Container mirror image encryption and decryption method and device and storage medium

Abstract

The invention discloses a container mirror image encryption and decryption method and device and a storage medium, and the encryption and decryption method comprises an encryption process: carrying out the layer-by-layer encryption of a container mirror image; obtaining the data volume stored by the to-be-encrypted data layer file, and judging whether the data volume stored by the to-be-encrypted data layer file is greater than a preset data volume threshold value or not; and if the judgment result is yes, performing data encryption on the storage data of the to-be-encrypted layer file by adopting a first encryption mode, and if the judgment result is no, performing data encryption on the storage data of the to-be-encrypted layer file by adopting a second encryption mode. According to the encryption and decryption method for the container mirror image, an encryption scheme for a layer file (1 ayer) of the container mirror image can be applied to a multi-region, multi-cloud and cross-border container mirror image warehouse and a container cluster product, and the encryption and decryption method for the container mirror image has important significance for improving the safety of the container mirror image.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing, and specifically provides a container image encryption and decryption method, device and storage medium. Background Art

[0002] With the rapid development of large-scale AI model applications, the construction and deployment of large-scale model applications on cloud computing infrastructure is becoming more and more common. Model files are one of the core assets of an enterprise. As the carrier of model files, container images also have higher security requirements. A container image is a lightweight, executable software package that contains everything needed to run a container - code, runtime environment, libraries, environment variables, and configuration files. The concept of container images is the core part of container technology, which enables containers to run in a consistent manner in different environments without being affected by the host environment. Container images are organized in the form of a layered file system. Each layer is based on the changes or additions made to the previous layer. Each layer is a layer file, and a series of layer files combine to form a complete container image.

[0003] In the traditional image repository solution, the layer files of the container image are transparent and visible. Any party that obtains the container image layer file can read the content. With the cross-border and cross-regional deployment of large model services, the security risks brought by the model distribution with the container image also increase. Therefore, the current container image repository solution in the industry has deficiencies in the security of container images, especially in a multi-regional and multi-cloud environment, the problem of container image security is particularly significant.

[0004] In view of this, the present invention patent is proposed. Summary of the invention

[0005] In view of the above technical problems, the present invention proposes a container image encryption and decryption method, device and storage medium. By designing an encryption mechanism for container image layer files in the container image repository, the key of the decryption layer file is distributed to the authorized client, so that even if the unauthorized client downloads the container image, it cannot obtain the content therein, thereby improving the security of the container image.

[0006] Specifically, the following technical solutions are adopted:

[0007] In a first aspect, the present invention provides a method for encrypting and decrypting a container image, including an encryption process:

[0008] Encrypt container images layer by layer;

[0009] Obtain the amount of data stored in the file of the data layer to be encrypted, and determine whether the amount of data stored in the file of the data layer to be encrypted is greater than a preset data amount threshold;

[0010] If the judgment result is yes, the first encryption method is used to encrypt the storage data of the to-be-encrypted layer file; if the judgment result is no, the second encryption method is used to encrypt the storage data of the to-be-encrypted layer file.

[0011] As an optional implementation manner of the present invention, in a container image encryption and decryption method of the present invention, the step of encrypting the storage data of the to-be-encrypted layer file using a first encryption method comprises:

[0012] Extracting the stored data in the designated area of ​​the to-be-encrypted layer file as target encrypted data, wherein the data volume of the target encrypted data is a preset encrypted data value, and the preset encrypted data value is less than or equal to a preset data volume threshold;

[0013] The first encryption algorithm is used to encrypt the target encrypted data.

[0014] As an optional implementation manner of the present invention, in a container image encryption and decryption method of the present invention, the step of encrypting target encrypted data using a first encryption algorithm includes:

[0015] Encrypt the first N bytes of the target encrypted data to obtain the ciphertext length area, which is used to indicate the length of the encrypted ciphertext, where N is a set value;

[0016] Encrypting the stored data after the ciphertext length area of ​​the target encrypted data to obtain the ciphertext area;

[0017] After the target encrypted data is encrypted, the original source data is retained after removing the ciphertext length area and the ciphertext area to obtain a remaining source data area.

[0018] As an optional implementation manner of the present invention, in a method for encrypting and decrypting a container image of the present invention, encrypting the storage data of the to-be-encrypted layer file using a second encryption method includes:

[0019] A second encryption algorithm is used to encrypt all stored data of the to-be-encrypted layer file. The second encryption algorithm is the same as or different from the first encryption algorithm.

[0020] As an optional implementation of the present invention, in a container image encryption and decryption method of the present invention, the data encryption using a second encryption algorithm for all stored data of the to-be-encrypted layer file includes:

[0021] The second encryption algorithm, which is the same as the first encryption algorithm, is used to encrypt all the stored data of the file in the to-be-encrypted layer;

[0022] Encrypt the first N bytes of all the stored data of the file to be encrypted to obtain the ciphertext length area, which is used to indicate the length of the encrypted ciphertext, where N is a set value;

[0023] The remaining data in the to-be-encrypted layer file excluding the ciphertext length area is encrypted to obtain the ciphertext area.

[0024] As an optional implementation of the present invention, a container image encryption and decryption method of the present invention includes a decryption process:

[0025] When the cluster client pulls the container image, it decrypts the container image layer by layer;

[0026] Read the stored data in the ciphertext length area of ​​the to-be-decrypted layer file to obtain the ciphertext length N;

[0027] According to the ciphertext length N, read the encrypted data stored in the N-byte ciphertext area after the ciphertext length area in the layer file to be decrypted, and use the decryption private key issued by the image repository to decrypt and obtain the decrypted data;

[0028] After the decryption of the ciphertext area of ​​the to-be-decrypted layer file is completed, if there is a remaining source data area after removing the ciphertext length area and the ciphertext area in the to-be-decrypted layer file, the decrypted data of the ciphertext area and the remaining source data of the remaining source data area are combined to obtain the complete decrypted data of the to-be-decrypted layer file; if there is no remaining source data area after removing the ciphertext length area and the ciphertext area in the to-be-decrypted layer file, the decrypted data of the ciphertext area is the complete decrypted data of the to-be-decrypted layer file.

[0029] In a second aspect, the present invention provides an encryption and decryption device for a container image, comprising an encryption module, wherein the encryption module performs layer-by-layer encryption on the container image;

[0030] The encryption module obtains the amount of data stored in the data layer file to be encrypted, and determines whether the amount of data stored in the data layer file to be encrypted is greater than a preset data amount threshold. If the judgment result is yes, the first encryption method is used to encrypt the storage data of the file to be encrypted. If the judgment result is no, the second encryption method is used to encrypt the storage data of the file to be encrypted.

[0031] As an optional implementation of the present invention, a container image encryption and decryption device of the present invention includes a decryption module. When a cluster client pulls a container image, the decryption module performs layer-by-layer decryption on the container image.

[0032] The decryption module reads the stored data in the ciphertext length area of ​​the to-be-decrypted layer file to obtain the ciphertext length N;

[0033] The decryption module reads the encrypted data stored in the N-byte ciphertext area after the ciphertext length area in the to-be-decrypted layer file according to the ciphertext length N, and decrypts it using the decryption private key issued by the image repository to obtain the decrypted data;

[0034] After the decryption module completes the decryption of the ciphertext area of ​​the to-be-decrypted layer file, if there is a remaining source data area after the ciphertext length area and the ciphertext area are removed from the to-be-decrypted layer file, the decrypted data of the ciphertext area and the remaining source data of the remaining source data area are combined to obtain the complete decrypted data of the to-be-decrypted layer file; if there is no remaining source data area after the ciphertext length area and the ciphertext area are removed from the to-be-decrypted layer file, the decrypted data of the ciphertext area is the complete decrypted data of the to-be-decrypted layer file.

[0035] As an optional implementation manner of the present invention, a container image encryption and decryption device of the present invention includes a key management service module KMS, wherein the key management service module KMS provides an encryption public key for container image encryption to the image repository, and sends a decryption private key for container image decryption to the cluster client.

[0036] In a third aspect, the present invention provides a computer-readable recording medium storing a computer-executable program, wherein when the computer-executable program is executed, the method for encrypting and decrypting a container image is implemented.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] The container image encryption and decryption method of the present invention encrypts the layer file (layer) of the container image layer by layer to ensure the data security of the layer file (layer) of the container image. In addition, during the data encryption process, the corresponding encryption method is selected according to the amount of data stored in the layer file (layer) of the data to be encrypted to ensure efficient and reliable data encryption. Therefore, after the layer file (layer) data of the container image is encrypted by the container image encryption and decryption method of the invention, even if the container image is leaked, the unauthorized third party cannot use the container image after obtaining it, which greatly improves the security of the container image.

[0039] Therefore, the encryption and decryption method of a container image of the present invention is an encryption scheme for the layer file (layer) of the container image, which can be applied to multi-regional, multi-cloud, and cross-border container image repositories and container cluster products. As the first scheme proposed on the market, this scheme is of great significance to improving the security of container images. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 An encryption flow chart of a container image encryption and decryption method according to a first embodiment of the present invention;

[0041] Figure 2 A decryption flow chart of a container image encryption and decryption method according to a first embodiment of the present invention;

[0042] Figure 3 An example diagram of the encryption and decryption process of a container image encryption and decryption method according to the first embodiment of the present invention;

[0043] Figure 4 A schematic diagram of key management of a key management service module in a container image encryption and decryption device according to a first embodiment of the present invention;

[0044] Figure 5 A flowchart of a method for pre-distributing cloud-native container images according to a second embodiment of the present invention;

[0045] Figure 6 A diagram of a one-master-multiple-slave image repository architecture according to Embodiment 2 of the present invention;

[0046] Figure 7 A specific example flow chart of a method for pre-distributing cloud-native container images according to Embodiment 2 of the present invention;

[0047] Figure 8 A schematic diagram of the structure of an electronic device according to a third embodiment of the present invention;

[0048] Fig. 9 A schematic diagram of a computer-readable recording medium according to a third embodiment of the present invention. DETAILED DESCRIPTION

[0049] To make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them.

[0050] Therefore, the following detailed description of the embodiments of the present invention is not intended to limit the scope of the invention claimed for protection, but merely represents some embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions in the embodiments may be combined with each other.

[0052] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0053] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the invention product is usually placed when in use, or the orientation or positional relationship commonly understood by those skilled in the art. Such terms are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0054] Embodiment 1

[0055] In the Internet system service architecture, for the stability of the service, a system service will be split into multiple independent functional modules, namely microservices, to ensure that the failure of a microservice will not affect other functional services; in addition, microservices also need to rely on the functional interfaces of other services, from user entry services to the final basic services such as databases and caches, forming a call tree link, namely the service call link.

[0056] See also Figure 1 As shown, a container image encryption and decryption method of this embodiment includes an encryption process:

[0057] Encrypt container images layer by layer;

[0058] Obtaining the amount of data stored in the layer file to be encrypted, and determining whether the amount of data stored in the layer file to be encrypted is greater than a preset data amount threshold;

[0059] If the judgment result is yes, the first encryption method is used to encrypt the storage data of the to-be-encrypted layer file; if the judgment result is no, the second encryption method is used to encrypt the storage data of the to-be-encrypted layer file.

[0060] The container image encryption and decryption method of the present embodiment encrypts the layer file (layer) of the container image layer by layer to ensure the data security of the layer file (layer) of the container image. In addition, during the data encryption process, the corresponding encryption method is selected according to the amount of data stored in the layer file (layer) of the data to be encrypted to ensure efficient and reliable data encryption. Therefore, after the layer file (layer) data of the container image is encrypted by the container image encryption and decryption method of the present embodiment, even if the container image is leaked, an unauthorized third party cannot use the container image after obtaining it, which greatly improves the security of the container image.

[0061] Therefore, the encryption and decryption method of a container image in this embodiment is an encryption scheme for the layer file (layer) of the container image, which can be applied to multi-regional, multi-cloud, and cross-border container image repositories and container cluster products. As the first scheme proposed on the market, this scheme is of great significance to improving the security of container images.

[0062] Furthermore, in a container image encryption and decryption method of this embodiment, the encrypting the storage data of the to-be-encrypted layer file using the first encryption method includes:

[0063] Extracting the stored data in the designated area of ​​the to-be-encrypted layer file as target encrypted data, wherein the data volume of the target encrypted data is a preset encrypted data value, and the preset encrypted data value is less than or equal to a preset data volume threshold;

[0064] The first encryption algorithm is used to encrypt the target encrypted data.

[0065] Specifically, in this embodiment, the designated area of ​​the file to be encrypted that is extracted may be the header or tail data of the file to be encrypted, so that the encrypted data can be obtained from the designated area for decryption.

[0066] Specifically, in a container image encryption and decryption method of this embodiment, encrypting the target encrypted data using a first encryption algorithm includes:

[0067] Encrypt the first N bytes of the target encrypted data to obtain the ciphertext length area, which is used to indicate the length of the encrypted ciphertext, where N is a set value;

[0068] Encrypting the stored data after the ciphertext length area of ​​the target encrypted data to obtain the ciphertext area;

[0069] After the target encrypted data is encrypted, the original source data is retained after removing the ciphertext length area and the ciphertext area to obtain a remaining source data area.

[0070] Correspondingly, in a container image encryption and decryption method of this embodiment, encrypting the storage data of the to-be-encrypted layer file using the second encryption method includes:

[0071] A second encryption algorithm is used to encrypt all stored data of the to-be-encrypted layer file. The second encryption algorithm is the same as or different from the first encryption algorithm.

[0072] In the container image encryption and decryption method of this embodiment, for a to-be-encrypted layer file with a small amount of data, all data in the to-be-encrypted layer file is encrypted using the second encryption algorithm.

[0073] Furthermore, in a container image encryption and decryption method of this embodiment, the encrypting all stored data of the to-be-encrypted layer file using a second encryption algorithm includes:

[0074] The second encryption algorithm, which is the same as the first encryption algorithm, is used to encrypt all the stored data of the file in the to-be-encrypted layer;

[0075] Encrypt the first N bytes of all the stored data of the file to be encrypted to obtain the ciphertext length area, which is used to indicate the length of the encrypted ciphertext, where N is a set value;

[0076] The remaining data in the to-be-encrypted layer file excluding the ciphertext length area is encrypted to obtain the ciphertext area.

[0077] Specifically, the first encryption algorithm and the second encryption algorithm of this embodiment both use the AES algorithm, or other encryption algorithms except the AES algorithm, or one of the first encryption algorithm and the second encryption algorithm uses the AES algorithm, and the other uses other encryption algorithms.

[0078] Also, see Figure 2 As shown, a container image encryption and decryption method of this embodiment includes a decryption process:

[0079] When the cluster client pulls the container image, it decrypts the container image layer by layer;

[0080] Read the stored data in the ciphertext length area of ​​the to-be-decrypted layer file to obtain the ciphertext length N;

[0081] According to the ciphertext length N, read the encrypted data stored in the N-byte ciphertext area after the ciphertext length area in the layer file to be decrypted, and use the decryption private key issued by the image repository to decrypt and obtain the decrypted data;

[0082] After the decryption of the ciphertext area of ​​the to-be-decrypted layer file is completed, if there is a remaining source data area after removing the ciphertext length area and the ciphertext area in the to-be-decrypted layer file, the decrypted data of the ciphertext area and the remaining source data of the remaining source data area are combined to obtain the complete decrypted data of the to-be-decrypted layer file; if there is no remaining source data area after removing the ciphertext length area and the ciphertext area in the to-be-decrypted layer file, the decrypted data of the ciphertext area is the complete decrypted data of the to-be-decrypted layer file.

[0083] As a specific implementation of this embodiment, see Figure 3 As shown, a container image encryption and decryption method of this embodiment has the following detailed process:

[0084] In the continuous integration (CI) process, the container image is built and pushed to the image repository.

[0085] The image repository obtains the AES key pair. For layer files larger than 4MB (the preset data volume threshold), the data of the 4MB (specified area) of the layer header is extracted for encryption. The first 8 bytes (N bytes) of the encrypted data represent the length of the ciphertext, followed by the ciphertext, and then the remaining data. For layer files smaller than 4MB (the preset data volume threshold), the entire layer file is encrypted. Similarly, the first 8 bytes represent the length of the ciphertext, followed by the ciphertext, and there is no remaining data.

[0086] Upload the encrypted layer files to object storage for caching and distribution.

[0087] When the cluster client pulls the image, each layer file obtained is encrypted data and needs to be decrypted before it can be read and used. The decryption process is: first read the first 8 bytes (N bytes) of the file to get the length L of the ciphertext, then read L bytes, use the AES private key issued in advance to decrypt, and combine the decrypted content with the remaining data to obtain a readable and usable layer file.

[0088] This embodiment also provides a container image encryption and decryption device, including an encryption module, which performs layer-by-layer encryption on the container image;

[0089] The encryption module obtains the amount of data stored in the data layer file to be encrypted, and determines whether the amount of data stored in the data layer file to be encrypted is greater than a preset data amount threshold. If the judgment result is yes, the first encryption method is used to encrypt the storage data of the file to be encrypted. If the judgment result is no, the second encryption method is used to encrypt the storage data of the file to be encrypted.

[0090] In the container image encryption and decryption device of the present embodiment, the encryption module encrypts the layer files of the container image layer by layer to ensure the data security of the layer files of the container image. In addition, during the data encryption process, the encryption module selects the corresponding encryption method according to the amount of data stored in the layer files to be encrypted to ensure efficient and reliable data encryption. Therefore, after the layer files of the container image are encrypted by the container image encryption and decryption device of the present embodiment, even if the container image is leaked, the unauthorized third party cannot use the container image after obtaining it, which greatly improves the security of the container image.

[0091] Therefore, a container image encryption and decryption device of this embodiment, an encryption solution for layer files of container images, can be applied to multi-regional, multi-cloud, and cross-border container image repositories and container cluster products. As the first solution proposed on the market, this solution is of great significance to improving the security of container images.

[0092] A container image encryption and decryption device of this embodiment includes a decryption module. When a cluster client pulls a container image, the decryption module decrypts the container image layer by layer.

[0093] The decryption module reads the stored data in the ciphertext length area of ​​the to-be-decrypted layer file to obtain the ciphertext length N;

[0094] The decryption module reads the encrypted data stored in the N-byte ciphertext area after the ciphertext length area in the to-be-decrypted layer file according to the ciphertext length N, and decrypts it using the decryption private key issued by the image repository to obtain the decrypted data;

[0095] After the decryption module completes the decryption of the ciphertext area of ​​the to-be-decrypted layer file, if there is a remaining source data area after the ciphertext length area and the ciphertext area are removed from the to-be-decrypted layer file, the decrypted data of the ciphertext area and the remaining source data of the remaining source data area are combined to obtain the complete decrypted data of the to-be-decrypted layer file; if there is no remaining source data area after the ciphertext length area and the ciphertext area are removed from the to-be-decrypted layer file, the decrypted data of the ciphertext area is the complete decrypted data of the to-be-decrypted layer file.

[0096] The encryption and decryption device of a container image in this embodiment includes a key management service module KMS, see Figure 4 As shown, the key management service module KMS provides an encryption public key for container image encryption to the image repository, and sends a decryption private key for container image decryption to the cluster client.

[0097] Embodiment 2

[0098] In the traditional image repository solution, it takes hours or even days to build a container image of hundreds of GB in size, from continuous integration (CI) to continuous deployment (CD), which greatly restricts the iteration efficiency of the application. In the current container image repository solution in the industry, container images are stored in a central warehouse and distributed uniformly by the central warehouse. The image distribution efficiency of large model applications is insufficient, especially in a multi-regional and multi-cloud environment. The problem of insufficient distribution efficiency is particularly significant.

[0099] In view of this, see Figure 5 As shown, this embodiment provides a method for pre-distributing a cloud native container image, including:

[0100] Build container images and push the built container images to the central warehouse;

[0101] Determine whether container image pre-distribution is required based on the business logic of the service project to which the container image belongs;

[0102] If the judgment is yes, the container image is pulled from the central warehouse to the corresponding image warehouse in each region for caching. If the judgment is no, the container image is saved in the central warehouse.

[0103] Among them, the container image of this embodiment is encrypted using the encryption process of the container image encryption and decryption method described in the first embodiment when it is cached from the image repository in each region.

[0104] This embodiment provides a method for pre-distributing cloud native container images. In a multi-region, multi-cloud environment, a master-slave image repository architecture is adopted, which includes a central repository and slave image repositories located in various regions. For details, see Figure 6 As shown in the figure, the central warehouse serves as the central data source. After the container image is built, the preheating distribution mechanism is automatically triggered to preheat and distribute the container image on demand in other clouds or other regions. After preheating and distribution, each cloud cluster can download it from the image warehouse in its region, which can greatly improve the speed of container image downloading, thereby improving the distribution efficiency. In addition, the traffic pressure of the central warehouse can be dispersed without accessing the central warehouse.

[0105] In addition, a cloud-native container image pre-distribution method of this embodiment determines whether container image pre-distribution is needed according to the business logic of the service project to which the container image belongs after the container image is built, thereby automatically triggering the preheating distribution mechanism without the need for complex configuration.

[0106] Therefore, a cloud-native container image pre-distribution method of this embodiment, based on a master-slave architecture image repository, can be applied to multi-regional, multi-cloud, and cross-border container image repository cluster products. As the first solution proposed on the market, this solution is of great significance for improving the efficiency of container image distribution and saving network bandwidth and storage resource costs.

[0107] As an optional implementation of this embodiment, in a cloud native container image pre-distribution method of this embodiment, judging whether container image pre-distribution is required according to the business logic of the service project to which the container image belongs includes:

[0108] Get the project name of the service project based on the container image, and get the name of the service it contains based on the project name;

[0109] Get the service topology based on the service name, and then get the region where the service is to be deployed based on the service topology.

[0110] Whether container images need to be pre-distributed is determined by determining whether the services of the service project to which the container image belongs are deployed in the same region.

[0111] A cloud-native container image pre-distribution method of this embodiment, in order to realize automatic triggering of container image pre-heating distribution, obtains the corresponding service project after the container image is built, and judges whether the related services in the service project are deployed in the same region.

[0112] Specifically, when the services of the service project to which the container image belongs are deployed in different regions, the preheating distribution of the container image is automatically triggered. When the services of the service project to which the container image belongs are deployed in the same region, the preheating distribution of the container image is not triggered. In addition, this embodiment can obtain the region where the service is to be deployed through the service topology. The service topology is the basic information of each service project and can be obtained without configuration.

[0113] Further, in a cloud native container image pre-distribution method of this embodiment, if the judgment is yes, pulling the container image from the central warehouse to the corresponding image warehouse in each region for caching includes:

[0114] According to the service topology, the region where the service is to be deployed is obtained, and the container image is pulled from the central warehouse and cached in the object storage of the slave image warehouse corresponding to each region to be deployed.

[0115] As an optional implementation of this embodiment, in a cloud native container image pre-distribution method of this embodiment, judging whether container image pre-distribution is required according to the business logic of the service project to which the container image belongs includes:

[0116] Get the project name of the service project based on the container image, and get the name of the service it contains based on the project name;

[0117] Get the configuration information of the service according to the service name;

[0118] Whether container image pre-distribution is required is determined by determining whether service configuration information of the service project to which the container image belongs contains a container image pre-distribution instruction.

[0119] A cloud-native container image pre-distribution method of this embodiment can also automatically trigger the pre-heating distribution of the container image through the container image pre-distribution instruction in the service configuration information.

[0120] Further, in a cloud native container image pre-distribution method of this embodiment, if the judgment is yes, pulling the container image from the central warehouse to the corresponding image warehouse in each region for caching includes:

[0121] Obtain the pre-distribution target region or pre-distribution target cluster of the container image according to the container image pre-distribution instruction in the service configuration information;

[0122] According to the container image pre-distribution instructions in the service configuration information, the container image is pulled from the central warehouse and cached in the secondary image warehouse of the pre-distribution target region, or in the secondary image warehouse of the pre-distribution target cluster.

[0123] A cloud-native container image pre-distribution method of the present embodiment, when the pre-heating distribution of the container image is automatically triggered by the container image pre-distribution instruction in the service configuration information, the container image will be pre-heated and distributed to the slave image repository of the target region or target cluster according to the container image pre-distribution instruction, thereby improving the container image distribution efficiency and meeting the service project's requirements for pre-heating distribution of the container image.

[0124] A cloud-native container image pre-distribution method of this embodiment includes:

[0125] After the service project to which the container image belongs is deployed;

[0126] The cluster to which the service for pre-distribution of container images belongs downloads the container image from the image repository corresponding to the region to which the cluster belongs;

[0127] The cluster to which the service belongs that does not pre-distribute the container image downloads the container image from the central warehouse.

[0128] A cloud-native container image pre-distribution method of this embodiment automatically pre-distributes container images to slave image repositories in various regions. In this way, clusters in various regions can directly download container images from the slave image repositories in their corresponding regions for deployment, greatly improving the efficiency of container image distribution.

[0129] Furthermore, after the container image of this embodiment is downloaded from the image repository or the central repository to the cluster client, it is encrypted using the decryption process of the container image encryption and decryption method described in the first embodiment.

[0130] As an optional implementation of this embodiment, a cloud native container image pre-distribution method of this embodiment includes:

[0131] In the continuous integration (CI) phase of software development, the container image is built, and after the container image is built, it is determined whether the container image needs to be pre-distributed. If so, the container image pre-distribution is automatically triggered;

[0132] During the continuous deployment (CD) phase of software development, the cluster to which the container image is pre-distributed belongs downloads the container image from the image repository corresponding to the region to which the cluster belongs, and the cluster to which the container image is not pre-distributed belongs downloads the container image from the central repository.

[0133] Specifically, see Figure 7 As shown, a cloud native container image pre-distribution method of this embodiment includes:

[0134] Step S1. In the continuous deployment (CI) process of software development, build the container image and push it to the central warehouse.

[0135] Step S2: Perform logical judgment, combined with actual business logic, to determine whether the container image needs to be preheated. If preheating is required, start the preheating instruction and enter step S3. If preheating is not required, end.

[0136] Step S3: Pull the container image from the central repository.

[0137] Step S4: Send the pulled container image to the object storage for caching.

[0138] Step S5. In the continuous deployment (CD) phase of software development, when each cluster pulls the container image, it downloads it from the object storage of the image warehouse in the local domain without accessing the central warehouse, which can disperse the traffic pressure of the central warehouse. In addition, obtaining it from the image warehouse in the local domain can greatly improve the speed of pulling the container image.

[0139] In this embodiment, CI / CD is the abbreviation of Continuous Integration and Continuous Deployment, which are two important components of modern software development practice, aiming to improve the efficiency and quality of software development. CI generally refers to the software construction process, and CD generally refers to the software deployment process.

[0140] The cluster in this embodiment selects the widely used K8s cluster.

[0141] This embodiment also provides a cloud native container image pre-distribution device, including:

[0142] Container image building module, builds container images;

[0143] A central repository for receiving and storing built container images;

[0144] The container image pre-distribution module determines whether the container image needs to be pre-distributed according to the business logic of the service project to which the container image belongs. If the judgment result is yes, the container image is pre-distributed; if the judgment result is no, the container image is stored in the central warehouse;

[0145] From the image repository, deployed in various regions, when pre-distributing container images, the pre-distributed container images corresponding to each region are pulled from the image repository by the central repository for caching.

[0146] This embodiment provides a cloud native container image pre-distribution device. In a multi-region, multi-cloud environment, a master-multiple slave image warehouse architecture is adopted, which includes a central warehouse and slave image warehouses located in various regions. For details, see Figure 6 As shown in the figure, the central warehouse serves as the central data source. After the container image construction module completes the construction of the container image, the preheating distribution mechanism of the container image pre-distribution module is automatically triggered to preheat and distribute the container image on demand in other clouds or other regions. After preheating and distribution, each cloud cluster can download it from the image warehouse in its region, which can greatly improve the speed of container image downloading, thereby improving the distribution efficiency. In addition, the traffic pressure of the central warehouse can be dispersed without accessing the central warehouse.

[0147] In addition, in a cloud-native container image pre-distribution device of the present embodiment, after the container image construction module completes the construction of the container image, the container image pre-distribution module determines whether the container image needs to be pre-distributed according to the business logic of the service project to which the container image belongs, thereby realizing automatic triggering of the preheating distribution mechanism without the need for complex configuration.

[0148] Therefore, a cloud-native container image pre-distribution device in this embodiment, based on a master-slave architecture image repository, can be applied to multi-regional, multi-cloud, and cross-border container image repository cluster products, which is of great significance for improving container image distribution efficiency and saving network bandwidth and storage resource costs.

[0149] Embodiment 3

[0150] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0151] Figure 8 It is a structural diagram of an electronic device of an embodiment of the present invention, the electronic device includes a processor and a memory, the memory is used to store a computer executable program, when the computer program is executed by the processor, the processor executes the service quality analysis method based on service call link analysis of embodiment one.

[0152] like Figure 8 As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0153] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.

[0154] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0155] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0156] It should be understood that Figure 8 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0157] Fig. 9 Schematic diagram of a computer readable recording medium according to an embodiment of the present invention. Fig. 9 As shown, a computer executable program is stored in a computer-readable recording medium, and when the computer executable program is executed, the service quality analysis method based on service call link analysis of the first embodiment of the present invention is implemented. The computer-readable recording medium may include a data signal propagated in a baseband or as part of a carrier, which carries a readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable recording medium may also be any readable medium other than a readable recording medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, device, or device. The program code contained on the readable recording medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0158] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0159] Through the above description of the implementation mode, it is easy for those skilled in the art to understand that the present invention can be implemented by hardware capable of executing a specific computer program, such as the system of the present invention, and the electronic processing unit, server, client, mobile phone, control unit, processor, etc. contained in the system. The present invention can also be implemented by computer software that executes the method of the present invention, such as control software executed by a microprocessor, an electronic control unit, a client, a server, etc. However, it should be noted that the computer software that executes the method of the present invention is not limited to being executed by one or a specific hardware entity, and it can also be implemented in a distributed manner by unspecified specific hardware. For computer software, the software product can be stored in a computer-readable recording medium (which can be a CD-ROM, a USB flash drive, a mobile disk, etc.), and can also be distributed and stored on the network, as long as it enables the electronic device to execute the method according to the present invention.

[0160] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Although the present invention has been described in detail with reference to the above embodiments, the present invention is not limited to the above specific implementation methods. Therefore, any modification or equivalent replacement of the present invention; and all technical solutions and improvements thereof that do not depart from the spirit and scope of the invention are included in the scope of the claims of the present invention.

Claims

1. A method for encrypting and decrypting a container image, characterized in that: Including encryption process: Encrypt container images layer by layer; Obtain the amount of data stored in the file of the data layer to be encrypted, and determine whether the amount of data stored in the file of the data layer to be encrypted is greater than a preset data amount threshold; If the judgment result is yes, the first encryption method is used to encrypt the storage data of the to-be-encrypted layer file; if the judgment result is no, the second encryption method is used to encrypt the storage data of the to-be-encrypted layer file.

2. The method for encrypting and decrypting a container image according to claim 1, characterized in that: The step of encrypting the stored data of the to-be-encrypted layer file by using the first encryption method comprises: Extracting the stored data in the designated area of ​​the to-be-encrypted layer file as target encrypted data, wherein the data volume of the target encrypted data is a preset encrypted data value, and the preset encrypted data value is less than or equal to a preset data volume threshold; The first encryption algorithm is used to encrypt the target encrypted data.

3. The method for encrypting and decrypting a container image according to claim 2, characterized in that: The step of using a first encryption algorithm to encrypt target encrypted data includes: Encrypt the first N bytes of the target encrypted data to obtain the ciphertext length area, which is used to indicate the length of the encrypted ciphertext, where N is a set value; Encrypting the stored data after the ciphertext length area of ​​the target encrypted data to obtain the ciphertext area; After the target encrypted data is encrypted, the original source data is retained after removing the ciphertext length area and the ciphertext area to obtain a remaining source data area.

4. The method for encrypting and decrypting a container image according to claim 2, characterized in that: The storage data of the to-be-encrypted layer file is encrypted using the second encryption method, including: A second encryption algorithm is used to encrypt all stored data of the to-be-encrypted layer file. The second encryption algorithm is the same as or different from the first encryption algorithm.

5. The method for encrypting and decrypting a container image according to claim 2, characterized in that: The method of encrypting all the stored data of the to-be-encrypted layer file by using the second encryption algorithm comprises: The second encryption algorithm, which is the same as the first encryption algorithm, is used to encrypt all the stored data of the file in the to-be-encrypted layer; Encrypt the first N bytes of all the stored data of the file to be encrypted to obtain the ciphertext length area, which is used to indicate the length of the encrypted ciphertext, where N is a set value; The remaining data in the to-be-encrypted layer file excluding the ciphertext length area is encrypted to obtain the ciphertext area.

6. The method for encrypting and decrypting a container image according to claim 5, characterized in that: Including decryption process: When the cluster client pulls the container image, it decrypts the container image layer by layer; Read the stored data in the ciphertext length area of ​​the to-be-decrypted layer file to obtain the ciphertext length N; According to the ciphertext length N, read the encrypted data stored in the N-byte ciphertext area after the ciphertext length area in the layer file to be decrypted, and use the decryption private key issued by the image repository to decrypt and obtain the decrypted data; After the decryption of the ciphertext area of ​​the to-be-decrypted layer file is completed, if there is a remaining source data area after removing the ciphertext length area and the ciphertext area in the to-be-decrypted layer file, the decrypted data of the ciphertext area and the remaining source data of the remaining source data area are combined to obtain the complete decrypted data of the to-be-decrypted layer file; if there is no remaining source data area after removing the ciphertext length area and the ciphertext area in the to-be-decrypted layer file, the decrypted data of the ciphertext area is the complete decrypted data of the to-be-decrypted layer file.

7. A container image encryption and decryption device, characterized in that: An encryption module is included, and the encryption module performs layer-by-layer encryption on the container image; The encryption module obtains the amount of data stored in the data layer file to be encrypted, and determines whether the amount of data stored in the data layer file to be encrypted is greater than a preset data amount threshold. If the judgment result is yes, the first encryption method is used to encrypt the storage data of the file to be encrypted. If the judgment result is no, the second encryption method is used to encrypt the storage data of the file to be encrypted.

8. The container image encryption and decryption device according to claim 7, characterized in that: It includes a decryption module. When the cluster client pulls the container image, the decryption module decrypts the container image layer by layer. The decryption module reads the stored data in the ciphertext length area of ​​the to-be-decrypted layer file to obtain the ciphertext length N; The decryption module reads the encrypted data stored in the N-byte ciphertext area after the ciphertext length area in the to-be-decrypted layer file according to the ciphertext length N, and decrypts it using the decryption private key issued by the image repository to obtain the decrypted data; After the decryption module completes the decryption of the ciphertext area of ​​the to-be-decrypted layer file, if there is a remaining source data area after the ciphertext length area and the ciphertext area are removed from the to-be-decrypted layer file, the decrypted data of the ciphertext area and the remaining source data of the remaining source data area are combined to obtain the complete decrypted data of the to-be-decrypted layer file; if there is no remaining source data area after the ciphertext length area and the ciphertext area are removed from the to-be-decrypted layer file, the decrypted data of the ciphertext area is the complete decrypted data of the to-be-decrypted layer file.

9. The container image encryption and decryption device according to claim 7, characterized in that: It includes a key management service module KMS, which provides an encryption public key for container image encryption to the image repository and sends a decryption private key for container image decryption to the cluster client.

10. A computer-readable recording medium storing a computer-executable program, characterized in that: When the computer executable program is executed, the encryption and decryption method of a container image as described in any one of claims 1 to 6 is implemented.

Images