Application security certificate management method and device
By applying containerized management and random key and salt value encryption technology, the security credential information of enterprise applications is scatteredly stored and encrypted, and the security of information is solved, and the security of information is improved.
Patent Information
- Application Number
- CN202411660909.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-20
- Publication Date
- 2025-02-25
AI Technical Summary
In the prior art, the centralized management of security credential information used by enterprises has security risks and is easily exposed to malicious attacks.
Through containerized management, security credential information is stored decentralizedly, and random key and salt value encryption information generated based on service identification and environment identification are used to encrypt and decrypt the encryption operation only through preset encryption and decryption tools.
It greatly increases the difficulty of the explicit text of the login credential information being maliciously obtained, improves the security of the application security credential information, and avoids the security risks caused by centralized management.
Smart Images
Figure CN119513896A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the technical field of application containerization security management, and in particular to an application security credential management method and device. Background Art
[0002] In different business scenarios, enterprise applications use databases to support enterprise operations, decision-making, customer service, and other business activities.
[0003] Nowadays, more and more enterprise applications use security credential information represented by user names and passwords to access databases. As the number of enterprise applications continues to increase, the security credential information used by each enterprise application is usually stored in the configuration files of the code management platform (such as svn, git and other code management platforms) in R&D projects; or, the security credential information of each enterprise application is centrally stored and an access portal is provided. Enterprise applications access the security credential management service through http or tcp to obtain the corresponding required user name and password. This method requires special verification for accessing the security credential management service.
[0004] However, the above is actually still a centralized management of security credential information, regardless of whether it is stored in plain text or encrypted text. Once the centralized management location is maliciously attacked, the security credential information of all applications and their environments will be leaked, so there are certain security risks. Summary of the invention
[0005] The present disclosure provides an application security credential management method and device, the main purpose of which is to use application containerization management to provide a more optimized solution to ensure the security of application security credentials.
[0006] In order to achieve the above objectives, the present disclosure mainly provides the following technical solutions:
[0007] A first aspect of the present disclosure provides an application security credential management method, the method comprising:
[0008] After the first application is started, the login credential information ciphertext, key, and salt value corresponding to the first application are read from the application configuration files corresponding to at least one container orchestration platform; wherein each container orchestration platform deploys an application configuration file correspondingly, and the key and the salt value are random strings generated based on the service identifier of the first application and the environment identifier where the first application is located;
[0009] Using the key and the salt value, a preset encryption and decryption tool corresponding to the first application is called to perform a decryption operation on the login credential information ciphertext, so as to obtain a login credential information plaintext corresponding to the login credential information ciphertext;
[0010] Connect and access the database according to the plain text of the login credential information.
[0011] In some modified embodiments, before the first application is started, the method further includes:
[0012] adding a different security level identifier to at least one second application, the at least one second application including the first application;
[0013] Dividing the at least one second application into at least one group according to preset percentages corresponding to different security level identifiers;
[0014] Deploy each group of the second applications into containers orchestrated and managed by different container orchestration platforms, where each container orchestration platform correspondingly deploys an application configuration file;
[0015] For any group of second applications, the login credential information ciphertext, key and salt value corresponding to each of the second applications are stored in the application configuration file.
[0016] In some modified embodiments, in the process of deploying each group of the second applications to containers orchestrated and managed by different container orchestration platforms, the method further includes:
[0017] Packaging the second application into an image, and pushing the image to a container image repository;
[0018] By installing the encryption and decryption tool library file into the image, a preset encryption and decryption tool for performing encryption and decryption operations on the second application is obtained, and the encryption and decryption tool library file encapsulates program codes corresponding to the preset encryption method and the preset decryption method.
[0019] In some modified embodiments, for any group of second applications, before storing the ciphertext of login credential information, the key, and the salt value corresponding to each of the second applications in the application configuration file, the method further includes:
[0020] Providing an interface or console of a preset salt value management tool, for receiving input of a service identifier, an environment identifier, and plain text login credential information corresponding to the second application, wherein the plain text login credential information includes a plain text user name and a plain text password;
[0021] Using the preset salt value management tool to process the service identifier and the environment identifier to generate a salt value;
[0022] Using a preset key management tool to process the service identifier and the environment identifier to generate a key;
[0023] The salt value and the key are used to perform an encryption operation on the login credential information plaintext by calling the preset encryption and decryption tool corresponding to the second application to obtain the login credential information ciphertext corresponding to the login credential information plaintext.
[0024] In some modified embodiments, the using the salt value and the key to perform an encryption operation on the login credential information plaintext by calling the preset encryption and decryption tool corresponding to the second application to obtain the login credential information ciphertext corresponding to the login credential information plaintext includes:
[0025] Obfuscate the salt value and the plain text of the user name to obtain a first character string;
[0026] Obfuscating the salt value and the password plaintext to obtain a second character string;
[0027] Using the key, performing encryption operations on the first character string and the second character string by calling a preset encryption and decryption tool corresponding to the application, to obtain a first ciphertext corresponding to the first character string and a second ciphertext corresponding to the second character string;
[0028] A login credential information ciphertext corresponding to the login credential information plaintext is obtained according to the first ciphertext and the second ciphertext.
[0029] In some modified embodiments, the using the key and the salt value to perform a decryption operation on the login credential information ciphertext by calling the preset encryption and decryption tool corresponding to the first application to obtain the login credential information plaintext corresponding to the login credential information ciphertext includes:
[0030] Determine the encryption and decryption tool library file corresponding to the preset encryption and decryption tool;
[0031] Calling the preset decryption method encapsulated in the encryption and decryption tool library file to perform a decryption operation on the ciphertext of the login credential information;
[0032] Based on the key, decrypt to obtain the string information containing the salt value;
[0033] The salt value is deleted from the string information, and the login credential information plain text corresponding to the login credential information cipher text is obtained by decryption.
[0034] A second aspect of the present disclosure provides an application security credential management device, the device comprising:
[0035] A reading unit is used to read the login credential information ciphertext, key and salt value corresponding to the first application from the application configuration files corresponding to at least one container orchestration platform after the first application is started; wherein each container orchestration platform deploys an application configuration file correspondingly, and the key and the salt value are respectively random strings generated based on the service identifier of the first application and the environment identifier where the first application is located;
[0036] a decryption unit, configured to use the key and the salt value to perform a decryption operation on the login credential information ciphertext by calling a preset encryption and decryption tool corresponding to the first application, so as to obtain a login credential information plaintext corresponding to the login credential information ciphertext;
[0037] The access connection unit is used to connect and access the database according to the plain text of the login credential information.
[0038] In some modified embodiments, before the first application is started, the device further includes:
[0039] an adding unit, configured to add a different security level identifier to at least one second application, wherein the at least one second application includes the first application;
[0040] A division unit, configured to divide the at least one second application into at least one group according to preset percentages corresponding to different security level identifiers;
[0041] A deployment unit, configured to deploy each group of the second applications into containers orchestrated and managed by different container orchestration platforms, wherein each container orchestration platform deploys an application configuration file;
[0042] The storage unit is used to store the ciphertext of the login credential information, the key and the salt value corresponding to each of the second applications in the application configuration file for any group of second applications.
[0043] In some modified embodiments, in the process of deploying each group of the second applications to containers orchestrated and managed by different container orchestration platforms, the deployment unit further includes:
[0044] A packaging module, used to package the second application into an image, and push the image to a container image repository;
[0045] A module is provided for obtaining a preset encryption and decryption tool for performing encryption and decryption operations on the second application by installing an encryption and decryption tool library file into the image, wherein the encryption and decryption tool library file encapsulates program codes corresponding to preset encryption methods and preset decryption methods.
[0046] In some modified embodiments, for any group of second applications, before storing the ciphertext of login credential information, the key, and the salt value corresponding to each of the second applications in the application configuration file, the apparatus further includes:
[0047] A providing unit, configured to provide an interface or a console of a preset salt value management tool, configured to receive input of a service identifier, an environment identifier, and a plain text login credential information corresponding to the second application, wherein the plain text login credential information includes a plain text user name and a plain text password;
[0048] An encryption unit, used to process the service identifier and the environment identifier using the preset salt value management tool to generate a salt value;
[0049] The encryption unit is further used to process the service identifier and the environment identifier using a preset key management tool to generate a key;
[0050] The encryption unit is further used to use the salt value and the key to perform an encryption operation on the login credential information plaintext by calling the preset encryption and decryption tool corresponding to the second application, so as to obtain the login credential information ciphertext corresponding to the login credential information plaintext.
[0051] In some modified embodiments, the encryption unit includes:
[0052] An obfuscation module, used for obfuscating the salt value and the plain text of the user name to obtain a first character string;
[0053] The obfuscation module is further used to obfuscate the salt value and the password plaintext to obtain a second character string;
[0054] an encryption module, configured to use the key to perform encryption operations on the first character string and the second character string by calling a preset encryption and decryption tool corresponding to the application, so as to obtain a first ciphertext corresponding to the first character string and a second ciphertext corresponding to the second character string;
[0055] A combination module is used to obtain the login credential information ciphertext corresponding to the login credential information plaintext according to the first ciphertext and the second ciphertext.
[0056] In some modified embodiments, the decryption unit includes:
[0057] A determination module, used to determine the encryption and decryption tool library file corresponding to the preset encryption and decryption tool;
[0058] A calling module, used to call the preset decryption method encapsulated in the encryption and decryption tool library file to perform a decryption operation on the ciphertext of the login credential information;
[0059] The decryption module is further used to decrypt the string information containing the salt value based on the key;
[0060] The decryption module is further used to delete the salt value from the string information, and decrypt to obtain the login credential information plaintext corresponding to the login credential information ciphertext.
[0061] A third aspect of the present disclosure provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the application security credential management method as described above is implemented.
[0062] A fourth aspect of the present disclosure provides an electronic device, comprising at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute the application security credential management method as described above.
[0063] A fifth aspect of the present disclosure provides a computer program product, including a computer program / instruction, which implements the above-mentioned application security credential management method when executed by a processor.
[0064] By means of the above technical solution, the technical solution provided by the present disclosure has at least the following advantages:
[0065] The present disclosure provides an application security credential management method and device. With the help of application containerization management, the present disclosure pre-deploys multiple applications to container environments orchestrated and managed by different container orchestration platforms, and deploys an application configuration file for each container orchestration platform corresponding to the container orchestration platform, which is used to store security credential information of all applications orchestrated and managed under the container orchestration platform; therefore, after a certain application is started, the container orchestration platform with which the application has a deployment relationship can be determined first, and then the corresponding security credential information ciphertext, key and salt value can be obtained from the application configuration file corresponding to the container orchestration platform, and then the preset encryption and decryption tool corresponding to the application is called to decrypt and obtain the login credential information plaintext, so as to use the plaintext information to realize automatic access to the connection database.
[0066] In the present disclosure, multiple applications are pre-deployed to container environments orchestrated and managed by different container orchestration platforms, and the application configuration files of each container orchestration platform can be used to manage the security credential information of all applications that have a deployment relationship with the container orchestration platform, thereby realizing the decentralized storage management of the security credential information of a large number of applications, and the security credential information includes the login credential information ciphertext, key and salt value, because the key and salt value are random strings generated based on the service identifier and environment identifier of the application, thus the complexity of the ciphertext is increased due to the limitation of the service, environment and the salt value, and the present disclosure also uses the preset encryption and decryption tools corresponding to the application to realize encryption and decryption, thereby also restricting the operating environment of encryption and decryption, all of the above greatly increase the difficulty of malicious acquisition of the login credential information plaintext, thereby ensuring the security of the application security credential information. Compared with the prior art, the problem of security risks caused by the centralized management of the security credential information of the application is solved, and the present disclosure adopts application container management and provides a more optimized solution.
[0067] The above description is only an overview of the technical solution of the present disclosure. In order to more clearly understand the technical means of the present disclosure, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the specific implementation methods of the present disclosure are listed below. BRIEF DESCRIPTION OF THE DRAWINGS
[0068] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present disclosure. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:
[0069] Figure 1 A flow chart of an application security credential management method provided by an embodiment of the present disclosure;
[0070] Figure 2 A flow chart of another application security credential management method provided by an embodiment of the present disclosure;
[0071] Figure 3 A block diagram of a device for managing application security credentials provided by an embodiment of the present disclosure;
[0072] Figure 4 A block diagram of another application security credential management device provided by an embodiment of the present disclosure;
[0073] Figure 5 An electronic device is provided in accordance with an embodiment of the present disclosure. DETAILED DESCRIPTION
[0074] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0075] Nowadays, there is a demand for enterprise applications to use their own security credentials to access databases. As such demand increases, how to improve the security of enterprise application security credentials (e.g., represented by usernames and passwords) has received more attention. The usual method is to store the security credentials used by each enterprise application in the configuration file of a code management platform (such as SVN, GIT, etc.); or, to centrally store the security credentials of each enterprise application and provide access portals, and the enterprise application accesses the security credential management service through http or tcp to obtain the required username and password.
[0076] However, the inventors have discovered that regardless of whether the security credential information is stored in plain text or encrypted text, the above existing methods all use a dedicated storage location to centrally store the security credential information. Once the dedicated storage location is maliciously attacked, the security credential information of all applications and their environments will be leaked.
[0077] To this end, the inventors have studied that if instead of using a dedicated storage location, the security credential information is stored independently and dispersedly to adapt to a cluster composed of multiple different environment applications, and stored in encrypted form and the complexity of the ciphertext is increased, the security of the application's security credential information will be greatly improved.
[0078] Based on the above considerations, the embodiment of the present disclosure provides an application security credential management method, the execution subject can be but not limited to a client of a management device, the client can be customized and developed, and is used to automatically obtain security credential information of different applications to support different applications to access the connection database. The specific method is as follows: Figure 1 The illustrated embodiment includes at least 101-103, and the embodiment of the present disclosure does not limit the execution order of the scheme steps by numerical numbers.
[0079] 101. After the first application is started, the login credential information ciphertext, key, and salt value corresponding to the application are read from the application configuration files corresponding to at least one container orchestration platform.
[0080] It should be noted that the disclosed embodiment provides two different data processing stages, including: the first data processing stage is to deploy the application to the container orchestration platform to implement application container management; the second data processing stage is to start the application to access the database after the application container management has been implemented. In order to distinguish the applications processed at different data stages, the disclosed embodiment refers to the application processed in the first data processing stage as the "second application" and the application processed in the second data processing stage as the "first application", and it can be seen that the "first application" is any started application from the "second application".
[0081] In the disclosed embodiment, the container orchestration platform may be, but is not limited to, Kubernetes, in which multiple containers may be created, and the containers share the operating system kernel of the host machine, but provide process-level isolation, and each container runs in its own namespace, with an independent file system, network stack, and process ID space. The disclosed embodiment deploys at least one application to a Kubernetes container environment, so that each container contains information such as the application's code, runtime environment, dependencies, and configuration, thereby utilizing containers to provide a lightweight and fast way to run and manage applications, i.e., realizing application containerized management.
[0082] The embodiment of the present disclosure uses application containerization management to pre-deploy multiple applications into containers orchestrated and managed by different container orchestration platforms, and deploys an application configuration file for each container orchestration platform to store the ciphertext of login credential information, key, and salt value of the application managed under the container orchestration platform.
[0083] For example, taking Kubernetes as an example, the ciphertext, key, and salt value of the login credentials of multiple applications orchestrated and managed by Kubernetes can be maintained and stored in the Secret file of Kubernetes. In Kubernetes, the Secret file is a resource object used to store sensitive information such as passwords, OAuth tokens, and SSH keys. Using Secret can avoid hard-coding sensitive data in Pod definitions or Docker images, thereby improving security.
[0084] It should be noted that the embodiments of the present disclosure may provide multiple container orchestration platforms, and each container orchestration platform and the application configuration files corresponding to each container orchestration platform may be accessed through APIs. Therefore, for a large number of applications to be managed, they may be dispersed and deployed to different container orchestration platforms according to actual business needs.
[0085] For example, taking Kubernetes as an example, for applications A, B, C, D, and E to be managed, Kubernetes1 and Kubernetes2 can be provided. According to actual business needs, applications A, B, and C can be deployed to containers orchestrated and managed by Kubernetes1, while applications D and E can be deployed to containers orchestrated and managed by Kubernetes2. Since each Kubernetes deploys an application configuration file, it is necessary to store the security credential information of applications A, B, and C (including the ciphertext of the login credential information, the key, and the salt value) in the application configuration file 1 corresponding to Kubernetes1, and store the security credential information of applications D and E in the application configuration file 2 corresponding to Kubernetes2.
[0086] Among them, the embodiment of the present disclosure does not limit the form and quantity of division of which application is deployed to which container orchestrated and managed by Kubernetes, but as long as it is ensured that all applications are not allocated and deployed to the same container orchestrated and managed by Kubernetes, and according to which container orchestrated and managed by Kubernetes the application is deployed to, the security credential information of the application is also to be stored in the application configuration file corresponding to this Kubernetes, that is, the login credential information ciphertext, key and salt value in the security credential information of an application cannot be stored separately in the application configuration files of different Kubernetes. As combined with the above example, for example, for application A, since it is deployed to the container orchestrated and managed by Kubernetes1, the login credential information ciphertext, key and salt value in the security credential information corresponding to application A must be stored in the application configuration file corresponding to Kubernetes1, and cannot be stored separately in the application configuration files corresponding to other Kubernetes.
[0087] In the above, since a large number of applications are deployed separately to different Kubernetes, and correspondingly, the security credential information of an application is stored in the application configuration file of the corresponding Kubernetes, the security credential information of a large number of applications can be stored in a decentralized manner, so that even if a Kubernetes environment is maliciously attacked, it will not affect the normal operation of applications deployed in other Kubernetes, and since the security credential information of an application (i.e., including the login credential information ciphertext, key and salt value) is stored in the same application configuration file, the security credential information can be called at the same time without lacking data information, thereby achieving fast connection and access to the database.
[0088] Furthermore, the keys and salt values mentioned in the embodiments of the present disclosure are not only randomly and dynamically generated, but also are random strings constructed based on the service identifier and environment identifier of the application. This increases the complexity of the ciphertext of the login credential information. This not only avoids decryption by a single encryption and decryption method or rainbow table, but also achieves targeted encryption for different applications and different usage environments. Therefore, even if the security credential information of a certain application is leaked, it will not affect the normal use of other applications in other environments.
[0089] After the above pre-deployment operation of the application, after an application is started, the corresponding security credential information ciphertext, key and salt value can be obtained from the application configuration file of the container orchestration platform corresponding to the application deployment, and then the preset encryption and decryption tool corresponding to the application can be called to decrypt and obtain the plaintext login credential information.
[0090] 102. Using the key and the salt value, a preset encryption and decryption tool corresponding to the first application is called to perform a decryption operation on the login credential information ciphertext, and obtain the login credential information plaintext corresponding to the login credential information ciphertext.
[0091] The preset encryption and decryption tool is customized and developed for using the local encryption library file of the operating system, so that the ciphertext of the login credential information of the application cannot be decrypted directly by running the code, but needs to be decrypted using the local encryption library of the operating system.
[0092] 103. Access a connection database according to the obtained plain text login credential information corresponding to the first application.
[0093] In the embodiment of the present disclosure, after the application is started, a customized client can automatically execute steps 101-103 to achieve automatic connection to access the database. The embodiment of the present disclosure provides a method of automatically accessing the connection database with a client, which is different from the method of hard-coding security credential information in the program code of the application to achieve access to the connection database. Compared with the method, the latter exposes the security credential information in the coding, which may cause security risks due to information theft. Therefore, the method of accessing the connection database provided by the embodiment of the present disclosure is not only automated and efficient, but also improves security by avoiding the leakage of security credential information.
[0094] As mentioned above, the embodiment of the present disclosure provides an application security credential management method. In the embodiment of the present disclosure, multiple applications are pre-deployed to container environments orchestrated and managed by different container orchestration platforms, and the application configuration file of each container orchestration platform can be used to manage the security credential information of all applications that have a deployment relationship with the container orchestration platform, thereby realizing the decentralized storage management of the security credential information of a large number of applications, and the security credential information includes the login credential information ciphertext, key and salt value. Since the key and salt value are random strings generated based on the service identifier and environment identifier of the application, the complexity of the ciphertext is increased due to the limitation of the service, environment and the salt value. The present disclosure also uses the preset encryption and decryption tools corresponding to the application to realize encryption and decryption, thereby limiting the operating environment of encryption and decryption. All of the above greatly increase the difficulty of malicious acquisition of the login credential information plaintext, thereby ensuring the security of the application security credential information. Compared with the prior art, the problem of security risks caused by the centralized management of the security credential information of the application is solved. The embodiment of the present disclosure adopts application container management and provides a more optimized solution.
[0095] To explain in more detail, the present disclosure also provides another application security credential management method, such as Figure 2 As shown, the method provided by this embodiment of the present disclosure includes at least 201-208, and the embodiment of the present disclosure does not limit the execution order of the scheme steps by numerical numbers.
[0096] 201. Provide an interface or console of a preset salt value management tool, which is used to receive a service identifier, an environment identifier, and plain text login credential information corresponding to a second application, where the plain text login credential information includes a plain text user name and a plain text security credential.
[0097] The service identifier corresponding to the second application may include but is not limited to: the application name, and may also include but is not limited to the version number identifier corresponding to the application. The environment identifier corresponding to the second application is used to indicate the environment in which the application is used, and the environment identifier may include but is not limited to a geographical location identifier.
[0098] The disclosed embodiments provide a user interface or console, such as a drop-down list including service identifiers and environment identifiers, respectively, to prompt the user to fill in the service identifiers and environment identifiers by selecting information; a text input box to prompt the user to enter the login credential information in plain text by entering text information, and the login credential information in plain text includes the user name in plain text and the security credential in plain text.
[0099] 202. Use a preset salt value management tool to process the service identifier and the environment identifier to generate a salt value.
[0100] In security credential science, the salt value is a randomly generated string, but on this basis, the disclosed embodiment uses the service identifier and the environment identifier as the limiting factors for generating the salt value, so that the generated salt value is bundled with a specific service and a specific environment, so that for the same application, the generated salt value is different in different environments. In this way, the complexity of the application's login credential information ciphertext is increased, and even if the login credential information ciphertext of a certain application or a certain environment is maliciously attacked, it will not affect the security of other environments of the application or all environments of other applications.
[0101] 203. Use a preset key management tool to process the service identifier and the environment identifier to generate a key.
[0102] The preset security credential management tool is used to randomly generate keys, and the embodiment of the present disclosure also uses service identifiers and environment identifiers as restriction factors for generating keys, so that the keys used across applications and environments are also different.
[0103] 204. Use the salt value and the key to perform an encryption operation on the login credential information plaintext by calling a preset encryption and decryption tool corresponding to the second application to obtain the login credential information ciphertext corresponding to the login credential information plaintext.
[0104] In the embodiment of the present disclosure, the plain text login credential information includes a plain text username and a plain text password. The process of encrypting the plain text login credential information may include the following: (1)-(3). It should be noted that the embodiment of the present disclosure uses the words "first" and "second" only as identifiers to distinguish different character strings and different ciphertexts.
[0105] (1) Concatenate or confuse the salt value and the plain text of the user name to obtain a first string, and concatenate or confuse the salt value and the plain text of the security credential to obtain a second string.
[0106] (2) Using the key, an encryption operation is performed on the first character string and the second character string by calling a preset encryption and decryption tool corresponding to the application to obtain a first ciphertext corresponding to the first character string and a second ciphertext corresponding to the second character string.
[0107] (3) Obtain the login credential information ciphertext corresponding to the login credential information plaintext according to the first ciphertext and the second ciphertext.
[0108] Exemplarily, in combination with (1)-(3), the encrypt method of the preset encryption and decryption tool is called to pass in the login credential information plaintext {data}, key {password}, and salt value {salt} for encryption. During the encryption process, {data} and {salt} are used to confuse to obtain the first string, and {password} and {salt} are used to confuse to obtain the second string. Then, the key {password} is used and the preset encryption method in the encryption and decryption tool library file encapsulated in the preset encryption and decryption tool is called to perform encryption operations on the first string and the second string respectively, to obtain the first ciphertext corresponding to the first string and the second ciphertext corresponding to the second string, and then the data information is obtained based on the combination of the first ciphertext and the second ciphertext to generate the login credential information ciphertext, which can be expressed as, ciphertext {key} = ciphertext {cipher}.
[0109] If there are multiple variables that need to be encrypted, such as an application that can pre-set multiple login credential information ciphertexts, or multiple applications and each application correspondingly sets one or more login credential information ciphertexts, then multiple equation relationships between ciphertext variables and ciphertext content information such as {keyA}={cipherA}, {keyB}={cipherB}, {keyC}={cipherC}, etc. will be obtained. The embodiment of the present disclosure can call a template tool to generate a secret file corresponding to the service through the secret interface of the container orchestration platform (for example, but not limited to Kubernetes). The secret file can be used as an application configuration file deployed to the Kubernetes, so that different equation relationships and the key and salt value used to obtain an equation relationship (that is, one or more groups of data information used by an application, each group of data information includes a login credential information ciphertext, a key and a salt value) are maintained and stored in the secret file of Kubernetes.
[0110] 205. Pre-deploy the second application to containers orchestrated and managed by different container orchestration platforms, each container orchestration platform correspondingly deploys an application configuration file, the application configuration file is used to store at least: the login credential information ciphertext, key and salt value corresponding to one or more second applications that have a deployment relationship with the container orchestration platform.
[0111] In the embodiment of the present disclosure, the steps of pre-deploying the second application into containers orchestrated and managed by different container orchestration platforms mainly include the following: (21)-(24);
[0112] (21) Add different security level identifiers to at least one second application, where the at least one second application includes the first application.
[0113] (22) Divide at least one second application into at least one group according to preset percentages corresponding to different security level identifiers.
[0114] (23) Each group of second applications is deployed into containers orchestrated and managed by different container orchestration platforms, and each container orchestration platform deploys an application configuration file.
[0115] (24) For any group of second applications, the ciphertext of the login credential information, the key and the salt value corresponding to each second application are stored in the application configuration file.
[0116] Among them, the embodiments of the present disclosure can, but are not limited to, pre-add different security level identifications to different applications based on the privacy level of service data provided by the application, the security level of financial data involved, etc. For example, the security level of payment software is higher than that of game software.
[0117] Then, for these applications, in order to avoid centralized storage of security credential information, the present disclosure deploys them in different Kubernetes container environments in a grouped manner, and does not limit the number of applications in each group, but needs to limit the proportion of the number of different security level identifiers in each group. For example, a numerical range can be limited, such as the highest level of security level identification needs to account for [10%, 15%]. In this way, no matter how many applications are in each group, the applications with the highest security level can be dispersed into different Kubernetes container environments.
[0118] After each group of applications is deployed, the ciphertext, key, and salt value of the login credential information of the group of applications are stored in the corresponding Kubernetes application configuration file, thereby using different Kubernetes application configuration files to achieve decentralized storage of security credential information for a large number of applications.
[0119] The above is an example of a grouping method for implementing distributed storage of applications in an embodiment of the present disclosure. In addition to this method, an embodiment of the present disclosure can further refine the grouping of security credential information of the group of applications in a Kubernetes to implement distributed storage using multiple application configuration files, thereby avoiding the security of the group of applications being affected by a malicious attack on one application configuration file.
[0120] Furthermore, in the process of deploying each group of second applications to containers orchestrated and managed by different container orchestration platforms, where the container orchestration platform may be but is not limited to Kubernetes, the embodiment of the present disclosure also customizes and builds a preset encryption and decryption tool corresponding to each application, which mainly involves the following steps: (31)-(33);
[0121] (31) The second application is packaged into an image (such as a Docker image), and the image is pushed to a container image repository.
[0122] (32) By installing the encryption and decryption tool library file into the image, a preset encryption and decryption tool for performing encryption and decryption operations on the second application is obtained, and the encryption and decryption tool library file encapsulates program codes corresponding to the preset encryption method and the preset decryption method.
[0123] The preset encryption and decryption tool is customized and developed using the local encryption library file of the operating system. In the process of deploying at least one application in the Kubernetes container environment, the embodiment of the present disclosure packages the application into a Docker image, and the Docker image is pushed to the container image repository. By encapsulating the preset encryption function and the preset decryption function, an encryption and decryption tool library file is generated, and then the encryption and decryption file is installed into the Docker image to obtain the preset encryption and decryption tool corresponding to the application.
[0124] Exemplarily, the main development steps involved in the embodiments of the present disclosure include: (41)-(44);
[0125] (41) In the centos7.x environment, use c or c++ to call the libcrypto.so library for encryption and decryption, use a fixed random seed to ensure portability, and the specific algorithm can be selected according to the business, such as EVP_aes_256_cbc, EVP_aes_128_cbc, etc.
[0126] (42), encapsulates the encryption function String encrypt(String data, String password, String salt), which is used to encrypt plain text information.
[0127] (43) Encapsulates the decryption function String decrypt(String ciphered, String password, String salt) to decrypt the ciphertext information.
[0128] (44) Generate jni header file .h and dynamic library .so, and install the dynamic library to the base image system library directory, such as / usr / lib64.
[0129] For example, (41)-(44) requires the preset encryption and decryption tool to call the local encryption library of the operating system in order to encrypt the plaintext login credential information of the application and decrypt the ciphertext login credential information.
[0130] 206. After the first application is started, read the login credential information ciphertext, key, and salt value corresponding to the first application from the application configuration files corresponding to at least one container orchestration platform.
[0131] Each container orchestration platform deploys an application configuration file, and the key and salt value are random strings generated based on the service identifier of the application and the environment identifier where the application is located. In the embodiment of the present disclosure, the explanation of 206 can be found in 101, which will not be repeated here.
[0132] 207. Using the key and the salt value, perform a decryption operation on the login credential information ciphertext by calling a preset encryption and decryption tool corresponding to the first application to obtain the login credential information plaintext corresponding to the login credential information ciphertext.
[0133] In the embodiment of the present disclosure, the process of performing decryption on the ciphertext of the login credential information may include the following:
[0134] (51) Determine the encryption and decryption tool library file corresponding to the preset encryption and decryption tool.
[0135] (52) Call the preset decryption method encapsulated in the encryption and decryption tool library file to perform a decryption operation on the ciphertext of the login credential information.
[0136] (53), based on the key, decryption obtains the string information containing the salt value.
[0137] (54) Delete the salt value from the string information and decrypt to obtain the plain text of the login credential information corresponding to the cipher text of the login credential information.
[0138] As shown in (51)-(54), since the embodiment of the present disclosure uses a salt value and a key to perform an encryption operation on the ciphertext of the login credential information, the corresponding decryption operation is equivalent to including key decryption and salt value decryption, that is, using the key to decrypt and using the salt value to restore the plaintext of the login credential information.
[0139] 208. Access a connection database according to the obtained plain text login credential information corresponding to the first application.
[0140] In order to more clearly illustrate 201-208 above, the embodiments of the present disclosure provide the following examples for explanation.
[0141] (61) Taking the database user name and security credentials as an example, set them in the application configuration file:
[0142] 1.spring.datasource.username=ENC(db-username)
[0143] 2.spring.datasource.password=ENC(db-password)
[0144] (62) Use the interface provided by the preset salt value management tool to input the service ID and environment ID of the application, as well as the plain text {db-username} corresponding to db-username and {db-password} corresponding to db-password.
[0145] (63), using the data information input by the preset salt value management tool and the randomly generated salt value as parameters, calling the preset key management tool to generate the ciphertext of the login credential information, the encrypted variable information obtained includes:
[0146] data.db-username=cipher{db-username}
[0147] data.db-password=cipher{db-password}
[0148] Store the salt value, key, and login credential information in ciphertext in Kubernetes secret.
[0149] (64) The application publishing system is built using a Docker base image that includes encryption and decryption tool library files to generate an application image file. The application publishing system references the environment variables in the deployment through secrets.
[0150] (65) After the Springboot application is started, the database connection pool can obtain the database username and password through client-defined decryption to establish a connection for access.
[0151] As the above Figure 1 , Figure 2 The embodiment of the present disclosure provides an application security credential management device. The device embodiment corresponds to the aforementioned method embodiment. For ease of reading, the device embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. The device is used to provide security of application security credentials, specifically as follows Figure 3 As shown, the device comprises:
[0152] The reading unit 31 is used to read the login credential information ciphertext, key and salt value corresponding to the first application from the application configuration files corresponding to at least one container orchestration platform after the first application is started; wherein each container orchestration platform deploys an application configuration file correspondingly, and the key and the salt value are respectively random strings generated based on the service identifier of the first application and the environment identifier where the first application is located;
[0153] A decryption unit 32, configured to use the key and the salt value to perform a decryption operation on the login credential information ciphertext by calling a preset encryption and decryption tool corresponding to the first application, so as to obtain a login credential information plaintext corresponding to the login credential information ciphertext;
[0154] The access connection unit 33 is used to connect and access the database according to the plain text of the login credential information.
[0155] Further, such as Figure 4 As shown, before the first application is started, the device further includes:
[0156] An adding unit 34, configured to add a different security level identifier to at least one second application, wherein the at least one second application includes the first application;
[0157] A division unit 35, configured to divide the at least one second application into at least one group according to preset percentages corresponding to different security level identifiers;
[0158] A deployment unit 36, configured to deploy each group of the second applications into containers orchestrated and managed by different container orchestration platforms, each of the container orchestration platforms correspondingly deploying an application configuration file;
[0159] The storage unit 37 is used to store the login credential information ciphertext, key and salt value corresponding to each second application in the application configuration file for any group of second applications.
[0160] Further, such as Figure 4 As shown, in the process of deploying each group of the second applications to containers orchestrated and managed by different container orchestration platforms, the deployment unit 36 further includes:
[0161] A packaging module 361 is used to package the second application into an image, and the image is pushed to a container image repository;
[0162] A module 362 is provided for obtaining a preset encryption and decryption tool for performing encryption and decryption operations on the second application by installing an encryption and decryption tool library file into the image, wherein the encryption and decryption tool library file encapsulates program codes corresponding to preset encryption methods and preset decryption methods.
[0163] Further, such as Figure 4 As shown, for any group of second applications, before storing the ciphertext of login credential information, key and salt value corresponding to each second application in the application configuration file, the device further includes:
[0164] A providing unit 38 is used to provide an interface or a console of a preset salt value management tool, and is used to receive a service identifier, an environment identifier, and a plain text login credential information corresponding to the second application, wherein the plain text login credential information includes a plain text user name and a plain text password;
[0165] The encryption unit 39 is used to process the service identifier and the environment identifier by using the preset salt value management tool to generate a salt value;
[0166] The encryption unit 39 is further used to process the service identifier and the environment identifier using a preset key management tool to generate a key;
[0167] The encryption unit 39 is further used to use the salt value and the key to perform an encryption operation on the login credential information plaintext by calling the preset encryption and decryption tool corresponding to the second application to obtain the login credential information ciphertext corresponding to the login credential information plaintext.
[0168] Further, such as Figure 4 As shown, the encryption unit 39 includes:
[0169] The obfuscation module 391 is used to obfuscate the salt value and the plain text of the user name to obtain a first character string;
[0170] The obfuscation module 391 is further used to obfuscate the salt value and the password plain text to obtain a second character string;
[0171] An encryption module 392 is used to use the key to perform an encryption operation on the first character string and the second character string by calling a preset encryption and decryption tool corresponding to the application to obtain a first ciphertext corresponding to the first character string and a second ciphertext corresponding to the second character string;
[0172] The combining module 393 is used to obtain the login credential information ciphertext corresponding to the login credential information plaintext according to the first ciphertext and the second ciphertext.
[0173] Further, such as Figure 4 As shown, the decryption unit 32 includes:
[0174] A determination module 321, used to determine the encryption and decryption tool library file corresponding to the preset encryption and decryption tool;
[0175] A calling module 322 is used to call the preset decryption method encapsulated in the encryption and decryption tool library file to perform a decryption operation on the ciphertext of the login credential information;
[0176] The decryption module 323 is further used to decrypt the string information containing the salt value based on the key;
[0177] The decryption module 323 is further configured to delete the salt value from the string information, and decrypt to obtain the login credential information plaintext corresponding to the login credential information ciphertext.
[0178] The application security credential management device includes a processor and a memory. The above-mentioned reading unit, decryption unit and access connection unit are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.
[0179] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and by adjusting kernel parameters to utilize application containerization management, a more optimized solution is provided to ensure the security of application security credentials.
[0180] The embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned application security credential management method is implemented.
[0181] The present disclosure also provides an electronic device, such as Figure 5 As shown, the device includes at least one processor 41, and at least one memory 42 and a bus 43 connected to the processor 41; wherein the processor 41 and the memory 42 communicate with each other through the bus 43; the processor 41 is used to call the program instructions in the memory 42 to execute the above-mentioned application security credential management method.
[0182] The embodiment of the present disclosure also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the steps of the above application security credential management method.
[0183] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0184] In a typical configuration, the device includes one or more processors (CPU), memory and bus. The device may also include input / output interface, network interface and the like.
[0185] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.
[0186] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.
[0187] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.
[0188] It will be appreciated by those skilled in the art that the embodiments of the present disclosure may be provided as methods, systems or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0189] The above are only embodiments of the present disclosure and are not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the scope of the claims of the present disclosure.
Claims
1. A method for managing application security credentials, characterized in that: The method comprises: After the first application is started, the login credential information ciphertext, key, and salt value corresponding to the first application are read from the application configuration files corresponding to at least one container orchestration platform; wherein each container orchestration platform deploys an application configuration file correspondingly, and the key and the salt value are random strings generated based on the service identifier of the first application and the environment identifier where the first application is located; Using the key and the salt value, a preset encryption and decryption tool corresponding to the first application is called to perform a decryption operation on the login credential information ciphertext, so as to obtain a login credential information plaintext corresponding to the login credential information ciphertext; Connect and access the database according to the plain text of the login credential information.
2. The method according to claim 1, characterized in that Before the first application is started, the method further includes: adding a different security level identifier to at least one second application, the at least one second application including the first application; Dividing the at least one second application into at least one group according to preset percentages corresponding to different security level identifiers; Deploy each group of the second applications into containers orchestrated and managed by different container orchestration platforms, where each container orchestration platform correspondingly deploys an application configuration file; For any group of second applications, the login credential information ciphertext, key and salt value corresponding to each of the second applications are stored in the application configuration file.
3. The method according to claim 2, characterized in that In the process of deploying each group of the second applications to containers orchestrated and managed by different container orchestration platforms, the method further includes: Packaging the second application into an image, and pushing the image to a container image repository; By installing the encryption and decryption tool library file into the image, a preset encryption and decryption tool for performing encryption and decryption operations on the second application is obtained, and the encryption and decryption tool library file encapsulates program codes corresponding to the preset encryption method and the preset decryption method.
4. The method according to claim 2, characterized in that: For any group of second applications, before storing the ciphertext of login credential information, the key and the salt value corresponding to each of the second applications in the application configuration file, the method further includes: Providing an interface or console of a preset salt value management tool, for receiving input of a service identifier, an environment identifier, and plain text login credential information corresponding to the second application, wherein the plain text login credential information includes a plain text user name and a plain text password; Using the preset salt value management tool to process the service identifier and the environment identifier to generate a salt value; Using a preset key management tool to process the service identifier and the environment identifier to generate a key; The salt value and the key are used to perform an encryption operation on the login credential information plaintext by calling the preset encryption and decryption tool corresponding to the second application to obtain the login credential information ciphertext corresponding to the login credential information plaintext.
5. The method according to claim 4, characterized in that The method of using the salt value and the key to perform an encryption operation on the login credential information plaintext by calling the preset encryption and decryption tool corresponding to the second application to obtain the login credential information ciphertext corresponding to the login credential information plaintext includes: Obfuscate the salt value and the plain text of the user name to obtain a first character string; Obfuscating the salt value and the password plaintext to obtain a second character string; Using the key, performing encryption operations on the first character string and the second character string by calling a preset encryption and decryption tool corresponding to the application, to obtain a first ciphertext corresponding to the first character string and a second ciphertext corresponding to the second character string; A login credential information ciphertext corresponding to the login credential information plaintext is obtained according to the first ciphertext and the second ciphertext.
6. The method according to claim 5, characterized in that The method of using the key and the salt value to perform a decryption operation on the login credential information ciphertext by calling the preset encryption and decryption tool corresponding to the first application to obtain the login credential information plaintext corresponding to the login credential information ciphertext includes: Determine the encryption and decryption tool library file corresponding to the preset encryption and decryption tool; Calling the preset decryption method encapsulated in the encryption and decryption tool library file to perform a decryption operation on the ciphertext of the login credential information; Based on the key, decrypt to obtain the string information containing the salt value; The salt value is deleted from the string information, and the login credential information plain text corresponding to the login credential information cipher text is obtained by decryption.
7. An application security credential management device, characterized in that: The device comprises: A reading unit is used to read the login credential information ciphertext, key and salt value corresponding to the first application from the application configuration files corresponding to at least one container orchestration platform after the first application is started; wherein each container orchestration platform deploys an application configuration file correspondingly, and the key and the salt value are respectively random strings generated based on the service identifier of the first application and the environment identifier where the first application is located; a decryption unit, configured to use the key and the salt value to perform a decryption operation on the login credential information ciphertext by calling a preset encryption and decryption tool corresponding to the first application, so as to obtain a login credential information plaintext corresponding to the login credential information ciphertext; The access connection unit is used to connect and access the database according to the plain text of the login credential information.
8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the application security credential management method according to any one of claims 1 to 6 is implemented.
9. An electronic device, characterized in that: The device includes at least one processor, and at least one memory and a bus connected to the processor; Wherein, the processor and the memory communicate with each other through the bus; The processor is used to call the program instructions in the memory to execute the application security credential management method according to any one of claims 1 to 6.
10. A computer program product, characterized in that The method comprises a computer program / instruction, and when the computer program / instruction is executed by a processor, the method for managing application security credentials according to any one of claims 1 to 6 is implemented.