service module parses the encryption parameter to obtain the certificate application information; the hook function callback service module decrypts the encrypted ciphertext of the encryption key to obtain the encryption key; the hook function callback service module uses the encryption parameter application information and the encryption key to generate new encryption parameter information; the hook function callback service module uses the new encryption parameter information to update the original encryption parameter information in the confidential resource instance.

[0109] In an exemplary embodiment, when determining that the conditions for updating the certificate are met, the hook function callback service module obtains the certificate in the data in the Secret resource instance and the encrypted ciphertext of the encryption key in the annotations, and parses the certificate to obtain the certificate application information.

[0110] In an exemplary embodiment, the hook function callback service module uses the new certificate to update the original certificate in the Secret resource instance data, uses the recalculated ciphertext of the encryption key of the certificate to update the encrypted ciphertext of the original encryption key in the Secret resource instance annotations, and updates the expiration time of the certificate in the Secret resource instance annotations.

[0111] In some embodiments, the confidential resource instance carries an encryption parameter confidentiality tag, and the encryption parameter confidentiality tag is used to indicate that the encryption parameter information is stored in the confidential resource instance;

[0112] The monitoring the confidential resource instance and obtaining the expiration time of the encryption parameter in the confidential resource instance includes:

[0113] The confidential resource instance is monitored, and when the confidential resource instance carries the encryption parameter confidentiality tag, an expiration time of the encryption parameter in the confidential resource instance is obtained.

[0114] In an exemplary embodiment, the hook function callback service module monitors the confidential resource instance, and obtains the expiration time of the encryption parameter in the confidential resource instance when the confidential resource instance carries the encryption parameter confidentiality tag.

[0115] In an exemplary embodiment, the hook function callback service module monitors the Secret resource instance through the cache of the resource notifier (informer). Specifically, the informer continuously reads the Secret resource instance from the Etcd database into the cache, and the hook function callback service module reads the Secret resource instance with the encryption parameter confidentiality tag from the informer's cache, obtains the encryption parameter expiration time of the Secret resource instance, subtracts the encryption parameter expiration time from the current time to determine whether the conditions for updating the encryption parameters are met. If the conditions are met, the encryption parameters are updated. If not, no further processing is required.

[0116] In an exemplary embodiment, when the encryption parameter is a certificate, the Kubernetes cluster mounts the Secret resource instance as a file into the pod of the target application; the process of the target application reads the certificate and the private key encrypted ciphertext of the certificate from the mounted file, uses its own encryption key to perform aes-cbc-pkcs7padding decryption on the private key encrypted ciphertext, obtains the private key in the public-private key pair, and uses the certificate and the private key to provide HTTPS service.

[0117] In an exemplary embodiment, when the encryption parameter is a certificate, the data encryption service program of the target application obtains the mounted certificate and the private key encrypted ciphertext from the pod, decrypts the private key encrypted ciphertext with the encryption key to obtain the private key, and provides HTTPS service using the certificate and the private key. Other applications use the HTTPS service to connect to the data encryption service program of the target application to encrypt or decrypt data.

[0118] When the Kubernetes cluster detects updates to the Secret resource instance, it automatically updates the certificate and the certificate's private key encrypted ciphertext mounted in the target application's pod.

[0119] The target application process automatically monitors changes in files mounted in the pod, and automatically restarts when a certificate update is detected to provide HTTPS services using the updated certificate and private key.

[0120] In an exemplary embodiment, Figure 3 The following is a schematic diagram of the process of generating and updating certificates for a Kubernetes cluster. The process mainly includes:

[0121] In order to provide HTTPS services, the application initiates a Secret resource instance creation request to the Kubernetes cluster. The Secret resource instance creation request includes certificate application information and encryption key.

[0122] The API Server component in the Kubernetes cluster obtains the Secret resource instance creation request and calls back the Webhook callback service module for generating certificates through the Admission Webhook plug-in.

[0123] The Webhook callback service module generates certificate information based on the Secret resource instance creation request. The certificate information includes the certificate, the encrypted ciphertext of the certificate's private key, the certificate's expiration date, and the encrypted ciphertext of the encryption key, and returns it to the API Server component in the form of an Admission Response.

[0124] The API Server component creates and saves a Secret resource instance, which includes certificate information, and mounts the certificate and its private key encrypted ciphertext to the application's pod for use when the application provides HTTPS services.

[0125] When the Webhook callback service module monitors that the expiration time of the certificate meets the conditions for updating the certificate, it regenerates the certificate with the current time as the start time based on the encrypted ciphertext of the certificate and encryption key, and updates the stored certificate and the mounted certificate.

[0126] The embodiments provided by the present disclosure, when it is necessary to generate encryption parameters for a target application, obtain a confidential resource instance creation request of the target application, generate encryption parameter information for the confidential resource creation request, reassemble the initial assembly information of the confidential resource instance based on the encryption parameter information, obtain the reassembled assembly information of the confidential resource instance, and create the confidential resource instance based on the reassembled assembly information of the confidential resource instance, so that a confidential resource instance including encryption parameters can be generated for the application by creating a confidential resource instance, without adding new resource types or separately generating encryption parameter code for application development, thereby reducing the difficulty of application development, improving the efficiency of encryption parameter generation, reducing implementation complexity, and improving the efficiency of encryption parameter generation, use, and maintenance.

[0127] In the solution provided by the embodiment of the present disclosure, the generation, update and secure storage process of encryption parameters are separated from the application development process, so that application developers do not need to pay attention to the generation, update and storage process of encryption parameters, thereby improving application development efficiency.

[0128] Compared with the method of integrating Cert-manager certificate management service, it has the following advantages:

[0129] 1. The service provided by Cert-manager needs to create two types of resource instances: Certificate and Secret. The solution provided by the embodiment of the present disclosure does not need to create a resource instance of the Certificate type, but can use the Secret resource instance of the Kubernetes cluster, thereby reducing resource usage.

[0130] 2. The service provided by Cert-manager does not support encrypted storage of the private key of the encryption parameter, which is easy to be cracked and leaked, and has low security. The solution provided by the embodiment of the present disclosure encrypts and stores the private key of the encryption parameter through an encryption key, and the application uses the encryption key for decryption during the use of the encryption parameter, thereby ensuring the security of the private key of the encryption parameter and improving the security of the use of the encryption parameter.

[0131] It can be understood that the above-mentioned various method embodiments mentioned in the present disclosure can be combined with each other to form a combined embodiment without violating the principle logic. Due to space limitations, the present disclosure will not repeat them. It can be understood by those skilled in the art that in the above-mentioned method of the specific implementation method, the specific execution order of each step should be determined according to its function and possible internal logic.

[0132] In addition, the present disclosure also provides an information processing device, an electronic device, and a computer-readable storage medium, all of which can be used to implement any information processing method provided by the present disclosure. The corresponding technical solutions and descriptions are referred to the corresponding records in the method part and will not be repeated here.

[0133] Figure 4 A block diagram of an information processing device provided in an embodiment of the present disclosure.

[0134] Reference Figure 4 , an embodiment of the present disclosure provides an information processing device, the device comprising:

[0135] The acquisition module 401 is used to acquire a confidential resource instance creation request of a target application, wherein the confidential resource instance creation request includes initial assembly information of the confidential resource instance requested to be created;

[0136] An assembly module 402 is used to generate the encryption parameter information based on the confidential resource instance creation request, and reassemble the initial assembly information of the confidential resource instance based on the encryption parameter information to obtain the reassembled assembly information of the confidential resource instance;

[0137] The creation module 403 is used to create the confidential resource instance based on the reassembly information of the confidential resource instance, wherein the confidential resource instance includes the encryption parameter information.

[0138] Figure 5 A block diagram of an electronic device provided in an embodiment of the present disclosure.

[0139] Reference Figure 5 An embodiment of the present disclosure provides an electronic device, which includes: at least one processor 701; at least one memory 702, and one or more I / O interfaces 703, connected between the processor 701 and the memory 702; wherein the memory 702 stores one or more computer programs that can be executed by the at least one processor 701, and the one or more computer programs are executed by the at least one processor 701 so that the at least one processor 701 can execute the above-mentioned information processing method.

[0140] The present disclosure also provides a computer-readable storage medium on which a computer program is stored, wherein the computer program implements the above-mentioned information processing method when executed by a processor / processing core. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium.

[0141] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above-mentioned information processing method.

[0142] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable storage medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium).

[0143] As is known to those of ordinary skill in the art, the term computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable program instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technology, portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. In addition, it is known to those of ordinary skill in the art that communication media typically contain computer-readable program instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium.

[0144] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0145] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0146] The computer program product described herein may be implemented in hardware, software, or a combination thereof. In one optional embodiment, the computer program product is embodied as a computer storage medium, and in another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK), etc.

[0147] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0148] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0149] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0150] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0151] Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly noted, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, those skilled in the art will appreciate that various changes in form and detail may be made without departing from the scope of the present disclosure as set forth in the appended claims.

Claims

1. An information processing method, characterized in that: The method comprises: Obtaining a confidential resource instance creation request of a target application, wherein the confidential resource instance creation request includes initial assembly information of the confidential resource instance requested to be created; Generate encryption parameter information based on the confidential resource instance creation request, and reassemble the initial assembly information of the confidential resource instance based on the encryption parameter information to obtain the reassembled assembly information of the confidential resource instance; The confidential resource instance is created based on the reassembly information of the confidential resource instance, wherein the confidential resource instance includes the encryption parameter information.

2. The method according to claim 1, characterized in that The step of creating the confidential resource instance based on the reassembly information of the confidential resource instance includes: The confidential resource instance is created based on the reassembly information of the confidential resource instance, and the confidential resource instance is saved in a distributed key-value storage of the service cluster.

3. The method according to claim 1, characterized in that The method further comprises: The encrypted parameter information in the confidential resource instance is mounted to the scheduling unit of the target application for use by the target application.

4. The method according to claim 1, characterized in that: The initial assembly information includes an encryption key; the encryption parameter information includes an encryption parameter and a private key encrypted ciphertext of the encryption parameter, wherein the private key encrypted ciphertext of the encryption parameter is obtained by encrypting the private key of the encryption parameter using the encryption key; the reassembly information includes the encryption parameter and the private key encrypted ciphertext of the encryption parameter; The reassembling the initial assembly information of the confidential resource instance based on the encryption parameter information to obtain the reassembled assembly information of the confidential resource instance includes: Reassemble the data structure under the first target path in the initial assembly information of the confidential resource instance to assemble the encryption parameters and the private key encrypted ciphertext of the encryption parameters under the first target path to obtain the reorganized assembly information of the confidential resource instance.

5. The method according to claim 4, characterized in that The encryption parameter information also includes the expiration time of the encryption parameter and the encrypted ciphertext of the encryption key; the reassembly information also includes the expiration time of the encryption parameter and the encrypted ciphertext of the encryption key; The reassembling the initial assembly information of the confidential resource instance based on the encryption parameter information to obtain the reassembled assembly information of the confidential resource instance includes: Reassemble the data structure under the second target path in the initial assembly information of the confidential resource instance to assemble the expiration time of the encryption parameter and the encrypted ciphertext of the encryption key under the second target path to obtain the reorganization assembly information of the confidential resource instance.

6. The method according to claim 5, characterized in that The method further comprises: Monitoring the confidential resource instance, and obtaining the expiration time of the encryption parameter in the confidential resource instance; According to the expiration time of the encryption parameter, when a condition for updating the encryption parameter is met, the encryption parameter information in the confidential resource instance is updated.

7. The method according to claim 6, characterized in that The updating of the encryption parameter information in the confidential resource instance includes: Obtaining the encryption parameter and the encrypted ciphertext of the encryption key of the encryption parameter from the confidential resource instance; Parsing the encryption parameters to obtain encryption parameter application information; Decrypting the encrypted ciphertext of the encryption key to obtain the encryption key; Generate new encryption parameter information based on the encryption parameter application information and the encryption key; The original encryption parameter information in the confidential resource instance is updated based on the new encryption parameter information.

8. The method according to claim 6, characterized in that The confidential resource instance has an encryption parameter confidentiality tag, and the encryption parameter confidentiality tag is used to indicate that the encryption parameter information is stored in the confidential resource instance; The monitoring the confidential resource instance and obtaining the expiration time of the encryption parameter in the confidential resource instance includes: The confidential resource instance is monitored, and when the confidential resource instance carries the encryption parameter confidentiality tag, an expiration time of the encryption parameter in the confidential resource instance is obtained.

9. An information processing device, characterized in that: The device comprises: An acquisition module, configured to acquire a confidential resource instance creation request of a target application, wherein the confidential resource instance creation request includes initial assembly information of the confidential resource instance requested to be created; An assembly module, configured to generate encryption parameter information based on the confidential resource instance creation request, and reassemble the initial assembly information of the confidential resource instance based on the encryption parameter information to obtain the reassembled assembly information of the confidential resource instance; A creation module is used to create the confidential resource instance based on the reassembly information of the confidential resource instance, wherein the confidential resource instance includes the encryption parameter information.

10. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores at least one computer program executable by the at least one processor, and the at least one computer program is executed by the at least one processor so that the at least one processor can perform the information processing method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the computer program implements the information processing method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The invention comprises a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the information processing method as described in any one of claims 1 to 8.

Images