A zero-trust management method for edge computing application service operation security

Abstract

The present invention proposes a method for zero-trust management of the operation security of edge computing application services, comprising the following steps: Step 1, designing digital signature rules; Step 2, generating a partial digital signature PDS according to the edge computing application service operation environment and the digital signature rules; Step 3, the management node in the edge computing application service operation environment uses the partial digital signature PDS to initiate a service deployment request verification to the edge computing node; Step 4, after completing the verification, the management node generates a complete digital signature FDS and sends a service image package to the edge computing node; Step 5, the edge computing node deploys the service and performs service monitoring through the obtained image package, thereby realizing the zero-trust management of the operation security of the edge computing application service.

Description

Technical Field

[0001] The present invention relates to an application service operation management method, and in particular to an edge computing power application service operation security zero-trust management method. Background Art

[0002] This section merely provides background information related to the present disclosure and is not necessarily prior art.

[0003] With the rapid development and widespread application of the Internet of Things, big data, and 5G networks, network data is gradually becoming more marginalized and cross-regional. Traditional cloud computing cannot handle the massive data generated by network edge devices. Therefore, edge computing has emerged. Traditional edge computing computing services are based on data centers, connecting large, medium, and small edge centers to the central center for unified management and scheduling. As computing power demand increases, traditional

[0004] Data centers are no longer sufficient. Computing services are no longer limited to data centers, but have been extended to any public facility where power supply and network access are available.

[0005] However, since edge computing provides intelligent services at the edge of the Internet of Things close to physical devices or data sources, and has open features such as edgeization, mobility, distribution, virtualization, resource dynamics, content awareness, real-time computing, and parallel processing, but it cannot provide trusted, controllable, and available storage and computing services, the data security and privacy issues that already exist in the cloud computing environment have become more prominent.

[0006] In the current edge computing cloud solution, people are more focused on solving the data transmission security of the central node and the edge node. Internet and IoT experts have given various measures such as network authorization, authentication, data encryption and decryption from the network transmission level. For example, static identity authentication for network access, dynamic password authentication during link establishment, encryption during data transmission, and decryption after receiving data; while the security issues of the edge node running independently are ignored. Due to historical reasons, the construction of edge infrastructure cannot match the security specifications of the data room in terms of security, so the edge room or computing power providing node facilities may face the risk of being considered stolen, stolen, or destroyed. The edge computing server is directly contacted and accessed, or directly accessed through other interconnected edge nodes, which damages and impacts the running resources of the edge node.

[0007] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0008] Purpose of the invention: The technical problem to be solved by the present invention is to provide a zero-trust management method for the operation security of edge computing application services in response to the shortcomings of the prior art.

[0009] In order to solve the above technical problems, the present invention discloses a method for managing the operation security of edge computing application services with zero trust, comprising the following steps:

[0010] Step 1, design digital signature rules;

[0011] Step 2: Generate a partial digital signature PDS according to the edge computing application service operating environment and digital signature rules;

[0012] Step 3: The management node in the edge computing application service running environment uses the partial digital signature PDS to initiate a service deployment request verification to the edge computing node;

[0013] Step 4: After verification, the management node generates a complete digital signature FDS and sends the service image package to the edge computing node;

[0014] In step 5, the edge computing node deploys services and monitors services through the obtained image package to achieve zero-trust management of the operation security of the edge computing application service.

[0015] Furthermore, the digital signature described in step 1 includes:

[0016] Management node private key, management node IP and port range, edge computing node public key, edge computing node IP and port number, application system ID, image name, service identification code and service name.

[0017] Furthermore, the step 2 of generating the partial digital signature PDS includes:

[0018] Step 2-1, generate a management node private key. When the management node is built, generate a management node private key based on the customer ID of the management node and the regional code of the provincial tower branch to which the customer belongs;

[0019] Step 2-2: Generate the management node IP and port range and edge computing node IP and port number by manual configuration;

[0020] Step 2-3, edge computing node public key, when the edge computing node is built, the edge computing node public key is generated according to the customer ID of the edge computing node and the regional code of the provincial tower branch to which the customer belongs;

[0021] Step 2-4: The management node generates an application system ID when the application system is created, which is used to isolate data from different application systems;

[0022] Step 2-5, set the image name, service identifier, and service name to empty.

[0023] Furthermore, the service deployment request verification initiated to the edge computing node in step 3 includes:

[0024] Step 3-1: The management node initiates a service deployment request to the target edge computing node based on the edge computing node list generated when the application system is created, and sends a partial digital signature PDS of the service to be deployed;

[0025] Step 3-2: After receiving the service deployment request, the edge computing node parses the received partial digital signature PDS and makes a judgment. If the management node private key or management node IP and port range in the partial digital signature PDS are incorrect, the message is discarded and the service deployment is terminated; if only the application system id is incorrect, an error code is returned; if all information in the partial digital signature PDS is verified, the request is returned successful.

[0026] Furthermore, the generation of the complete digital signature FDS described in step 4 includes:

[0027] The management node randomly generates a service ID for the service to be deployed, obtains the image name, service name, and number of service copies, and generates a service identification code based on the encrypted information.

[0028] The image name, service identification code and service name are set in the partial digital signature PDS of the service to be deployed to obtain the complete digital signature FDS.

[0029] Furthermore, sending the service image package to the edge computing node in step 4 includes:

[0030] Step 4-1: The management node sends the service image package to the target edge computing node and verifies it using the complete digital signature FDS;

[0031] Step 4-2: The edge computing node verifies the image package name. If the verification passes, step 4-3 is executed. Otherwise, an error message is returned.

[0032] Step 4-3, verify the service identification code. If the service contained in the image package is not deployed in the current edge computing node, deploy it and return the service identification code and deployment result. Otherwise, upgrade the service and return the upgrade result.

[0033] Furthermore, the service monitoring described in step 5 includes:

[0034] The edge computing node periodically scans the services running in the node and verifies the digital signatures of the image packages of all services. If there is no digital signature or the digital signature is incorrect, the service is stopped immediately and an alarm message is sent to the management node.

[0035] Furthermore, the management node private key includes private data characteristics of the management node.

[0036] Furthermore, the edge computing node public key includes private data characteristics of the edge computing node.

[0037] Furthermore, the management node IP and port range and the edge computing node IP and port number are used for the network connection between the management node and the edge computing node.

[0038] Beneficial effects:

[0039] The present invention focuses on the operating environment security when edge computing nodes provide computing services, ensuring that the business services run by edge computing nodes are controllable and manageable. On the one hand, it provides a security supplement for the damage caused by network transmission security, and on the other hand, it ensures that the resources of edge computing nodes will not be occupied maliciously. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments, and the above and / or other advantages of the present invention will become more clear.

[0041] Figure 1 This is a diagram of a digital signature.

[0042] Figure 2 The diagram is a schematic diagram of a scenario of an embodiment.

[0043] Figure 3 It is a schematic diagram of the overall process of the present invention.

[0044] Figure 4 This is a schematic diagram of the edge computing node service deployment process. DETAILED DESCRIPTION

[0045] In order to ensure the safe operation of application systems running in the tower base station edge computing system, a set of methods is needed to identify the services running on the edge nodes and control resource usage. The environment can be restored when the edge node operating environment is maliciously used to ensure the safe operation of edge computing node services.

[0046] The present invention provides a zero-trust management method for the operation security of edge computing application services, so as to solve the problem that resources are divided and the operation environment is destroyed due to network attacks or illegal access on the edge computing nodes of tower base stations.

[0047] This method is completed by the cooperation of two modules: service digital signature management of management node and digital signature monitoring management of edge node; Figure 3 As shown in the figure, when the customer deploys the service through the management node, the service obtains a digital signature after verification, and the service image is designated to be sent to a certain edge computing node. When the edge computing node receives the image, it first verifies the electronic signature of the image, and only runs the image after the verification passes. At the same time, the monitoring service resident on the edge computing node monitors the service running on the node in real time, and determines whether the service is legal based on the electronic signature information of the service running image. If it is illegal, the service operation is terminated.

[0048] A zero-trust management method for edge computing application service operation security provided by the present invention involves the production and distribution management of service image digital signatures of management nodes, and image verification and monitoring of edge nodes.

[0049] This method does not include the algorithm for generating the public key and private key of the digital signature. It only includes the public key generation rules.

[0050] The prerequisites relied on by this method include the tower computing network management node, edge computing node asset code and the provincial administrative code of the tower company.

[0051] The execution process and content of this method are as follows:

[0052] S1; Description of digital signature composition rules

[0053] The digital signature of a complete image is 56 bytes long and has the following data format: the service name string and other fields are hexadecimal data. The signature includes fields such as Figure 1 As shown, specifically including:

[0054] Management node private key (4 bytes), management node IP and port range (6 bytes), edge computing node public key (4 bytes), edge computing node IP and port number (6 bytes), application system id (8 bytes), image name (4 bytes), service identification code (8 bytes), service name (16 bytes)

[0055] like Figure 4 As shown in the figure, digital signatures are required twice during service deployment. The first time is for deployment request verification, using the first 5 segments of the digital signature, with the image name and service identifier left blank, referred to as PDS (partial digital signature). The second time is when sending the image package, using the full digital signature as an input parameter, referred to as FDS (full digital signature).

[0056] S2: Pre-generated data

[0057] S2-1: Management node private key. When the management node is built, the management node asset code is generated as the management node private key based on the customer ID of the management node and the regional code of the provincial tower branch to which the customer belongs. The code is stored in the management node and synchronized to the edge node when the edge computing node is managed.

[0058] S2-2: Management node IP address and port range, generated by manual configuration, used for network connection between management node and edge computing node.

[0059] S2-3: Edge computing node public key. When the edge computing node is built, the edge computing node asset code is generated as the edge computing node public key based on the node's customer ID and the customer's provincial tower branch's location code. After the target edge computing node is managed, the edge computing node public key is stored in the management node and the edge computing node respectively.

[0060] S2-4: IP address and port number of edge computing node, generated by manual configuration, used for communication with the management node, usually unchanged.

[0061] S2-5: Application system ID, generated when the application system is created, used to isolate different application system data. This information is stored in the management node when it is created. The management node distributes the application system ID to the target edge computing node based on the computing node list when the application system is created. The edge computing node stores the application system ID after receiving it.

[0062] S3: Upload the image package to the management node and generate the image package CRC check code. After the user uploads the image package, read the image package name, perform CRC check on the image package, generate a 4-byte CRC value, and store the data in the database.

[0063] The image package includes services that need to be deployed on the computing power node.

[0064] S4: Management node initiates service deployment

[0065] S4-1: After the user submits the service deployment instruction, the management node randomly generates the service ID, 8 bytes, and reads the service name in the deployment orchestration information. Record the service identification code, service name, and number of service replicas;

[0066] S4-2: Generate the digital signature PDS of the service to be deployed according to the digital signature rules designed in S1

[0067] S4-3: The management node applies to the edge computing node for service deployment and issues a digital signature PDS for the service to be deployed;

[0068] S4-3-1: After receiving the deployment request, the edge computing node parses the received digital signature, verifies the management node private key, management node IP and port range, and application system ID;

[0069] S4-3-1-1: If the management node private key or management node IP and port range are incorrect, the message is discarded and the service deployment ends;

[0070] S4-3-1-2: If only the application system id is wrong, an error code is returned;

[0071] S4-3-1-3: If all information verification passes, the request is returned as successful;

[0072] S4-3-2: The management node sends the image package. The FDS used when sending the image package

[0073] S4-3-3: The edge computing node verifies the PDS part. If it passes, it goes to S4-3-3-1. If it fails, it discards the message and ends the service deployment.

[0074] S4-3-3-1: Verify the image package name. If the verification passes, continue to verify the service identification code. If the service is not deployed on the edge computing node, the service identification code and deployment result will be returned after deployment. If the service identification code already exists on the platform, it means that the service is upgraded, and the deployment result will be returned; the service identification code is generated after the service is deployed on the computing platform, and one service corresponds to a globally unique service identification code;

[0075] S4-3-3-2: Image package name verification failed, and the image package name error is returned;

[0076] S5: Edge computing node service monitoring.

[0077] The edge computing node periodically scans the services running on the node and verifies the digital signatures of the image packages of all services. If the image package running the service has no signature or the signature is incorrect, the service is stopped immediately and an alarm message is sent to the management node.

[0078] Example:

[0079] The present invention takes a specific implementation scenario as an example, and the process of a computing power service security zero-information management method is as follows:

[0080] Scene description, such as Figure 2 As shown in the figure, a provincial branch of China Tower has established a management node in a data center in a certain city, and established edge computing nodes in multiple China Tower base stations in the urban area to provide computing services to customers. Now it is necessary to deploy a large application system with a total of 30 services, which need to be deployed in containers, of which 10 services need to be deployed in multiple copies.

[0081] S1: Generate digital signature

[0082] S1-1: Management nodes manage edge computing nodes

[0083] S1-1-1: The management node IP segment is 10.122.2.255, the port range is 30000-30999, the connection addresses of the node and the three edge computing nodes are 10.122.2.114:30305 (0x0A7A02737661), 10.122.2.116:30130 (0x0A7A027475b2), 10.122.2.115:30238 (0x0A7A0273761E), the converted node public key is 0x FC01,

[0084] S1-1-2: Edge computing nodes are managed.

[0085] Node A, IP address 10.101.12.23:50223 Public key: EC2

[0086] Node B, IP address 10.101.13.23:50118, public key 1FC7

[0087] Node C: IP address 10.101.14.23:50522, public key A809

[0088] S1-2: Create application system Application A on the management node and generate application system id 0x FF93361B

[0089] Digital signature of edge computing node A: FC010A7A02737661 EC220A650C17C42FFF93361BB Digital signature of edge computing node: FC010A7A027475b21FC70A650D171FC7FF93361BC Digital signature of edge computing node: FC010A7A0273761E A8090A650E17c55a FF93361BS1-3-4: Broadcast the application system name "applicationA" to all edge computing nodes;

[0090] S1-3-5: All edge computing nodes receive the message and update the local application system data;

[0091] S2: Upload and install the service image package service-a, and generate the image package CRC code: 0x12A7; image package service-b, and generate the CRC code: 0x0EA7;

[0092] S3: The management node initiates the deployment of the service corresponding to the image package service-a for orgusermangenet, selects the edge computing node A, and the encrypted service name is:

[0093] HMcFMWPhrfIbkcs=

[0094] S3-1: The digital signature of the image package service-a carried by the management node when requesting deployment is:

[0095] FC010A7A02737661 EC220A650C17C42FFF93361B

[0096] S3-2: The management node sends the image package service-a to the edge computing node A, carrying the digital signature of the image package:

[0097] FC010A7A02737661 EC220A650C17C42FFF93361B 12A7ffffHMcFMWPhrfIbkcs=

[0098] The service id is ffff, indicating the initial deployment.

[0099] S3-1: Similarly, deploy services to Node C and Node B, also carrying the image digital signature;

[0100] S4: Deploy the image on edge computing node A

[0101] S4-1: After receiving the request to deploy the image, edge computing node A obtains the local location information and regional code, parses the digital signature, verifies it, and returns success;

[0102] S4-2: Edge computing node A starts downloading the image package service-a and starts the service. After the service is started, it generates a service id 0x11b9 and returns the service status code and service id 0x11B9.

[0103] S5: Service version upgrade

[0104] When the service version is upgraded, the service request is issued with the same signature as the initial deployment of the service. When issuing the upgrade package, the issued digital signature is:

[0105] FC010A7A02737661C220A650C17C42FFF93361B12A711B9HMCFMWPHrfIbkcs=

[0106] After node A successfully verifies the information, it starts to update the local server version. After the update is completed, it returns the update result and service identification code.

[0107] In a specific implementation, the present application provides a computer storage medium and a corresponding data processing unit, wherein the computer storage medium can store a computer program, and when the computer program is executed by the data processing unit, the invention content of the method for managing the operation security of an edge computing application service provided by the present invention and some or all of the steps in each embodiment can be executed. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0108] Those skilled in the art can clearly understand that the technical solutions in the embodiments of the present invention can be implemented by means of computer programs and their corresponding general hardware platforms. Based on such an understanding, the technical solutions in the embodiments of the present invention can be essentially or partly contributed to the prior art in the form of computer programs, i.e., software products, which can be stored in a storage medium and include several instructions for enabling a device including a data processing unit (which can be a personal computer, a server, a single-chip microcomputer, an MCU or a network device, etc.) to execute the methods described in various embodiments of the present invention or certain parts of the embodiments.

[0109] The present invention provides an idea and method for a zero-trust management method for the operation security of edge computing application services. There are many methods and ways to implement the technical solution. The above is only a preferred implementation of the present invention. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made, and these improvements and modifications should also be regarded as the scope of protection of the present invention. All components not specified in this embodiment can be implemented using existing technologies.

Claims

1. A method for managing the operation security of edge computing application services with zero trust, characterized in that: The following steps are involved: Step 1, design digital signature rules; Step 2: Generate a partial digital signature PDS according to the edge computing application service operating environment and digital signature rules; Step 3: The management node in the edge computing application service running environment uses the partial digital signature PDS to initiate a service deployment request verification to the edge computing node; Step 4: After verification, the management node generates a complete digital signature FDS and sends the service image package to the edge computing node; In step 5, the edge computing node deploys services and monitors services through the obtained image package to achieve zero-trust management of the operation security of the edge computing application service.

2. According to claim 1, a method for managing the operation security of edge computing application services with zero trust, characterized in that: The digital signature described in step 1, including: Management node private key, management node IP and port range, edge computing node public key, edge computing node IP and port number, application system ID, image name, service identification code and service name.

3. According to claim 2, a method for managing the operation security of edge computing application services with zero trust is characterized in that: Generate a partial digital signature PDS as described in step 2, including: Step 2-1, generate a management node private key. When the management node is built, generate a management node private key based on the customer ID of the management node and the regional code of the provincial tower branch to which the customer belongs; Step 2-2: Generate the management node IP and port range and edge computing node IP and port number by manual configuration; Step 2-3, edge computing node public key, when the edge computing node is built, the edge computing node public key is generated according to the customer ID of the edge computing node and the regional code of the provincial tower branch to which the customer belongs; Step 2-4: The management node generates an application system ID when the application system is created, which is used to isolate data from different application systems; Step 2-5, set the image name, service identifier, and service name to empty.

4. According to claim 3, a method for managing the operation security of edge computing application services with zero trust is characterized in that: The service deployment request verification initiated to the edge computing node in step 3 includes: Step 3-1: The management node initiates a service deployment request to the target edge computing node based on the edge computing node list generated when the application system is created, and sends a partial digital signature PDS of the service to be deployed; Step 3-2: After receiving the service deployment request, the edge computing node parses the received partial digital signature PDS and makes a judgment. If the management node private key or management node IP and port range in the partial digital signature PDS are incorrect, the message is discarded and the service deployment is terminated; if only the application system id is incorrect, an error code is returned; if all information in the partial digital signature PDS is verified, the request is returned successful.

5. A method for managing the operation security of edge computing application services according to claim 4, characterized in that: Generate a complete digital signature FDS as described in step 4, including: The management node randomly generates a service ID for the service to be deployed, obtains the image name, service name, and number of service copies, and generates a service identification code based on the encrypted information. The image name, service identification code and service name are set in the partial digital signature PDS of the service to be deployed to obtain the complete digital signature FDS.

6. A method for managing the operation security of edge computing application services according to claim 5, characterized in that: Sending the service image package to the edge computing node in step 4 includes: Step 4-1: The management node sends the service image package to the target edge computing node and verifies it using the complete digital signature FDS; Step 4-2: The edge computing node verifies the image package name. If the verification passes, step 4-3 is executed. Otherwise, an error message is returned. Step 4-3, verify the service identification code. If the service contained in the image package is not deployed in the current edge computing node, deploy it and return the service identification code and deployment result. Otherwise, upgrade the service and return the upgrade result.

7. A method for managing the operation security of edge computing application services according to claim 6, characterized in that: Perform service monitoring as described in step 5, including: The edge computing node periodically scans the services running in the node and verifies the digital signatures of the image packages of all services. If there is no digital signature or the digital signature is incorrect, the service is stopped immediately and an alarm message is sent to the management node.

8. A method for managing the operation security of edge computing application services according to claim 7, characterized in that: The management node private key includes the private data characteristics of the management node.

9. A method for managing the operation security of edge computing application services according to claim 8, characterized in that: The edge computing node public key includes the private data characteristics of the edge computing node.

10. A method for managing the operation security of edge computing application services according to claim 9, characterized in that: The management node IP and port range and the edge computing node IP and port number are used for the network connection between the management node and the edge computing node.

Images