Data processing method based on encryption and decryption of side vehicle container

Abstract

The invention provides a data processing method based on an encryption and decryption side vehicle container, and belongs to the technical field of cloud computing and containers, and the method comprises the steps: deploying a business service container and the encryption and decryption side vehicle container in a system unit; the business service container sends to-be-processed data to the encryption and decryption side vehicle container; the encryption and decryption side vehicle container sends an authentication request instruction to the development operation management and control platform for identity recognition, and after identity recognition is passed, an authentication token is sent to the encryption and decryption side vehicle container; the encryption and decryption side vehicle container sends a key request to a key management system according to the authentication token, and generates a data key to be sent to the encryption and decryption side vehicle container after the access authority is judged; and the encryption and decryption side vehicle container encrypts or decrypts the to-be-processed data according to the data key, obtains the processed data and transmits the processed data to the business service container. According to the method, the data security is improved, the risk of key leakage is reduced, the encryption and decryption operation is executed in the encryption and decryption side vehicle container, and the operation performance of the business service container is improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing and container technology, and in particular to a data processing method based on an encryption and decryption sidecar container. Background Art

[0002] With the popularity of cloud computing and microservice architecture, modern applications increasingly rely on distributed systems to provide efficient and scalable services. In order to ensure data security and confidentiality, encryption and decryption technologies are usually used to process data.

[0003] In traditional technology, business servers obtain keys from key management systems and perform encryption and decryption operations on stored data to ensure data security. However, since business servers directly interact with key management systems, once interface authentication information is leaked, attackers will obtain keys, thereby threatening the security of the entire system. In addition, business servers integrate encryption and decryption functions, so encryption and decryption operations on data to be processed will consume a large amount of memory resources, thereby affecting the operating performance of business servers.

[0004] Therefore, a data processing method based on encryption and decryption sidecar container is proposed. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides a data processing method based on an encryption and decryption sidecar container, which is used to solve the problem in traditional technology that the encryption and decryption operations of the business server occupy memory resources and there is a risk of key leakage when the business server directly interacts with the key management system.

[0006] An embodiment of the present invention provides a data processing method based on an encryption and decryption sidecar container, including:

[0007] Deploy business service containers and encryption and decryption sidecar containers in the system unit;

[0008] The business service container sends the data to be processed to the encryption and decryption sidecar container according to business requirements;

[0009] The encryption and decryption sidecar container sends an authentication request instruction to the development and operation control platform. The development and operation control platform identifies the identity of the encryption and decryption sidecar container according to the authentication request instruction, and sends the authentication token to the encryption and decryption sidecar container after the identity is identified.

[0010] The encryption and decryption sidecar container sends a key request to the key management system according to the authentication token. The key management system performs access permission judgment on the key request. After judging that the encryption and decryption sidecar container has access permission, it generates a data key and sends it to the encryption and decryption sidecar container.

[0011] The encryption / decryption sidecar container performs corresponding encryption or decryption processing on the data to be processed according to the data key to obtain processed data;

[0012] The encryption and decryption sidecar container transmits the processed data to the business service container.

[0013] Preferably, the present invention provides a data processing method based on an encryption and decryption sidecar container, the steps of: deploying a business service container and an encryption and decryption sidecar container in a system unit; comprising:

[0014] Deploy the business service container and several encryption and decryption sidecar containers in the system unit;

[0015] The business port number of the business service container and the sidecar port number of the encryption and decryption sidecar container are obtained, a data port forwarding rule is constructed, and a communication connection between the business service container and the encryption and decryption sidecar container is established.

[0016] Preferably, the present invention provides a data processing method based on an encryption and decryption sidecar container, the step of: the business service container sends the data to be processed to the encryption and decryption sidecar container according to business requirements; comprising:

[0017] The business service container obtains the data to be encrypted according to the business requirements, generates an encryption service program based on the data port forwarding rule, executes the encryption service program in the system unit, and sends the data to be encrypted to the encryption and decryption sidecar container; optionally, including:

[0018] Initialize the encryption service program;

[0019] According to business needs, set the service name and type of the encryption service program;

[0020] According to the service port number and the sidecar port number, set the sending port and the target port;

[0021] Importing the data to be encrypted into the data port in the encryption service program;

[0022] Execute the encryption service program and send the data to be encrypted to the encryption and decryption sidecar container;

[0023] The business service container obtains the data to be decrypted according to the business requirements, generates a decryption service program based on the data port forwarding rule, executes the decryption service program in the system unit, and sends the decrypted data to the encryption and decryption sidecar container; optionally, including:

[0024] Initialize the decryption service program;

[0025] According to business needs, set the service name and type of the decryption service program;

[0026] According to the service port number and the sidecar port number, set the sending port and the target port;

[0027] Importing the data to be decrypted into the data port in the encryption service program;

[0028] Execute the decryption service program and send the data to be decrypted to the encryption and decryption sidecar container.

[0029] Preferably, the present invention provides a data processing method based on an encryption and decryption sidecar container, the steps of: the encryption and decryption sidecar container sends an authentication request instruction to the development and operation control platform, the development and operation control platform identifies the identity of the encryption and decryption sidecar container according to the authentication request instruction, and sends an authentication token to the encryption and decryption sidecar container after the identity is identified; including:

[0030] The identity of the encryption and decryption sidecar container is encrypted by a secret key to obtain a sidecar container signature, and the access key, the identity and the sidecar container signature are constructed into an authentication request instruction and sent to the development and operation control platform;

[0031] The development and operation management and control platform receives the authentication request instruction transmitted by the encrypted and decrypted sidecar container, and performs parsing processing to obtain the access key, identity identifier and sidecar container signature in the authentication request instruction;

[0032] Querying a corresponding secret key according to the access key, encrypting the identity in the authentication request instruction by using the secret key, and obtaining a platform encryption signature;

[0033] The platform encryption signature is compared with the sidecar container signature. When the comparison is consistent, the development and operation management and control platform authenticates the encryption and decryption sidecar container and sends the authentication token to the encryption and decryption sidecar container. When the comparison is inconsistent, an error code is returned to the encryption and decryption sidecar container.

[0034] Preferably, the present invention provides a data processing method based on an encryption and decryption sidecar container, the steps of: the encryption and decryption sidecar container sends a key request to a key management system according to the authentication token, the key management system performs access permission judgment on the key request, and after judging that the encryption and decryption sidecar container has access permission, generates a data key and sends it to the encryption and decryption sidecar container; including:

[0035] After the key management system determines that the encryption and decryption sidecar container has access rights, the key management system sends a test data group to the encryption and decryption sidecar container to evaluate the data processing capability of the encryption and decryption sidecar container and obtain container evaluation data;

[0036] The key management system generates a data key of corresponding complexity according to the container evaluation data; optionally, including:

[0037] According to the container evaluation data, the length of the random number string is set to generate a random number string C = (C1, ..., C n+1 );

[0038] C n+1 =(a×C n +b)mod M

[0039] Among them, C n+1 is the n+1th random character, a is the premultiplier, C n is the nth random character, b is the random character increment, M is the modulus, and mod is the modulus operator;

[0040] C1=(a×K+b)mod M

[0041] For the first random character of C1, it is calculated by introducing the random number seed K;

[0042] Obtain an initial secret key IK, calculate a corresponding initial key digest value H, and perform pseudo-randomization processing on the initial key according to the random number character string C to obtain a random secret key RK;

[0043] RK=H-hash(C,IK)

[0044] Among them, hash is a hash operator;

[0045] Performing hash calculation according to the random key and the preset character string, and setting the extended length of the data key according to the container evaluation data, to obtain the data key;

[0046] Assume that the extended length of the data key is m, and construct m sub-data keys;

[0047] T1=H-hash(RK,T0)

[0048] T m =H-hash(RK,T m-1 )

[0049] Among them, T1 is the first sub-data key, T0 is a random string, T m is the mth sub-data key, T m is the m-1th sub-data key;

[0050] The constructed m sub-data keys are combined into a preprocessed data key, and the preprocessed data key is intercepted according to a preset key length to generate the data key.

[0051] Preferably, the present invention provides a data processing method based on an encryption and decryption sidecar container, the steps of: obtaining an initial key IK, calculating a corresponding initial key digest value H, and performing pseudo-randomization processing on the initial key according to the random number string C to obtain a random key RK; comprising:

[0052] Detecting the key length of the initial key, and when the key length is less than a preset key length, padding character codes so that the key length of the initial key is equal to the preset key length; when the key length is greater than the preset key length, compressing the initial key based on a digest algorithm so that the key length of the initial key is equal to the preset key length;

[0053] Performing an XOR operation on an initial key whose key length is processed to a preset key length and the first character string to obtain a first bit sequence;

[0054] Extracting the container identifier in the key request, appending the first bit sequence to the beginning of the container identifier to generate a first identifier sequence, and calculating a first identifier digest value of the first identifier sequence by using a hash function;

[0055] Performing an XOR operation on the initial key whose key length is processed to a preset key length and the second character string to obtain a second bit sequence;

[0056] The second bit sequence is appended to the beginning of the first identification digest value to generate a second identification sequence, and a second identification digest value of the second identification sequence is calculated by a hash function as the initial key digest value.

[0057] Preferably, the present invention provides a data processing method based on an encryption and decryption sidecar container, the step of: the encryption and decryption sidecar container performs corresponding encryption or decryption processing on the data to be processed according to the data key to obtain the processed data; comprising:

[0058] The encryption / decryption sidecar container encrypts the received data to be encrypted according to the data key to generate encrypted data; optionally, including:

[0059] Obtaining the encryption key in the data key and constructing an encryption key matrix;

[0060] Convert the to-be-encrypted data into a to-be-encrypted matrix, and perform a bitwise XOR operation with the encryption key matrix to obtain an initial encryption matrix;

[0061] According to the position of the byte in the initial encryption matrix, searching for a replacement character in the byte replacement box to perform a replacement operation, and obtaining a state encryption matrix;

[0062] Perform row shift and column confusion operations according to the state encryption matrix to obtain a transformation encryption matrix;

[0063] The transformation encryption matrix and the encryption key matrix are subjected to a bitwise exclusive OR operation to obtain a data encryption matrix, which is then bitwise expanded into encryption processing data.

[0064] Preferably, the present invention provides a data processing method based on an encryption and decryption sidecar container, the step of: the encryption and decryption sidecar container performs corresponding encryption or decryption processing on the data to be processed according to the data key to obtain the processed data; and further comprising:

[0065] The encryption / decryption sidecar container performs decryption processing on the received data to be decrypted according to the decryption key in the data key, which is specifically implemented as an inverse operation of the encryption processing to generate decrypted processing data.

[0066] Preferably, the present invention provides a data processing method based on an encryption and decryption sidecar container, the step of: the encryption and decryption sidecar container transmitting the processed data to the business service container; comprising:

[0067] After the encryption / decryption sidecar container sends the processed data to the business service container and receives the data receiving instruction returned by the business service container, the authentication token and the data key received by the encryption / decryption sidecar container are deleted.

[0068] Compared with the traditional technology, the beneficial effects of the present invention are: a data processing method based on an encryption and decryption sidecar container, by deploying an encryption and decryption sidecar container in a system unit, the encryption and decryption sidecar container interacts with the development and operation management platform and the key management system to perform identity authentication and access permission judgment, obtain data keys, perform corresponding encryption and decryption operations on the data to be processed in the encryption and decryption sidecar container, and obtain the processed data and return it to the business service container; the above method interacts with the development and operation management platform and the key management system through the encryption and decryption sidecar container to obtain authentication tokens and data keys, thereby improving the security of data key acquisition, reducing the risk of key leakage caused by direct information transmission between the business server and the key management system in the traditional technology, improving data security, and performing encryption and decryption operations in the encryption and decryption sidecar container, avoiding resource occupation of the business service container, improving the operating performance of the business service container, and realizing the isolation of encryption and decryption operations from data operations in the business service container, while improving the processing efficiency of the data to be processed.

[0069] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0070] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 The figure is a flow chart of a data processing method based on encryption and decryption sidecar container provided by the present invention. DETAILED DESCRIPTION

[0072] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0073] Embodiment 1:

[0074] The embodiment of the present invention provides a data processing method based on encryption and decryption sidecar container, referring to Figure 1 ,include:

[0075] Deploy business service containers and encryption and decryption sidecar containers in the system unit;

[0076] The business service container sends the data to be processed to the encryption and decryption sidecar container according to business needs;

[0077] The encryption and decryption sidecar container sends an authentication request instruction to the development and operation control platform. The development and operation control platform identifies the identity of the encryption and decryption sidecar container according to the authentication request instruction, and sends the authentication token to the encryption and decryption sidecar container after the identity is identified.

[0078] The encryption and decryption sidecar container sends a key request to the key management system based on the authentication token. The key management system determines the access rights for the key request. After determining that the encryption and decryption sidecar container has access rights, it generates a data key and sends it to the encryption and decryption sidecar container.

[0079] The encryption and decryption sidecar container encrypts or decrypts the data to be processed according to the data key to obtain the processed data;

[0080] The encryption and decryption sidecar container transmits the processed data to the business service container.

[0081] In the above embodiments, the business service container sends the data to be processed to the encryption and decryption sidecar container according to business needs. After receiving the data to be processed, the encryption and decryption sidecar container sends an authentication request instruction to the development and operation control platform. The development and operation control platform identifies the identity of the encryption and decryption sidecar container according to the authentication request instruction, and sends the authentication token to the encryption and decryption sidecar container after the identity identification is passed; the encryption and decryption sidecar container sends a key request to the key management system according to the authentication token, and the key management system performs access permission judgment on the key request, and generates a data key after judging that the encryption and decryption sidecar container has access permission; the encryption and decryption sidecar container performs corresponding encryption or decryption processing on the data to be processed according to the data key, obtains the processed data and transmits it to the business service container.

[0082] The beneficial effects of the above technology are: by deploying an encryption and decryption sidecar container in the system unit, the encryption and decryption sidecar container interacts with the development and operation control platform and the key management system to perform identity authentication and access permission judgment, obtain data keys, perform corresponding encryption and decryption operations on the data to be processed in the encryption and decryption sidecar container, and obtain the processed data and return it to the business service container; compared with the traditional technology, the above method interacts with the development and operation control platform and the key management system through the encryption and decryption sidecar container to obtain authentication tokens and data keys, thereby improving the security of data key acquisition, reducing the risk of key leakage caused by direct information transmission between the business server and the key management system in the traditional technology, improving data security, and performing encryption and decryption operations in the encryption and decryption sidecar container, avoiding resource occupation of the business service container, improving the operating performance of the business service container, and realizing the isolation of encryption and decryption operations from data operations in the business service container, while improving the processing efficiency of the data to be processed.

[0083] Embodiment 2:

[0084] An embodiment of the present invention provides a data processing method based on an encryption and decryption sidecar container, comprising the steps of: deploying a business service container and an encryption and decryption sidecar container in a system unit; comprising:

[0085] Deploy the business service container and several encryption and decryption sidecar containers in the system unit;

[0086] Get the business port number of the business service container and the sidecar port number of the encryption and decryption sidecar container, build data port forwarding rules, and establish a communication connection between the business service container and the encryption and decryption sidecar container.

[0087] In the above embodiments, a business service container and several encryption and decryption sidecar containers are deployed in the system unit to achieve physical isolation between different container services.

[0088] In the above embodiments, a data port forwarding rule is constructed according to the business port number of the business service container and the sidecar port number of the encryption and decryption sidecar container, and a communication connection is established between the business service container and the encryption and decryption sidecar container.

[0089] The beneficial effect of the above technology is that by deploying the business service container and the encryption and decryption sidecar container in the system unit, the business port number and the sidecar port number are obtained, and the communication connection between the business service container and the encryption and decryption sidecar container is realized, which facilitates data transmission in subsequent steps.

[0090] Embodiment 3:

[0091] An embodiment of the present invention provides a data processing method based on an encryption and decryption sidecar container, comprising: a business service container sends data to be processed to an encryption and decryption sidecar container according to business requirements; comprising:

[0092] The business service container obtains the data to be encrypted according to business needs, generates an encryption service program based on the data port forwarding rules, executes the encryption service program in the system unit, and sends the data to be encrypted to the encryption and decryption sidecar container; optional, including:

[0093] Initialize the encryption service program;

[0094] According to business needs, set the service name and type of the encryption service program;

[0095] Set the sending port and target port according to the business port number and the sidecar port number;

[0096] Import the data to be encrypted into the data port in the encryption service program;

[0097] Execute the encryption service program and send the data to be encrypted to the encryption and decryption sidecar container;

[0098] The business service container obtains the data to be decrypted according to business needs, generates a decryption service program based on the data port forwarding rules, executes the decryption service program in the system unit, and sends the decrypted data to the encryption and decryption sidecar container; optional, including:

[0099] Initialize the decryption service program;

[0100] According to business needs, set the service name and type of the decryption service program;

[0101] Set the sending port and target port according to the business port number and the sidecar port number;

[0102] Import the data to be decrypted into the data port in the encryption service program;

[0103] Execute the decryption service program and send the data to be decrypted to the encryption and decryption sidecar container.

[0104] In the above embodiments, according to business needs, the data to be encrypted is obtained, the encryption service program is executed in the system unit, and the data to be encrypted is sent to the encryption and decryption sidecar container; for the encryption service program, according to business needs, the service name and type of the encryption service program are set, and the sending port and the target port are set according to the business port number and the sidecar port number, and the data to be encrypted is imported at the data port to obtain it.

[0105] In the above embodiments, according to business needs, the data to be decrypted is obtained, the decryption service program is executed in the system unit, and the decrypted data is sent to the encryption and decryption sidecar container; for the decryption service program, the service name and type of the decryption service program are set according to business needs, the sending port and the target port are set according to the business port number and the sidecar port number, and the data to be decrypted is imported at the data port to obtain it.

[0106] The beneficial effect of the above technology is that when the business service container obtains the data to be encrypted and the data to be decrypted according to business needs, an encryption service program and a decryption service program are generated in the system unit for execution, thereby realizing the sending of the data to be encrypted and the data to be decrypted to the encryption and decryption sidecar container.

[0107] Embodiment 4:

[0108] An embodiment of the present invention provides a data processing method based on an encryption and decryption sidecar container, comprising the steps of: the encryption and decryption sidecar container sends an authentication request instruction to the development and operation management and control platform, the development and operation management and control platform identifies the identity of the encryption and decryption sidecar container according to the authentication request instruction, and sends an authentication token to the encryption and decryption sidecar container after the identity is identified; comprising:

[0109] The identity of the encryption and decryption sidecar container is encrypted with a secret key to obtain the sidecar container signature. The access key, identity and sidecar container signature are constructed into an authentication request instruction and sent to the development and operation control platform.

[0110] The development and operation control platform receives the authentication request instruction transmitted by the encrypted sidecar container, parses it, and obtains the access key, identity identifier, and sidecar container signature in the authentication request instruction;

[0111] Query the corresponding secret key according to the access key, encrypt the identity in the authentication request instruction with the secret key, and obtain the platform encryption signature;

[0112] The platform encryption signature and the sidecar container signature are compared. When the comparison is consistent, the development and operation management platform authenticates the encryption and decryption sidecar container and sends the authentication token to the encryption and decryption sidecar container. When the comparison is inconsistent, an error code is returned to the encryption and decryption sidecar container.

[0113] In the above embodiments, the identity identifier of the encryption and decryption sidecar container is encrypted by a secret key to obtain the sidecar container signature, and the access key, identity identifier and sidecar container signature are constructed as an authentication request instruction and sent to the development and operation control platform; after receiving the authentication request instruction, the development and operation control platform parses and processes it to obtain the access key, identity identifier and sidecar container signature in the authentication request instruction, queries the corresponding secret key according to the access key, encrypts the identity identifier in the authentication request instruction by the secret key, and obtains the platform encryption signature; the platform encryption signature and the sidecar container signature are compared to authenticate the identity of the encryption and decryption sidecar container.

[0114] In the above embodiment, when the platform encryption signature and the sidecar container signature are consistent, the development and operation management platform authenticates the encryption and decryption sidecar container and sends the authentication token to the encryption and decryption sidecar container; when the platform encryption signature and the sidecar container signature are inconsistent, an error code is returned to the encryption and decryption sidecar container.

[0115] In the above embodiments, the secret key is stored in the encryption and decryption sidecar container and the development and operation management platform respectively. During the identity authentication process, the secret key is not transmitted.

[0116] In the above embodiments, the development and operation control platform can be implemented as a DevOps control platform.

[0117] The beneficial effect of the above technology is that the encryption and decryption sidecar container sends an authentication request instruction to the development and operation control platform, and the development and operation control platform parses and processes the authentication request instruction, thereby realizing the identity authentication of the encryption and decryption sidecar container by the development and operation control platform, and sending an authentication token to the encryption and decryption sidecar container after the identity authentication is passed, so as to facilitate the subsequent steps of the encryption and decryption sidecar container to obtain the data key from the key management system.

[0118] Embodiment 5:

[0119] An embodiment of the present invention provides a data processing method based on an encryption and decryption sidecar container, comprising the steps of: the encryption and decryption sidecar container sends a key request to a key management system according to an authentication token, the key management system performs access permission judgment on the key request, and after judging that the encryption and decryption sidecar container has access permission, generates a data key and sends it to the encryption and decryption sidecar container; comprising:

[0120] After the key management system determines that the encryption and decryption sidecar container has access rights, the key management system sends a test data group to the encryption and decryption sidecar container to evaluate the data processing capability of the encryption and decryption sidecar container and obtain container evaluation data;

[0121] The key management system generates a data key of corresponding complexity based on the container evaluation data; optionally, including:

[0122] According to the container evaluation data, the length of the random number string is set to generate a random number string C = (C1, ..., C n+1 );

[0123] C n+1 =(a×C n +b)mod M

[0124] Among them, C n+1 is the n+1th random character, a is the premultiplier, C n is the nth random character, b is the random character increment, M is the modulus, and mod is the modulus operator;

[0125] C1=(a×K+b)mod M

[0126] For the first random character of C1, it is calculated by introducing the random number seed K;

[0127] Obtain the initial secret key IK, calculate the corresponding initial key digest value H, and perform pseudo-randomization processing on the initial key according to the random number string C to obtain the random secret key RK;

[0128] RK=H-hash(C,IK)

[0129] Among them, hash is a hash operator;

[0130] Perform hash calculation based on the random key and the preset string, set the extended length of the data key based on the container evaluation data, and obtain the data key;

[0131] Assume that the extended length of the data key is m, and construct m sub-data keys;

[0132] T1=H-hash(RK,T0)

[0133] T m =H-hash(RK,T m-1 )

[0134] Among them, T1 is the first sub-data key, T0 is a random string, T m is the mth sub-data key, T m is the m-1th sub-data key;

[0135] The constructed m sub-data keys are combined into a preprocessed data key, and the preprocessed data key is intercepted according to the preset key length to generate a data key.

[0136] In the above embodiments, the key management system sends a test data group to the encryption and decryption sidecar container, evaluates the data processing capability of the encryption and decryption sidecar container, and obtains container evaluation data; and sets the length of the random number string according to the container evaluation data to generate a random number string; performs pseudo-randomization on the initial key through the random number string to obtain a random secret key, performs hash calculation based on the random secret key and the preset string, and obtains the data key.

[0137] In the above embodiments, for the generation of the random number string, a random number seed is introduced, the first random character is calculated, and the subsequent n random characters are iteratively generated to construct the random number string.

[0138] In the above embodiments, the extended length of the data key is set according to the container evaluation data, a corresponding number of sub-data keys are generated, combined into a preprocessed data key, and the preprocessed data key is intercepted according to the preset key length to generate the data key.

[0139] The beneficial effect of the above technology is that by sending a test data group to the encryption and decryption sidecar container, the data processing capability of the encryption and decryption sidecar container is evaluated, and a data key of corresponding complexity is generated based on the container evaluation data. The above technical solution enables the key management system to generate data keys while enabling the acquired data keys to be suitable for the processing of the corresponding encryption and decryption sidecar container, thereby avoiding the problem that the encryption and decryption sidecar container takes a long time to process the data according to the data key and is difficult to generate the processed data in time.

[0140] Embodiment 6:

[0141] The embodiment of the present invention provides a data processing method based on an encryption and decryption sidecar container, comprising the steps of obtaining an initial key IK, calculating a corresponding initial key digest value H, and performing pseudo-randomization processing on the initial key according to a random number string C to obtain a random key RK; comprising:

[0142] Detecting the key length of the initial key, and when the key length is less than the preset key length, padding the character code so that the key length of the initial key is equal to the preset key length; when the key length is greater than the preset key length, compressing the initial key based on the digest algorithm so that the key length of the initial key is equal to the preset key length;

[0143] Performing an XOR operation on an initial key whose key length is processed to a preset key length and the first character string to obtain a first bit sequence;

[0144] Extracting the container identifier in the key request, appending the first bit sequence to the beginning of the container identifier to generate a first identifier sequence, and calculating a first identifier digest value of the first identifier sequence by using a hash function;

[0145] Performing an XOR operation on the initial key whose key length is processed to a preset key length and the second character string to obtain a second bit sequence;

[0146] The second bit sequence is appended to the beginning of the first identification digest value to generate a second identification sequence, and a second identification digest value of the second identification sequence is calculated by a hash function as an initial key digest value.

[0147] In the above embodiments, the key length of the initial key is converted to a preset key length, the initial key is XORed with the first character string to obtain a first bit sequence, the first bit sequence is attached to the beginning of the container identifier to generate a first identifier sequence, and a first identifier summary value of the first identifier sequence is calculated by a hash function; the initial key is XORed with the second character string to obtain a second bit sequence, and the second bit sequence is attached to the beginning of the first identifier summary value to generate a second identifier sequence, and a second identifier summary value of the second identifier sequence is calculated by a hash function as the initial key summary value.

[0148] In the above embodiment, when it is detected that the key length of the initial key is less than the preset key length, the character code "0" is padded to make the key length equal to the preset key length.

[0149] In the above embodiments, when it is detected that the key length of the initial key is greater than the preset key length, compression processing is performed based on the digest algorithm to make the key length equal to the preset key length.

[0150] In the above embodiment, the first character string is a cycle of “00110110”, and the length of the first character string is set according to a preset key length.

[0151] In the above embodiment, the second character string is a cycle of "01011100", and the length of the second character string is set according to the preset key length.

[0152] Embodiment 7:

[0153] An embodiment of the present invention provides a data processing method based on an encryption and decryption sidecar container, comprising the steps of: the encryption and decryption sidecar container performs corresponding encryption or decryption processing on the data to be processed according to the data key to obtain the processed data; comprising:

[0154] The encryption and decryption sidecar container encrypts the received data to be encrypted according to the data key to generate encrypted data; optional, including:

[0155] Obtain the encryption key from the data key and construct an encryption key matrix;

[0156] The data to be encrypted is converted into a matrix to be encrypted, and a bitwise XOR operation is performed with the encryption key matrix to obtain an initial encryption matrix;

[0157] According to the position of the byte in the initial encryption matrix, the replacement character is searched in the byte replacement box to perform a replacement operation, and the state encryption matrix is ​​obtained;

[0158] Perform row shift and column confusion operations according to the state encryption matrix to obtain a transformation encryption matrix;

[0159] The transformed encryption matrix and the encryption key matrix are subjected to a bitwise XOR operation to obtain a data encryption matrix, which is then bitwise expanded into encrypted processing data.

[0160] In the above embodiments, the data to be encrypted is converted into a matrix to be encrypted according to byte arrangement, and the encryption key is constructed into an encryption key matrix of the same size as the matrix to be encrypted according to the row and column values ​​of the matrix to be encrypted; the encryption key matrix and the matrix to be encrypted are subjected to bitwise XOR operation to obtain an initial encryption matrix; the bytes in the initial encryption matrix are replaced with characters by a byte replacement box to obtain a state encryption matrix, and row shift and column confusion operations are performed to generate a transformation encryption matrix, and the transformation encryption matrix and the encryption key matrix are subjected to bitwise XOR operation to obtain a data encryption matrix, which is converted into encrypted processing data according to byte arrangement.

[0161] In the above embodiments, the data to be processed includes data to be encrypted and data to be decrypted.

[0162] In the above embodiments, processing data includes encrypting the data and decrypting the data.

[0163] In the above embodiments, the processing of the data to be encrypted may be implemented by iterating the above steps several times.

[0164] In the above embodiment, character replacement is performed on bytes in the initial encryption matrix, and corresponding character replacement is searched in the byte replacement box according to the position of the bytes in the initial encryption matrix.

[0165] In the above embodiment, the row shift of the state encryption matrix can be implemented by shifting the i-th row in the matrix to the left by i-1 bytes.

[0166] In the above embodiments, the column obfuscation of the state encryption matrix can be implemented by modularly multiplying a specific matrix on the left side of the state encryption matrix, where the specific matrix consists of 01, 02, 03, 04, and 05 to achieve linear encoding with the maximum distance between codewords.

[0167] In the above embodiments, encryption and decryption operations are performed in an independent encryption and decryption sidecar container, and business development personnel cannot directly access the encryption details, thereby enhancing the confidentiality of data processing.

[0168] The beneficial effect of the above technology is: converting the data to be encrypted into a matrix to be encrypted, performing encryption processing according to the encryption key, and performing byte replacement, row shift and column confusion operations to obtain encrypted processing data, thereby realizing that the encryption and decryption sidecar container encrypts the data to be encrypted according to the data key.

[0169] Embodiment 8:

[0170] An embodiment of the present invention provides a data processing method based on an encryption and decryption sidecar container, comprising the steps of: the encryption and decryption sidecar container performs corresponding encryption or decryption processing on the data to be processed according to the data key to obtain the processed data; and further comprising:

[0171] The encryption and decryption sidecar container decrypts the received data to be decrypted according to the decryption key in the data key, which is specifically implemented as the inverse operation of the encryption process to generate decrypted data.

[0172] In the above embodiments, the encryption and decryption sidecar container decrypts the received data to be decrypted according to the decryption key in the data key to generate decrypted data.

[0173] In the above embodiments, the decryption process of the data to be processed is the inverse operation of the encryption process.

[0174] Embodiment 9:

[0175] An embodiment of the present invention provides a data processing method based on an encryption and decryption sidecar container, comprising: the encryption and decryption sidecar container transmits processed data to a business service container; comprising:

[0176] After the encryption and decryption sidecar container sends the processed data to the business service container and receives the data receiving instruction returned by the business service container, it deletes the authentication token and data key received by the encryption and decryption sidecar container.

[0177] In the above embodiment, after the encryption and decryption sidecar container sends the processed data to the business service container and receives the data receiving instruction returned by the business service container, it deletes the authentication token and data key obtained by the encryption and decryption sidecar container based on the data to be processed.

[0178] The beneficial effect of the above technology is that after the encryption and decryption sidecar container sends the processed data to the business service container, it receives the returned data receiving instruction, so that the business service container prompts the encryption and decryption sidecar container after successfully receiving the processed data, and the encryption and decryption sidecar container deletes the authentication token and data key after receiving the data receiving instruction, thereby avoiding the encryption and decryption sidecar container using the previously obtained authentication token and data key for data processing, resulting in the leakage of processed data and data keys, further improving the security of the data, and deleting the authentication token and data key in time, reducing the resource occupation of the encryption and decryption sidecar container, and improving the container's processing speed for the data to be processed.

[0179] In summary, the data processing method based on the encryption and decryption sidecar container proposed in the present invention not only improves the data processing efficiency and security, but also provides a guarantee for the stable operation of the service. The method proposed in the present invention can improve the security, performance and reliability between services in a cloud environment under a microservice architecture.

[0180] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A data processing method based on encryption and decryption sidecar container, characterized in that: include: Deploy business service containers and encryption and decryption sidecar containers in the system unit; The business service container sends the data to be processed to the encryption and decryption sidecar container according to business requirements; The encryption and decryption sidecar container sends an authentication request instruction to the development and operation control platform. The development and operation control platform identifies the identity of the encryption and decryption sidecar container according to the authentication request instruction, and sends the authentication token to the encryption and decryption sidecar container after the identity is identified. The encryption and decryption sidecar container sends a key request to the key management system according to the authentication token. The key management system performs access permission judgment on the key request. After judging that the encryption and decryption sidecar container has access permission, it generates a data key and sends it to the encryption and decryption sidecar container. The encryption / decryption sidecar container performs corresponding encryption or decryption processing on the data to be processed according to the data key to obtain processed data; The encryption and decryption sidecar container transmits the processed data to the business service container.

2. According to claim 1, a data processing method based on encryption and decryption sidecar container is characterized in that: The steps of: deploying a business service container and an encryption and decryption sidecar container in a system unit; include: Deploy the business service container and several encryption and decryption sidecar containers in the system unit; The business port number of the business service container and the sidecar port number of the encryption and decryption sidecar container are obtained, a data port forwarding rule is constructed, and a communication connection between the business service container and the encryption and decryption sidecar container is established.

3. According to claim 2, a data processing method based on encryption and decryption sidecar container is characterized in that: The step: the business service container sends the data to be processed to the encryption and decryption sidecar container according to business requirements; includes: The business service container obtains the data to be encrypted according to the business requirements, generates an encryption service program based on the data port forwarding rule, executes the encryption service program in the system unit, and sends the data to be encrypted to the encryption and decryption sidecar container; optionally, including: Initialize the encryption service program; According to business needs, set the service name and type of the encryption service program; According to the service port number and the sidecar port number, set the sending port and the target port; Importing the data to be encrypted into the data port in the encryption service program; Execute the encryption service program and send the data to be encrypted to the encryption and decryption sidecar container; The business service container obtains the data to be decrypted according to the business requirements, generates a decryption service program based on the data port forwarding rule, executes the decryption service program in the system unit, and sends the decrypted data to the encryption and decryption sidecar container; optionally, including: Initialize the decryption service program; According to business needs, set the service name and type of the decryption service program; According to the service port number and the sidecar port number, set the sending port and the target port; Importing the data to be decrypted into the data port in the encryption service program; Execute the decryption service program and send the data to be decrypted to the encryption and decryption sidecar container.

4. According to claim 1, a data processing method based on encryption and decryption sidecar container is characterized in that: The step: the encryption and decryption sidecar container sends an authentication request instruction to the development and operation control platform, and the development and operation control platform identifies the identity of the encryption and decryption sidecar container according to the authentication request instruction, and sends the authentication token to the encryption and decryption sidecar container after the identity is identified; includes: The identity of the encryption and decryption sidecar container is encrypted by a secret key to obtain a sidecar container signature, and the access key, the identity and the sidecar container signature are constructed into an authentication request instruction and sent to the development and operation control platform; The development and operation management and control platform receives the authentication request instruction transmitted by the encrypted and decrypted sidecar container, and performs parsing processing to obtain the access key, identity identifier and sidecar container signature in the authentication request instruction; Querying a corresponding secret key according to the access key, encrypting the identity in the authentication request instruction by using the secret key, and obtaining a platform encryption signature; The platform encryption signature is compared with the sidecar container signature. When the comparison is consistent, the development and operation management and control platform authenticates the encryption and decryption sidecar container and sends the authentication token to the encryption and decryption sidecar container. When the comparison is inconsistent, an error code is returned to the encryption and decryption sidecar container.

5. According to claim 1, a data processing method based on encryption and decryption sidecar container is characterized in that: The step: the encryption and decryption sidecar container sends a key request to the key management system according to the authentication token, the key management system performs access permission judgment on the key request, and after judging that the encryption and decryption sidecar container has access permission, generates a data key and sends it to the encryption and decryption sidecar container; includes: After the key management system determines that the encryption and decryption sidecar container has access rights, the key management system sends a test data group to the encryption and decryption sidecar container to evaluate the data processing capability of the encryption and decryption sidecar container and obtain container evaluation data; The key management system generates a data key of corresponding complexity according to the container evaluation data; optionally, including: According to the container evaluation data, the length of the random number string is set to generate a random number string C=(C1, ..., C n+1 ); C n+1 =(a×C n +b)mod M Among them, C n+1 is the n+1th random character, a is the premultiplier, C n is the nth random character, b is the random character increment, M is the modulus, and mod is the modulus operator; C1=(a×K+b)mod M For the first random character of C1, it is calculated by introducing the random number seed K; Obtain an initial secret key IK, calculate a corresponding initial key digest value H, and perform pseudo-randomization processing on the initial key according to the random number character string C to obtain a random secret key RK; RK=H-hash(C,IK) Among them, hash is a hash operator; Performing hash calculation according to the random key and the preset character string, and setting the extended length of the data key according to the container evaluation data, to obtain the data key; Assume that the extended length of the data key is m, and construct m sub-data keys; T1=H-hash(RK,T0) T m =H-hash(RK,T m-1 ) Among them, T1 is the first sub-data key, T0 is a random string, T m is the mth sub-data key, T m is the m-1th sub-data key; The constructed m sub-data keys are combined into a preprocessed data key, and the preprocessed data key is intercepted according to a preset key length to generate the data key.

6. A data processing method based on encryption and decryption sidecar container according to claim 5, characterized in that: The step of obtaining an initial secret key IK, calculating a corresponding initial key summary value H, and performing pseudo-randomization processing on the initial key according to the random number character string C to obtain a random secret key RK includes: Detecting the key length of the initial key, and when the key length is less than a preset key length, padding character codes so that the key length of the initial key is equal to the preset key length; when the key length is greater than the preset key length, compressing the initial key based on a digest algorithm so that the key length of the initial key is equal to the preset key length; Performing an XOR operation on an initial key whose key length is processed to a preset key length and the first character string to obtain a first bit sequence; Extracting the container identifier in the key request, appending the first bit sequence to the beginning of the container identifier to generate a first identifier sequence, and calculating a first identifier digest value of the first identifier sequence by using a hash function; Performing an XOR operation on the initial key whose key length is processed to a preset key length and the second character string to obtain a second bit sequence; The second bit sequence is appended to the beginning of the first identification digest value to generate a second identification sequence, and a second identification digest value of the second identification sequence is calculated by a hash function as the initial key digest value.

7. According to claim 1, a data processing method based on encryption and decryption sidecar container is characterized in that: The step: the encryption / decryption sidecar container performs corresponding encryption or decryption processing on the data to be processed according to the data key to obtain the processed data; includes: The encryption / decryption sidecar container encrypts the received data to be encrypted according to the data key to generate encrypted data; optionally, including: Obtaining the encryption key in the data key and constructing an encryption key matrix; Convert the to-be-encrypted data into a to-be-encrypted matrix, and perform a bitwise XOR operation with the encryption key matrix to obtain an initial encryption matrix; According to the position of the byte in the initial encryption matrix, searching for a replacement character in the byte replacement box to perform a replacement operation, and obtaining a state encryption matrix; Perform row shift and column confusion operations according to the state encryption matrix to obtain a transformation encryption matrix; The transformation encryption matrix and the encryption key matrix are subjected to a bitwise exclusive OR operation to obtain a data encryption matrix, which is then bitwise expanded into encryption processing data.

8. The data processing method based on encryption and decryption sidecar container according to claim 7 is characterized in that: The step: the encryption / decryption sidecar container performs corresponding encryption or decryption processing on the data to be processed according to the data key to obtain the processed data; further comprising: The encryption / decryption sidecar container performs decryption processing on the received data to be decrypted according to the decryption key in the data key, which is specifically implemented as an inverse operation of the encryption processing to generate decrypted processing data.

9. A data processing method based on encryption and decryption sidecar container according to claim 1, characterized in that: The step: the encryption and decryption sidecar container transmits the processed data to the business service container; includes: After the encryption / decryption sidecar container sends the processed data to the business service container and receives the data receiving instruction returned by the business service container, the authentication token and the data key received by the encryption / decryption sidecar container are deleted.

Images