Data security communication method and system based on object storage side vehicle container

Abstract

The invention provides a data security communication method and system based on an object storage sidecar container, and belongs to the technical field of micro-service architecture, and the method comprises the steps: a business service container in a container unit sends a storage service request to the object storage sidecar container, the object storage sidecar container carries out the analysis, obtains an encryption key from a key management and control platform, and sends the encryption key to a server; encrypting to-be-operated data according to the encryption key, configuring an application program interface, sending a data request to a target cloud server, executing data operation by the target cloud server according to the data request, acquiring response operation information, transmitting the response operation information to an object storage side vehicle container, and detecting a response state of the target cloud server; and transmitting the response operation information to the business service container to execute business operation, and obtaining a data processing result. According to the technical scheme, convenient communication with the target cloud server is achieved, meanwhile, safe access to the target cloud server is achieved, the risk of data leakage in the process of communication with the target cloud server is reduced, and data communication safety is effectively protected.

Description

Technical Field

[0001] The present invention relates to the field of microservice architecture technology, and in particular to a data security communication method and system based on an object storage sidecar container. Background Art

[0002] With the development of cloud computing technology, more and more enterprises are choosing multi-cloud deployment strategies to leverage the strengths of different cloud service providers to meet business needs. The multi-cloud server strategy can help enterprises achieve high availability, disaster recovery, and data backup for their businesses.

[0003] However, service management in a multi-cloud environment, especially the management of object storage services, requires developers to write specific adaptation codes for each cloud server to configure the network and make corresponding calls between the codes to achieve data communication between the business server and the cloud server. The above technical solution makes the communication connection steps between the business server and the cloud server cumbersome, and the access keys are usually managed by the developers, which can easily lead to key leakage due to human factors, exposing the data stored on the cloud server to security risks.

[0004] Therefore, a data security communication method and system based on object storage sidecar container are proposed. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides a data security communication method and system based on object storage sidecar container, which is used to solve the problem that the steps for establishing communication connection between business servers and cloud servers in traditional technologies are cumbersome and there is a risk of data leakage.

[0006] An embodiment of the present invention provides a data security communication method based on an object storage sidecar container, including:

[0007] Deploy business service containers and object storage sidecar containers in the container unit;

[0008] The business service container sends a storage service request to the object storage sidecar container, and the object storage sidecar container parses and processes the storage service request, obtains the target cloud server name, constructs a key request, and sends it to the key management and control platform;

[0009] The key management and control platform generates an encryption key according to the key request and sends it to the object storage sidecar container;

[0010] The object storage sidecar container configures the corresponding application program interface according to the name of the target cloud server, processes the data to be operated through the encryption key, obtains the encrypted data, constructs a data request and sends it to the target cloud server through the application program interface;

[0011] The target cloud server performs corresponding data operations according to the data request, obtains response operation information and sends it to the object storage sidecar container;

[0012] The object storage sidecar container parses and processes the received response operation information, detects the response status of the target cloud server, and after detecting that the target cloud server operates correctly, transmits the response operation information to the business service container;

[0013] The business service container performs corresponding business operations according to the response operation information to obtain data processing results.

[0014] Preferably, the present invention provides a data security communication method based on an object storage sidecar container, the step of: deploying a business service container and an object storage sidecar container in a container unit, comprising:

[0015] A software development component is set in the business service container, and initial configuration is performed to establish a communication connection between the business service container and the object storage sidecar container.

[0016] Preferably, the present invention provides a data security communication method based on an object storage sidecar container, the steps of: the business service container sends a storage service request to the object storage sidecar container, the object storage sidecar container performs parsing processing according to the storage service request, obtains the target cloud server name, constructs a key request and sends it to the key management and control platform; including:

[0017] Monitor the resource usage of the object storage sidecar container, and when the resource usage of the object storage sidecar container reaches a busy threshold, deploy a second object storage sidecar container in the container unit;

[0018] According to the resource usage status of the object storage sidecar container and the second object storage sidecar container, the business service container preferentially selects the sidecar container with good resource usage status to send the storage service request.

[0019] Preferably, the present invention provides a data security communication method based on an object storage sidecar container, the steps of: the business service container sends a storage service request to the object storage sidecar container, the object storage sidecar container performs parsing processing according to the storage service request, obtains the target cloud server name, constructs a key request and sends it to the key management and control platform; including:

[0020] The business service container encapsulates the operation type, the target server name and the data to be operated through the software development component according to the service requirements, and generates a storage service request;

[0021] The object storage sidecar container parses the storage service request, obtains the target server name, constructs a key request and sends it to the key management and control platform.

[0022] Preferably, the present invention provides a data security communication method based on an object storage sidecar container, the step of: the key management and control platform generates an encryption key according to the key request and sends it to the object storage sidecar container; comprising:

[0023] The key management and control platform generates an encryption key according to the key request; optionally, including:

[0024] Obtain the target server name and request time in the key request, and generate an initial key;

[0025] Performing a scrambling operation and a character replacement operation on the initial key to obtain a scrambling key;

[0026] Generate a random number sequence by using a random number generator, perform round key processing with the scrambling key, and obtain an encryption key;

[0027] Obtain an access key and a secret key from the encryption key, and send the access key and the secret key to the object storage sidecar container; and according to the target server name in the key request, send the secret key to the target cloud server corresponding to the target server name.

[0028] Preferably, the present invention provides a data security communication method based on an object storage sidecar container, the steps of: the object storage sidecar container configures a corresponding application program interface according to the name of the target cloud server, processes the data to be operated through the encryption key, obtains encrypted data, constructs a data request and sends it to the target cloud server through the application program interface; including:

[0029] According to the target cloud server name, obtaining the server address of the target cloud server, building a data transmission path, configuring a corresponding application program interface, and establishing a communication connection with the target cloud server; optionally, including:

[0030] According to the configured application program interface, a communication test sequence is constructed and sent to the target cloud server;

[0031] {[protocol identifier]: / / [server address] / [data transmission path] / [communication test data address]}

[0032] The protocol identifier is an identifier for performing corresponding functional tests on the communication test sequence, including any one of request data, hypertext transmission, and mail transmission; the communication test data address is an address for storing communication test data in the object storage sidecar container;

[0033] The object storage sidecar container receives the response test data returned by the target cloud server, detects the data communication between the target cloud server and the object storage sidecar container, and analyzes the response time, resource usage and data throughput of the target cloud server to the communication test data to obtain the response performance of the target cloud server;

[0034] According to the response performance of the target cloud server, a corresponding encryption complexity is set to encrypt the data to be operated by using a secret key in the encryption key to obtain encrypted data;

[0035] The container name of the object storage sidecar container is encrypted by using the secret key to obtain the sidecar container identity signature;

[0036] According to the encrypted data, access key, sidecar container identity signature and operation instruction, a data request is constructed and sent to the target cloud server through the application program interface.

[0037] Preferably, the present invention provides a data security communication method based on an object storage sidecar container, the steps of: the target cloud server performs corresponding data operations according to the data request, obtains response operation information and sends it to the object storage sidecar container; including:

[0038] After receiving the data request sent by the object storage sidecar container, the target cloud server performs parsing processing to obtain the encrypted data, access key, sidecar container identity signature and operation instruction in the data request;

[0039] Matching the corresponding secret key with the access key, and encrypting the identity of the object storage sidecar container that sends the data request according to the secret key to obtain the service container identifier;

[0040] The service container identifier is compared with the sidecar container identity signature. When the comparison is consistent, the encrypted data is parsed by the secret key to obtain the data to be processed; according to the operation instruction in the data request, the data to be processed is processed to obtain the response operation information.

[0041] Preferably, the present invention provides a data security communication method based on an object storage sidecar container, the steps of: the object storage sidecar container parses and processes the received response operation information, detects the response status of the target cloud server, and after detecting that the target cloud server operates correctly, transmits the response operation information to the business service container; including:

[0042] Obtaining response result information and operation status information in the response operation information;

[0043] The object storage sidecar container detects, according to the operation instruction, whether the operation status information is set accordingly according to the operation instruction and the data flow relationship during the operation, and analyzes whether the target cloud server performs the corresponding operation;

[0044] After detecting that the target cloud server is operating correctly, transmitting the response operation information to the business service container;

[0045] After detecting that the target cloud server is not operating correctly, an error prompt instruction is returned to the target cloud server.

[0046] The present invention provides a data security communication system based on an object storage sidecar container, comprising:

[0047] The container deployment module is used to deploy business service containers and object storage sidecar containers in the container unit;

[0048] The business service container is used to send a storage service request to the object storage sidecar container;

[0049] The object storage sidecar container is used to parse and process the storage service request, obtain the target cloud server name, construct a key request and send it to the key management and control platform;

[0050] The key management and control platform is used to generate an encryption key according to the key request and send it to the object storage sidecar container;

[0051] The object storage sidecar container is used to configure the corresponding application program interface according to the name of the target cloud server, obtain the encrypted data after processing the data to be operated through the encryption key, and construct a data request to send to the target cloud server through the application program interface;

[0052] The target cloud server is used to perform corresponding data operations according to the data request, obtain response operation information and send it to the object storage sidecar container;

[0053] The object storage sidecar container is used to parse and process the received response operation information, detect the response status of the target cloud server, and after detecting that the target cloud server is operating correctly, transmit the response operation information to the business service container;

[0054] The business service container is used to perform corresponding business operations according to the response operation information and obtain data processing results.

[0055] Compared with traditional technologies, the beneficial effects of the present invention are as follows: a data security communication method and system based on an object storage sidecar container proposed in the present invention realizes close coupling and efficient communication of services within the container unit through the business service container and the object storage sidecar container, realizes the generation of encryption keys through the key management and control platform, and does not require the participation of developers, thus avoiding the problem of key leakage due to human factors in traditional technologies and improving data security. The object storage sidecar container configures the corresponding application program interface according to the name of the target cloud service, which solves the inconvenience of requiring developers to write specific codes for each cloud server in traditional technologies. While realizing convenient communication with the target cloud server, no developer participation is required throughout the process, thereby realizing secure access to the target cloud server, greatly reducing the risk of data leakage on the target cloud service, reducing development and maintenance costs, and effectively protecting data communication security.

[0056] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0057] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A flowchart of a data security communication method based on an object storage sidecar container provided by the present invention;

[0059] Figure 2 A data communication schematic diagram of a data security communication method based on an object storage sidecar container provided by the present invention;

[0060] Figure 3 A schematic diagram of the structure of a data security communication system based on an object storage sidecar container provided by the present invention. DETAILED DESCRIPTION

[0061] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0062] Embodiment 1:

[0063] The embodiment of the present invention provides a data security communication method based on an object storage sidecar container, referring to Figure 1 and Figure 2 ,include:

[0064] Deploy business service containers and object storage sidecar containers in the container unit;

[0065] The business service container sends a storage service request to the object storage sidecar container. The object storage sidecar container parses and processes the storage service request, obtains the target cloud server name, builds a key request, and sends it to the key management and control platform.

[0066] The key management and control platform generates an encryption key based on the key request and sends it to the object storage sidecar container;

[0067] The object storage sidecar container configures the corresponding API according to the target cloud server name, processes the data to be operated through the encryption key, obtains the encrypted data, builds a data request and sends it to the target cloud server through the API;

[0068] The target cloud server performs corresponding data operations based on the data request, obtains the response operation information and sends it to the object storage sidecar container;

[0069] The object storage sidecar container parses and processes the received response operation information, detects the response status of the target cloud server, and transmits the response operation information to the business service container after detecting that the target cloud server is operating correctly.

[0070] The business service container executes corresponding business operations according to the response operation information and obtains the data processing results.

[0071] In the above embodiments, the business service container in the container unit sends a storage service request to the object storage sidecar container. The object storage sidecar container parses and processes the storage service request, obtains the name of the target cloud server, builds a key request and sends it to the key management and control platform; the key management and control platform generates an encryption key based on the key request; the object storage sidecar container configures the corresponding application program interface based on the name of the target cloud server, processes the data to be operated through the encryption key, obtains the encrypted data, builds a data request and sends it to the target cloud server through the application program interface; the target cloud server performs the corresponding data operation based on the data request, obtains the response operation information and sends it to the object storage sidecar container; the object storage sidecar container parses and processes the received response operation information, detects the response status of the target cloud server, and after detecting that the target cloud server is operating correctly, transmits the response operation information to the business service container. The business service container performs the corresponding business operation based on the response operation information and obtains the data processing result.

[0072] In the above embodiments, the deployment of the business service container and the object storage sidecar container in the container unit realizes tight coupling and efficient communication between services, and the use of the sidecar container mode simplifies the configuration of communication between services and reduces maintenance complexity.

[0073] In the above embodiments, the storage service request includes program file upload, program file download, data retrieval and object deletion.

[0074] In the above embodiments, the target cloud server includes one or more of AWS Amazon cloud server, Azure Microsoft cloud server, and Google Cloud Google cloud server.

[0075] The beneficial effects of the above technology are: the business service container sends a storage service request to the object storage sidecar container, the object storage sidecar container parses and obtains the encryption key from the key management platform, the object storage sidecar container encrypts the data to be operated according to the encryption key, configures the application interface, sends a data request to the target cloud server, the target cloud server performs corresponding data operations according to the data request, obtains response operation information, realizes the operation processing of the storage service request sent by the business service container by the target cloud server, and transmits the response operation information to the object storage sidecar container, detects the response status of the target cloud server, transmits the response operation information to the business service container to perform corresponding business operations, obtains data processing results, and realizes data communication between the business service container and the target server. Compared with traditional technologies, the above method realizes the close coupling and efficient communication of services within the container unit through the business service container and the object storage sidecar container, and realizes the generation of encryption keys through the key management and control platform without the participation of developers, avoiding the problem of key leakage due to human factors in traditional technologies and improving data security. The object storage sidecar container configures the corresponding application program interface according to the name of the target cloud service, which solves the inconvenience of developers writing specific codes for each cloud server in traditional technologies. While realizing convenient communication with the target cloud server, there is no need for developers to participate in the whole process, and secure access to the target cloud server is realized, which greatly reduces the risk of data leakage on the target cloud service, reduces development and maintenance costs, and effectively protects data communication security.

[0076] Embodiment 2:

[0077] An embodiment of the present invention provides a data security communication method based on an object storage sidecar container, comprising the steps of: deploying a business service container and an object storage sidecar container in a container unit, including:

[0078] Set up software development components in the business service container and perform initial configuration to establish a communication connection between the business service container and the object storage sidecar container.

[0079] In the above embodiments, the communication connection between the business service container and the object storage sidecar container is achieved by setting the software development components and performing initial configuration.

[0080] In the above embodiments, the business server container uses a unified software development component, and the object storage sidecar container encapsulates the logic code for communicating with different target cloud servers. Developers only need to use unified software development components to achieve communication and data processing with the target cloud server, which simplifies the development process, reduces the writing of duplicate code, and reduces the amount of code and maintenance costs.

[0081] The beneficial effect of the above technology is that through the software driving component, the business service container and the object storage sidecar container in the container unit are quickly deployed to establish a data communication connection.

[0082] Embodiment 3:

[0083] An embodiment of the present invention provides a data security communication method based on an object storage sidecar container, comprising the steps of: a business service container sends a storage service request to an object storage sidecar container, the object storage sidecar container performs parsing processing according to the storage service request, obtains the target cloud server name, constructs a key request and sends it to a key management and control platform; including:

[0084] Monitor resource usage of the object storage sidecar container, and when the resource usage of the object storage sidecar container reaches a busy threshold, deploy a second object storage sidecar container in the container unit;

[0085] According to the resource usage status of the object storage sidecar container and the second object storage sidecar container, the business service container preferentially selects the sidecar container with good resource usage status to send storage service requests.

[0086] In the above embodiments, the resource usage status of the object storage sidecar container in the container unit is monitored. When it is monitored that the resource usage status of the object storage sidecar container reaches a busy threshold, a second object storage sidecar container is deployed in the container unit to establish a communication connection with the business service container; the business service container gives priority to the sidecar container with good resource usage status to send storage service requests based on the resource usage status of the object storage sidecar container and the second object storage sidecar container.

[0087] In the above embodiments, the container unit can perform container expansion according to the resource usage status of the current sidecar container, making service expansion and deployment more flexible and efficient.

[0088] The beneficial effect of the above technology is that by monitoring the resource usage of the object storage sidecar container, when the resource usage of the object storage sidecar container reaches the busy threshold, a second object storage sidecar container is deployed in the container unit to process the request, thereby realizing the function of the business service container intelligently selecting the sidecar container to process the storage service request, avoiding the problem that the business service container sends storage service requests to a fixed single sidecar container, affecting the request processing speed, thereby improving the processing efficiency of storage service requests.

[0089] Embodiment 4:

[0090] The embodiment of the present invention provides a data security communication method based on an object storage sidecar container. The steps are as follows: a business service container sends a storage service request to an object storage sidecar container, and the object storage sidecar container parses and processes the storage service request, obtains the target cloud server name, and constructs a key request and sends it to a key management and control platform; including:

[0091] Based on the service requirements, the business service container encapsulates the operation type, target server name, and data to be operated through software development components to generate a storage service request.

[0092] The object storage sidecar container parses the storage service request, obtains the target server name, builds a key request and sends it to the key management and control platform.

[0093] In the above embodiments, the business service container encapsulates the operation type, the target server name, and the data to be operated through the software development component to generate a storage service request; the object storage sidecar container parses and processes the storage service request, obtains the target server name, and constructs a key request to send to the key management and control platform.

[0094] In the above embodiments, the software development component encapsulates the operation type, the target server name, and the data to be operated into a storage service request in a standard format.

[0095] In the above embodiments, the software development component can be implemented as an SDK component.

[0096] Embodiment 5:

[0097] An embodiment of the present invention provides a data security communication method based on an object storage sidecar container, comprising the steps of: a key management and control platform generates an encryption key according to a key request and sends it to the object storage sidecar container; comprising:

[0098] The key management and control platform generates encryption keys based on key requests; optional ones include:

[0099] Obtain the target server name and request time in the key request and generate an initial key;

[0100] Perform scrambling operations and character replacement operations on the initial key to obtain a scrambling key;

[0101] Generate a random number sequence through a random number generator, perform round key processing with the scrambling key, and obtain the encryption key;

[0102] Get the access key and secret key in the encryption key, send the access key and secret key to the object storage sidecar container; according to the target server name in the key request, send the secret key to the target cloud server corresponding to the target server name.

[0103] In the above embodiments, the key management and control platform generates an encryption key based on the key request sent by the object storage sidecar container, sends the access key and secret key in the encryption key to the object storage sidecar container, and sends the secret key to the target cloud server corresponding to the target server name.

[0104] In the above embodiments, the key management and control platform generates an initial key according to the target server name and request time in the key request, performs scrambling and character replacement operations on the initial key, obtains the scrambled key, performs round key processing with the random number sequence generated by the random number generator, and obtains the encryption key.

[0105] In the above embodiments, the key management and control platform can be implemented as a DevOps management and control platform, which improves the efficiency of encryption key generation, reduces the risk of key leakage, avoids exposing encryption keys to developers, ensures the security of encryption keys, and the DevOps management and control platform can realize automatic rotation of keys, regularly replace keys, and reduce the complexity of key management.

[0106] In the above embodiments, the configuration of the key management and control platform and the object storage sidecar container simplifies the structure and reduces maintenance costs while meeting service processing requirements.

[0107] The beneficial effect of the above technology is that the key management and control platform generates encryption keys according to key requests, and sends access keys and secret keys to the object storage sidecar container, and the secret keys are sent to the target cloud server, thereby avoiding the transmission of secret keys during data communication between the object storage sidecar container and the target cloud server, which may lead to the risk of secret key leakage. While realizing encryption processing of the operation data, the security of the secret keys is improved.

[0108] Embodiment 6:

[0109] The embodiment of the present invention provides a data security communication method based on an object storage sidecar container, comprising the following steps: the object storage sidecar container configures a corresponding application program interface according to the name of a target cloud server, obtains encrypted data after processing the data to be operated through an encryption key, and constructs a data request and sends it to the target cloud server through the application program interface; including:

[0110] According to the name of the target cloud server, obtain the server address of the target cloud server, build a data transmission path, configure the corresponding application interface, and establish a communication connection with the target cloud server; optional, including:

[0111] According to the configured application program interface, a communication test sequence is constructed and sent to the target cloud server;

[0112] {[protocol identifier]: / / [server address] / [data transmission path] / [communication test data address]}

[0113] The protocol identifier is an identifier for the communication test sequence to perform a corresponding functional test, including any one of request data, hypertext transmission, and mail transmission; the communication test data address is an address for storing the communication test data in the object storage sidecar container;

[0114] The object storage sidecar container receives the response test data returned by the target cloud server, detects the data communication between the target cloud server and the object storage sidecar container, and analyzes the response time, resource usage, and data throughput of the target cloud server to the communication test data to obtain the response performance of the target cloud server.

[0115] According to the response performance of the target cloud server, the corresponding encryption complexity is set to encrypt the operation data using the secret key in the encryption key to obtain the encrypted data;

[0116] Encrypt the container name of the object storage sidecar container using a secret key to obtain the sidecar container identity signature;

[0117] Based on the encrypted data, access key, sidecar container identity signature and operation instructions, a data request is constructed and sent to the target cloud server through the application program interface.

[0118] In the above embodiments, according to the target cloud server name, the server address of the target cloud server is obtained, a data transmission path is constructed, a corresponding application program interface is configured, a communication connection is established with the target cloud server, and a data request is sent to the target cloud server.

[0119] In the above embodiments, a data request is constructed according to encrypted data, an access key, a sidecar container identity signature and an operation instruction. The encrypted data is obtained by encrypting the data to be operated using a secret key, and the sidecar container identity signature is obtained by encrypting the container name of the object storage sidecar container using a secret key.

[0120] In the above embodiments, after the application program interface is configured, the object storage sidecar container sends a communication test sequence to the target cloud server to perform a data communication test and a target cloud server performance test; specifically, the object storage sidecar container sends a communication test sequence to the target cloud server, receives and returns response test data, and analyzes the data communication situation and the response time of the target cloud server to the communication test data, resource usage, and data throughput.

[0121] In the above embodiments, the object storage sidecar container sets the corresponding encryption complexity according to the response performance of the target cloud server and encrypts the data to be operated.

[0122] In the above embodiments, the object storage sidecar container sends the data request to the target cloud server, ensuring the correct routing of the request without requiring developers to pay attention to the details of the underlying cloud service.

[0123] The beneficial effects of the above technology are: the object storage sidecar container configures the corresponding application interface according to the name of the target cloud server, realizes the communication connection with the target cloud server, and sends the communication test sequence according to the application interface to perform data communication test to ensure normal communication with the target cloud server, and encrypts the data to be operated according to the response performance of the obtained target cloud server to construct a data request, so that the target cloud server can authenticate and process the data accordingly according to the data request.

[0124] Embodiment 7:

[0125] The embodiment of the present invention provides a data security communication method based on an object storage sidecar container, comprising the steps of: a target cloud server performs corresponding data operations according to a data request, obtains response operation information and sends it to the object storage sidecar container; comprising:

[0126] After receiving the data request sent by the object storage sidecar container, the target cloud server parses and processes it to obtain the encrypted data, access key, sidecar container identity signature, and operation instructions in the data request;

[0127] The access key is matched with the corresponding secret key, and the identity of the object storage sidecar container that sends the data request is encrypted according to the secret key to obtain the service container identity;

[0128] The service container identifier is compared with the sidecar container identity signature. When the comparison is consistent, the encrypted data is parsed using the secret key to obtain the data to be processed. According to the operation instructions in the data request, the data to be processed is processed to obtain the response operation information.

[0129] In the above embodiment, the target cloud server receives the data request sent by the object storage sidecar container, obtains the encrypted data, access key, sidecar container identity signature and operation instruction through parsing, and the target cloud server matches the corresponding secret key through the access key, and encrypts the identity of the object storage sidecar container according to the secret key to obtain the service container identifier. When the service container identifier is consistent with the sidecar container identity signature, the identity authentication of the object storage sidecar container is passed, and the encrypted data is parsed with the secret key to obtain the data to be processed; the target cloud server processes the data to be processed accordingly according to the operation instruction and obtains the response operation information.

[0130] The beneficial effect of the above technology is that the target cloud server receives the data request sent by the object storage sidecar container and parses it, thereby verifying the identity of the object storage sidecar container, and parses the encrypted data according to the obtained secret key, executes the operation corresponding to the operation instruction, and realizes the target cloud server's processing of the encrypted data and obtains response operation information.

[0131] Embodiment 8:

[0132] The embodiment of the present invention provides a data security communication method based on an object storage sidecar container, comprising the steps of: the object storage sidecar container parses and processes the received response operation information, detects the response status of the target cloud server, and after detecting that the target cloud server operates correctly, transmits the response operation information to the business service container; comprising:

[0133] Obtaining response result information and operation status information in the response operation information;

[0134] The object storage sidecar container detects whether the operation status information is set according to the operation instruction and the data flow relationship during the operation, and analyzes whether the target cloud server performs the corresponding operation;

[0135] After detecting that the target cloud server is operating correctly, the response operation information is transmitted to the business service container;

[0136] After detecting that the target cloud server is not operating correctly, an error prompt instruction is returned to the target cloud service.

[0137] In the above embodiments, the object storage sidecar container detects whether the target cloud server is set up accordingly according to the operation instructions and the data flow relationship during the operation process based on the operation status information and the corresponding operation instructions in the response operation information, and analyzes whether the target cloud server performs the corresponding operation.

[0138] In the above embodiments, after detecting that the target cloud server operates correctly, the response operation information is transmitted to the business service container; after detecting that the target cloud server does not operate correctly, an error prompt instruction is returned to the target cloud service.

[0139] The beneficial effect of the above technology is that the object storage sidecar container parses the response operation information and analyzes whether the target cloud server executes the data operation corresponding to the operation instruction, thereby realizing the detection of whether the storage sidecar container executes the corresponding operation on the target cloud server, and after detecting that the target cloud server does not operate correctly, returns an error prompt instruction to the target cloud server for reprocessing, thereby avoiding returning erroneous data to the business service container and affecting the business operations of subsequent steps.

[0140] Embodiment 9:

[0141] The embodiment of the present invention provides a data security communication system based on an object storage sidecar container, referring to Figure 3 ,include:

[0142] The container deployment module is used to deploy business service containers and object storage sidecar containers in the container unit;

[0143] Business service container, used to send storage service requests to the object storage sidecar container;

[0144] The object storage sidecar container is used to parse and process storage service requests, obtain the target cloud server name, and construct a key request to send to the key management and control platform.

[0145] The key management and control platform is used to generate encryption keys based on key requests and send them to the object storage sidecar container;

[0146] The object storage sidecar container is used to configure the corresponding application program interface according to the name of the target cloud server, process the data to be operated through the encryption key, obtain the encrypted data, and construct a data request to send it to the target cloud server through the application program interface;

[0147] The target cloud server is used to perform corresponding data operations according to the data request, obtain the response operation information and send it to the object storage sidecar container;

[0148] The object storage sidecar container is used to parse and process the received response operation information, detect the response status of the target cloud server, and transmit the response operation information to the business service container after detecting that the target cloud server is operating correctly;

[0149] The business service container is used to execute corresponding business operations according to the response operation information and obtain data processing results.

[0150] In the above embodiment, the business service container sends a storage service request to the object storage sidecar container, the object storage sidecar container parses and processes the storage service request, obtains the name of the target cloud server, builds a key request and sends it to the key management and control platform; the key management and control platform generates an encryption key based on the key request; the object storage sidecar container configures the corresponding application interface based on the name of the target cloud server, processes the data to be operated through the encryption key, obtains the encrypted data, builds a data request and sends it to the target cloud server through the application interface; the target cloud server performs the corresponding data operation based on the data request, obtains the response operation information and sends it to the object storage sidecar container; the object storage sidecar container parses and processes the received response operation information, detects the response status of the target cloud server, and after detecting the correct operation, transmits the response operation information to the business service container, and the business service container performs the corresponding business operation based on the response operation information and obtains the data processing result.

[0151] The beneficial effects of the above technology are: the business service container sends a storage service request to the object storage sidecar container, the object storage sidecar container parses and obtains the encryption key from the key management platform, the object storage sidecar container encrypts the data to be operated according to the encryption key, configures the application interface, sends a data request to the target cloud server, the target cloud server performs corresponding data operations according to the data request, obtains response operation information, realizes the operation processing of the storage service request sent by the business service container by the target cloud server, and transmits the response operation information to the object storage sidecar container, detects the response status of the target cloud server, transmits the response operation information to the business service container to perform corresponding business operations, obtains data processing results, and realizes data communication between the business service container and the target server. Compared with traditional technologies, the above system achieves close coupling and efficient communication of services within the container unit through the business service container and the object storage sidecar container, and realizes the generation of encryption keys through the key management and control platform without the participation of developers, avoiding the problem of key leakage due to human factors in traditional technologies and improving data security. The object storage sidecar container configures the corresponding application program interface according to the name of the target cloud service, which solves the inconvenience of developers writing specific codes for each cloud server in traditional technologies. While achieving convenient communication with the target cloud server, there is no need for developers to participate in the whole process, and secure access to the target cloud server is achieved, which greatly reduces the risk of data leakage on the target cloud service, reduces development and maintenance costs, and effectively protects data communication security.

[0152] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A data security communication method based on object storage sidecar container, characterized in that: include: Deploy business service containers and object storage sidecar containers in the container unit; The business service container sends a storage service request to the object storage sidecar container, and the object storage sidecar container parses and processes the storage service request, obtains the target cloud server name, constructs a key request and sends it to the key management and control platform; The key management and control platform generates an encryption key according to the key request and sends it to the object storage sidecar container; The object storage sidecar container configures the corresponding application program interface according to the name of the target cloud server, processes the data to be operated through the encryption key, obtains the encrypted data, constructs a data request and sends it to the target cloud server through the application program interface; The target cloud server performs corresponding data operations according to the data request, obtains response operation information and sends it to the object storage sidecar container; The object storage sidecar container parses and processes the received response operation information, detects the response status of the target cloud server, and after detecting that the target cloud server operates correctly, transmits the response operation information to the business service container; The business service container performs corresponding business operations according to the response operation information to obtain data processing results.

2. According to a data security communication method based on object storage sidecar container according to claim 1, it is characterized in that: The step of deploying a business service container and an object storage sidecar container in a container unit includes: A software development component is set in the business service container, and initial configuration is performed to establish a communication connection between the business service container and the object storage sidecar container.

3. According to a data security communication method based on object storage sidecar container according to claim 1, it is characterized in that: The step: the business service container sends a storage service request to the object storage sidecar container, the object storage sidecar container parses and processes the storage service request, obtains the target cloud server name, constructs a key request and sends it to the key management and control platform; including: Monitor the resource usage of the object storage sidecar container, and when the resource usage of the object storage sidecar container reaches a busy threshold, deploy a second object storage sidecar container in the container unit; According to the resource usage status of the object storage sidecar container and the second object storage sidecar container, the business service container preferentially selects the sidecar container with good resource usage status to send the storage service request.

4. According to claim 2, a data security communication method based on object storage sidecar container is characterized in that: The step: the business service container sends a storage service request to the object storage sidecar container, the object storage sidecar container parses and processes the storage service request, obtains the target cloud server name, constructs a key request and sends it to the key management and control platform; including: The business service container encapsulates the operation type, the target server name and the data to be operated through the software development component according to the service requirements, and generates a storage service request; The object storage sidecar container parses the storage service request, obtains the target server name, constructs a key request and sends it to the key management and control platform.

5. According to claim 4, a data security communication method based on object storage sidecar container is characterized in that: The step: the key management and control platform generates an encryption key according to the key request and sends it to the object storage sidecar container; includes: The key management and control platform generates an encryption key according to the key request; optionally, including: Obtain the target server name and request time in the key request, and generate an initial key; Performing a scrambling operation and a character replacement operation on the initial key to obtain a scrambling key; Generate a random number sequence by using a random number generator, perform round key processing with the scrambling key, and obtain an encryption key; Obtain an access key and a secret key from the encryption key, and send the access key and the secret key to the object storage sidecar container; and according to the target server name in the key request, send the secret key to the target cloud server corresponding to the target server name.

6. A data security communication method based on object storage sidecar container according to claim 5, characterized in that: The step: the object storage sidecar container configures the corresponding application program interface according to the name of the target cloud server, processes the data to be operated through the encryption key, obtains the encrypted data, constructs a data request and sends it to the target cloud server through the application program interface; including: According to the target cloud server name, obtaining the server address of the target cloud server, building a data transmission path, configuring a corresponding application program interface, and establishing a communication connection with the target cloud server; optionally, including: According to the configured application program interface, a communication test sequence is constructed and sent to the target cloud server; {[protocol identifier]: / / [server address] / [data transmission path] / [communication test data address]} The protocol identifier is an identifier for performing corresponding functional tests on the communication test sequence, including any one of request data, hypertext transmission, and mail transmission; the communication test data address is an address for storing communication test data in the object storage sidecar container; The object storage sidecar container receives the response test data returned by the target cloud server, detects the data communication between the target cloud server and the object storage sidecar container, and analyzes the response time, resource usage and data throughput of the target cloud server to the communication test data to obtain the response performance of the target cloud server; According to the response performance of the target cloud server, a corresponding encryption complexity is set to encrypt the data to be operated by using a secret key in the encryption key to obtain encrypted data; The container name of the object storage sidecar container is encrypted by using the secret key to obtain the sidecar container identity signature; According to the encrypted data, access key, sidecar container identity signature and operation instruction, a data request is constructed and sent to the target cloud server through the application program interface.

7. A data security communication method based on object storage sidecar container according to claim 6, characterized in that: The step: the target cloud server performs corresponding data operations according to the data request, obtains response operation information and sends it to the object storage sidecar container; includes: After receiving the data request sent by the object storage sidecar container, the target cloud server performs parsing processing to obtain the encrypted data, access key, sidecar container identity signature and operation instruction in the data request; Matching the corresponding secret key with the access key, and encrypting the identity of the object storage sidecar container that sends the data request according to the secret key to obtain the service container identifier; The service container identifier is compared with the sidecar container identity signature. When the comparison is consistent, the encrypted data is parsed by the secret key to obtain the data to be processed; according to the operation instruction in the data request, the data to be processed is processed to obtain the response operation information.

8. A data security communication method based on object storage sidecar container according to claim 7, characterized in that: The step: the object storage sidecar container parses and processes the received response operation information, detects the response status of the target cloud server, and after detecting that the target cloud server is operating correctly, transmits the response operation information to the business service container; includes: Obtaining response result information and operation status information in the response operation information; The object storage sidecar container detects, according to the operation instruction, whether the operation status information is set accordingly according to the operation instruction and the data flow relationship during the operation, and analyzes whether the target cloud server performs the corresponding operation; After detecting that the target cloud server is operating correctly, transmitting the response operation information to the business service container; After detecting that the target cloud server is not operating correctly, an error prompt instruction is returned to the target cloud server.

9. A data security communication system based on object storage sidecar container according to claim 1, characterized in that: include: The container deployment module is used to deploy business service containers and object storage sidecar containers in the container unit; The business service container is used to send a storage service request to the object storage sidecar container; The object storage sidecar container is used to parse and process the storage service request, obtain the target cloud server name, construct a key request and send it to the key management and control platform; The key management and control platform is used to generate an encryption key according to the key request and send it to the object storage sidecar container; The object storage sidecar container is used to configure the corresponding application program interface according to the name of the target cloud server, obtain the encrypted data after processing the data to be operated through the encryption key, and construct a data request to send to the target cloud server through the application program interface; The target cloud server is used to perform corresponding data operations according to the data request, obtain response operation information and send it to the object storage sidecar container; The object storage sidecar container is used to parse and process the received response operation information, detect the response status of the target cloud server, and after detecting that the target cloud server is operating correctly, transmit the response operation information to the business service container; The business service container is used to perform corresponding business operations according to the response operation information and obtain data processing results.

Images