Istio-based zero-trust cloud native network method

Abstract

The invention relates to an Istio-based zero-trust cloud native network method. The method comprises the following steps: generating specific digital certificates subjected to signature authentication for entities in a cloud native environment; the cluster node closes all gateway flows by default and configures related access strategies; an Istio service component is used for acting on each Service Workload of the cloud native network; the workloads in the cloud native network are in bidirectional mTLS encryption communication with one another; an access strategy based on Istio is created, and an authorization strategy and other security configurations are distributed to a side vehicle assembly of the Workload through Pilot of the control center; a zero-trust cloud native network is established according to bidirectional mTLS encryption communication based on a specific digital certificate and a given Istio network strategy. According to the Istio-based zero-trust cloud native network method provided by the invention, the security and robustness of the cloud native network can be effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud native network technology of cloud computing, and in particular to an Istio-based zero-trust cloud native network method. Background Art

[0002] Istio is an open source service mesh built on top of Kubernetes. It provides an easy way to manage distributed services, providing traffic management, load balancing, security metrics and other functions. It provides a high degree of visibility and control for communication between services, providing better management capabilities for developers and operators. In Istio, administrators can configure which services can communicate with each other and what kind of identity authentication and authentication mechanisms to use. Istio supports transport layer security, A / B testing, traffic management and grayscale release, and integrates seamlessly with Kubernetes.

[0003] Zero Trust Network is a security paradigm that does not grant implicit trust to users, devices, and services, and continuously verifies their identities and authorization to access resources. Zero Trust Network believes that the Internet is untrusted and that each request needs to be protected, rather than focusing on the perimeter, that is, the boundary between the enterprise intranet and the extranet. In the security model of Zero Trust Network, each service is an untrusted subject, and requests must be protected through identity authentication, stateless authentication, data encryption, and other measures.

[0004] With the development of cloud-native technologies, more and more enterprises are migrating applications and services to the cloud, and the network security required by these applications and services is also urgently needed to be improved. The traditional network security model is usually implemented by "perimeter", but this model can no longer meet the security needs of modern applications. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a zero-trust cloud native network method based on Istio, complete two-way mTLS encrypted communication based on a digital certificate with a specific signature, and combine Istio related components and network policies to improve the security of cloud native networks.

[0006] To achieve the above object, the present invention adopts the following technical solution: a zero-trust cloud native network method based on Istio, comprising the following steps: Step S01: Generate a signed and authenticated digital certificate for each entity in the cloud native environment; Step S02: The cluster node closes all ingress and egress traffic by default and configures relevant access policies; Step S03: Use the Istio service component to proxy each Service Workload of the cloud native network; Step S04: Mutual mTLS encrypted communication is used between each workload in the cloud native network; Step S05: Create an Istio-based access policy and distribute the authorization policy and other security configurations to the sidecar component of the workload through the Pilot in the control center; Step S06: Establish a zero-trust cloud native network based on two-way mTLS encrypted communication based on specific digital certificates and a given Istio network policy.

[0007] In a preferred embodiment, in step S01, a PKI public key infrastructure is used to issue signed digital certificates to each entity in the cloud native network, providing trusted identity authentication for each entity, and only authorized entities can access the cloud native network.

[0008] In a preferred embodiment, in step S02, a cloud native network plug-in such as Calico is used to provide a network node access policy at the L3~L4 level based on the OSI seven-layer reference model.

[0009] In a preferred embodiment, in step S02, all ingress and egress access traffic of each cluster node of the cloud native network is controlled through an access policy based on a specific network plug-in, and all unauthenticated access traffic is intercepted to ensure the security and controllability of the workload within the cloud native network cluster.

[0010] In a preferred embodiment, in step S03, each Service Workload in the cloud native network is encapsulated through Istio service-related components, the traffic in the default entrance and exit of each Service is closed, and a network node access policy at the L4~L7 level based on the OSI seven-layer reference model is provided.

[0011] In a preferred embodiment, in step S04, each workload in the cloud native network uses two-way mTLS encrypted communication based on the digital certificate issued in step S01, thereby ensuring the credibility of each entity in the network.

[0012] In a preferred embodiment, in step S05, an Istio-based access control policy is adopted, and the authorization policy and other security configurations are distributed to the sidecar component of the workload through the Pilot of the control center, providing L4~L7 level access control based on the OSI seven-layer reference model for the workload in the cloud native network.

[0013] The present invention also provides a system based on the Istio zero-trust cloud native network method, which runs the Istio zero-trust cloud native network method.

[0014] The present invention also provides a computer device, comprising: A processor, a memory and a bus, the memory storing machine-readable instructions executed by the processor; When the computer device is running, the processor communicates with the memory through a bus, and when the machine-readable instructions are executed by the processor, a zero-trust cloud native network method based on Istio is performed as described.

[0015] The present invention also provides a computer-readable storage medium, comprising: The computer readable storage medium has a computer program stored thereon; The computer program is executed by the processor when it is running as described in a zero-trust cloud native network method based on Istio.

[0016] Compared with the prior art, the present invention has the following beneficial effects: the present invention completes two-way mTLS encrypted communication based on a digital certificate with a specific signature, combines Istio-related components and network policies, provides a more flexible access control strategy at the L3~L7 level based on the OSI seven-layer reference model, and improves the security and robustness of cloud-native networks.

[0017] The present invention combines cloud native network plug-ins and Istio related components to create specific network policies and provide more flexible access control policies at the L3~L7 level based on the OSI seven-layer reference model. The present invention increases user identity authentication through the PKI public key facility mechanism.

[0018] The novelty of this system lies in: the present invention supports national encryption algorithms and enhances identity authentication through digital certificates with specific signatures, and combines cloud-native network plug-ins and Istio-related components and network policies to provide more flexible access control strategies at the L3~L7 levels based on the OSI seven-layer reference model. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 Flowchart of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0020] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0021] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0022] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0023] like Figure 1 As shown, this embodiment is a zero-trust cloud native network method based on Istio, including the following steps: Step S01: Generate a signed and authenticated digital certificate for each entity in the cloud native environment; Step S02: The cluster node closes all ingress and egress traffic by default and configures relevant access policies; Step S03: Use the Istio service component to proxy each ServiceWorkload of the cloud native network; Step S04: Mutual mTLS encrypted communication is used between each workload in the cloud native network; Step S05: Create an Istio-based access policy and distribute the authorization policy and other security configurations to the sidecar component of the workload through the Pilot in the control center; Step S06: Establish a zero-trust cloud native network based on two-way mTLS encrypted communication based on specific digital certificates and a given Istio network policy.

[0024] In this embodiment, the signed and authenticated digital certificate generated in step S01 provides reliable identity authentication for entities in the cloud-native network, ensures the confidentiality and integrity of communications, and supports multiple digital signature algorithms, such as the national secret algorithm.

[0025] In this embodiment, the S02 step provides L3~L4 level network node access policies based on the OSI seven-layer reference model based on a cloud-native network plug-in such as Calico. The cluster nodes close all ingress and egress traffic by default and configure relevant access policies.

[0026] In this embodiment, the S03 step encapsulates each Service Workload in the cloud native network through Istio service-related components, closes the traffic in the default entrance and exit of each Service, and provides L4~L7 level network node access strategy based on the OSI seven-layer reference model.

[0027] In this embodiment, in step S04, each workload in the cloud native network uses two-way mTLS encrypted communication based on the digital certificate issued in step S01, thereby ensuring the credibility of each entity in the network.

[0028] In this embodiment, the S05 step adopts an Istio-based access control policy, and distributes the authorization policy and other security configurations to the sidecar component of the workload through the Pilot of the control center, thereby providing L4~L7 level access control based on the OSI seven-layer reference model for the workload in the cloud native network.

[0029] In this embodiment, two-way mTLS encrypted communication is completed based on a digital certificate with a specific signature, and Istio-related components and network policies are combined to improve the security of the cloud-native network.

[0030] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0031] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0032] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0033] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0034] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

[0035] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions do not exceed the scope of the technical solution of the present invention, belong to the protection scope of the present invention.

Claims

1. A zero-trust cloud native network method based on Istio, characterized in that: The steps include: Step S01: Generate a signed and authenticated digital certificate for each entity in the cloud native environment; Step S02: The cluster node closes all ingress and egress traffic by default and configures relevant access policies; Step S03: Use the Istio service component to proxy each Service Workload of the cloud native network; Step S04: Mutual mTLS encrypted communication is used between each workload in the cloud native network; Step S05: Create an Istio-based access policy and distribute the authorization policy and other security configurations to the sidecar component of the workload through the Pilot in the control center; Step S06: Establish a zero-trust cloud native network based on two-way mTLS encrypted communication based on specific digital certificates and a given Istio network policy.

2. According to claim 1, a zero-trust cloud native network method based on Istio is characterized in that: In step S01, the PKI public key infrastructure is used to issue signed digital certificates to each entity in the cloud native network, providing trusted identity authentication for each entity. Only authorized entities can access the cloud native network.

3. According to claim 1, a zero-trust cloud native network method based on Istio is characterized in that: In step S02, a cloud native network plug-in such as Calico is used to provide a network node access policy at the L3~L4 level based on the OSI seven-layer reference model.

4. According to claim 1, a zero-trust cloud native network method based on Istio is characterized in that: In step S02, all ingress and egress access traffic of each cluster node of the cloud native network is controlled through an access policy based on a specific network plug-in, and all unauthenticated access traffic is intercepted to ensure the security and controllability of the workload within the cloud native network cluster.

5. According to claim 1, a zero-trust cloud native network method based on Istio is characterized in that: In step S03, each Service Workload in the cloud native network is encapsulated through Istio service-related components, the traffic in the default entrance and exit of each Service is closed, and the L4~L7 level network node access policy based on the OSI seven-layer reference model is provided.

6. According to claim 1, a method for zero-trust cloud native network based on Istio is characterized in that: In step S04, each workload in the cloud native network uses two-way mTLS encrypted communication based on the digital certificate issued in step S01, ensuring the credibility of each entity in the network.

7. According to claim 1, a zero-trust cloud native network method based on Istio is characterized in that: In step S05, an Istio-based access control policy is adopted, and the authorization policy and other security configurations are distributed to the sidecar component of the workload through the Pilot of the control center, providing L4~L7 level access control based on the OSI seven-layer reference model for the workload in the cloud native network.

8. A system based on Istio zero-trust cloud native network method, characterized in that: Run an Istio-based zero-trust cloud native network method as described in any one of claims 1-7 above.

9. A computer device, characterized in that: include: A processor, a memory and a bus, the memory storing machine-readable instructions executed by the processor; When the computer device is running, the processor communicates with the memory through a bus, and when the machine-readable instructions are executed by the processor, an Istio-based zero-trust cloud native network method is performed as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: include: The computer readable storage medium has a computer program stored thereon; When the computer program is executed by a processor, an Istio-based zero-trust cloud native network method as described in any one of claims 1 to 7 is executed.

Images