Container access control method and device, equipment and storage medium

Abstract

The invention provides a container access control method and device, equipment and a storage medium, and relates to the technical field of computers, in particular to the technical field of containers and cloud. The specific implementation scheme is as follows: in response to a session request, authenticating first identity information contained in the session request; under the condition that the identity authentication is passed, obtaining an identity certificate of a current session; obtaining a starting parameter of a root process according to the session feature of the current session; sending a resource creation request containing the starting parameter to a container arrangement system so as to create a resource for running the current session; and in response to a voucher acquisition request of any working process, encrypting an identity voucher of a target session associated with the working process and then sending the identity voucher to the working process. According to the invention, secure and trusted transmission of the identity credential at the container session isolation level can be realized.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to container technology and cloud technology. Background Art

[0002] Kubernetes (k8s) is an open source container orchestration system for automating the deployment, expansion, and management of containerized applications. Kubernetes is also an important part of cloud technology, providing management and orchestration capabilities for containerized applications in cloud environments. Container security directly affects the asset security and production data security of information technology (IT) in the enterprise production environment. Container security protection measures often involve image security, container isolation, host security, access control and auditing, etc. The container bastion host helps enterprises achieve the safe operation and maintenance of IT assets such as production servers in the Kubernetes cluster cloud environment through access control and auditing, abnormal alarm and other measures, thereby ensuring data security and ultimately improving the security of the Kubernetes cluster. Summary of the invention

[0003] The present disclosure provides a container access control method, apparatus, device and storage medium.

[0004] According to one aspect of the present disclosure, a container access control method is provided, which is applied to a bastion host, including:

[0005] In response to the session request, authenticating the first identity information included in the session request;

[0006] If the identity authentication is successful, the identity credentials of the current session are obtained;

[0007] According to the session characteristics of the current session, the startup parameters of the root process are obtained;

[0008] Send a resource creation request containing startup parameters to the container orchestration system to create resources to run the current session;

[0009] In response to a credential acquisition request from any work process, the identity credential of the target session associated with the work process is encrypted and sent to the work process.

[0010] According to another aspect of the present disclosure, a container access control method is provided, which is applied to a container and includes:

[0011] Call the bastion host SDK to negotiate with the bastion host proxy module to obtain the shared key of the current session;

[0012] Send a credential acquisition request to the bastion host proxy module to obtain the encrypted identity credential; wherein the identity credential is associated with the current session;

[0013] Decrypt the identity credential using the shared key in the current working process to obtain the identity credential.

[0014] According to another aspect of the present disclosure, a container access control device is provided, which is applied to a bastion host, including:

[0015] an authentication module, configured to, in response to a session request, authenticate the first identity information included in the session request;

[0016] The credential determination module is used to obtain the identity credential of the current session when the identity authentication is passed;

[0017] A parameter determination module, used to obtain the startup parameters of the root process according to the session characteristics of the current session;

[0018] A sending module, used to send a resource creation request including startup parameters to the container orchestration system to create resources for running the current session;

[0019] The encryption module is used to respond to a credential acquisition request of any work process, encrypt the identity credential of the target session associated with the work process and send it to the work process.

[0020] According to another aspect of the present disclosure, a container access control device is provided, which is applied to a container and includes:

[0021] The negotiation module is used to call the bastion host SDK to negotiate with the bastion host proxy module to obtain the shared key of the current session;

[0022] A request module is used to send a credential acquisition request to the bastion host proxy module to obtain an encrypted identity credential; wherein the identity credential is associated with the current session;

[0023] The decryption module is used to decrypt the identity credential using the shared key in the current working process to obtain the identity credential.

[0024] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0025] at least one processor; and

[0026] a memory communicatively connected to the at least one processor; wherein,

[0027] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any method in the embodiments of the present disclosure.

[0028] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any method according to the embodiments of the present disclosure.

[0029] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements any method according to the embodiments of the present disclosure when executed by a processor.

[0030] According to the present disclosure, secure and trusted transmission of identity credentials at the container session isolation level can be achieved.

[0031] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0033] Figure 1 is an exemplary system architecture according to an embodiment of the present disclosure;

[0034] Figure 2 is a flowchart of a container access control method according to an embodiment of the present disclosure;

[0035] Figure 3 is a flowchart of a container access control method according to another embodiment of the present disclosure;

[0036] Figure 4 is a flowchart of a method for securely transmitting identity credentials according to an embodiment of the present disclosure;

[0037] Figure 5 is a structural diagram of a container access control device according to an embodiment of the present disclosure;

[0038] Figure 6 is a structural schematic diagram of a container access control device according to another embodiment of the present disclosure;

[0039] Figure 7 is a block diagram of an electronic device for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0040] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0041] Figure 1 An exemplary system architecture 100 is shown to which an embodiment of the container access control method or container access control apparatus of the present disclosure can be applied.

[0042] like Figure 1 As shown, the system architecture 100 may include a container bastion host 110 and a Kubernetes cluster 120. The container bastion host 110 and the Kubernetes cluster 120 communicate with each other via a network. The network may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0043] The user can use a terminal device (such as a smart phone, tablet computer, laptop computer, etc.) to interact with the container bastion machine 110 through the network to log in and operate the container in the Kubernetes cluster 120. Various client applications can be installed on the terminal device, such as a web browser application, a remote desktop application, an SSH client, etc.

[0044] The container bastion host 110 may include the following components:

[0045] Console: Users log in to the container bastion host through the console and perform various operations and management tasks through the console.

[0046] Bastion host proxy module: The bastion host proxy acts as an intermediary between the user and the container environment, and is responsible for processing user requests, managing sessions, recording behaviors, etc. The bastion host proxy communicates with the console, the behavior audit anomaly detection module, and the third-party user authority system interface 130 through the network.

[0047] Behavior audit anomaly detection module: This module is responsible for monitoring and recording user operations on the container bastion host, and detecting and warning abnormal behaviors.

[0048] The Kubernetes cluster 120 can be a distributed cluster consisting of multiple servers or a single server. The Kubernetes cluster 120 includes an application program interface server (API Server) and other components for managing the life cycle, expansion, update, and maintenance of containers. The API Server 121 can communicate with the bastion host Proxy through the network.

[0049] The terminal device can be hardware or software. When the terminal device is hardware, it can be various electronic devices with a display screen and supporting web browsing or remote connection, including but not limited to smart phones, tablet computers, laptops, desktop computers, etc. When the terminal device is software, it can be installed in the electronic devices listed above. It can be implemented as multiple software or software modules (for example, to provide distributed services), or it can be implemented as a single software or software module. No specific limitation is made here.

[0050] It should be noted that the container bastion host 110 can be a server of a distributed system, or a server combined with a blockchain. The container bastion host can also be a cloud server, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology.

[0051] It should be understood that Figure 1 The number of users, networks, bastion servers, Kubernetes system container groups (Pods), and nodes in the example are only illustrative. Depending on the implementation requirements, there can be any number of terminal devices, networks, servers, Kubernetes system nodes, and Pods.

[0052] Figure 2 1 is a flow chart of a container access control method provided according to an embodiment of the present disclosure, which is applied to a bastion host. Figure 2 As shown, the method comprises at least the following steps:

[0053] S201. In response to a session request, authenticate first identity information included in the session request.

[0054] In this embodiment, the container bastion machine serves as the unified login entrance for the entire Kubernetes cluster, and the user submits a session request through the console. The session request includes at least: the user's first identity information, which can be the login account information logged in to the console. The user can submit the session request through the graphical interface provided by the console, or submit the request through the command line.

[0055] The bastion host console communicates with the bastion host proxy based on the websocket protocol, providing a visual command operation interface. Businesses can also use the websocket protocol to call the bastion host proxy interface based on any operation interface to complete the connection and send a session request to the bastion host proxy.

[0056] After receiving the session request, the bastion proxy can forward the request to the third-party user authority system for identity authentication. The user authority system is responsible for issuing and authenticating user identity credentials and managing user resource permissions.

[0057] S202: When the identity authentication is successful, obtain the identity credential of the current session.

[0058] In this embodiment, after identity authentication is passed, the third-party user permission system will generate the identity credentials of the current session and pass the credentials to the container bastion host through the bastion host proxy. The container bastion host can store the identity credentials of the current session for subsequent access control and permission management.

[0059] S203: Obtain startup parameters of the root process according to the session characteristics of the current session.

[0060] In this embodiment, when a user logs in, the bastion host proxy will attach the session characteristics of the current session to the root process of the container to be created. The session characteristics may include session ID (sessionId), process ID (pid), user name, session start timestamp, etc. One or more of the above characteristics are attached to the process as startup parameters for subsequent process management and resource access control.

[0061] S204: Send a resource creation request including startup parameters to the container orchestration system to create resources for running the current session.

[0062] In this embodiment, the bastion host proxy forwards the resource creation request containing the startup parameters to the API server of the Kubernetes cluster. The Kubernetes cluster creates corresponding resources such as containers and Pods based on the request to support the operation of the current session. At the same time, the bastion host proxy passes the characteristics related to the current session to the container and attaches them to the root process startup parameters generated by the session.

[0063] S205: In response to a credential acquisition request of any work process, encrypt the identity credential of the target session associated with the work process and send it to the work process.

[0064] In this embodiment, when any working process in the container needs to access the identity credentials of the current session, it sends a credential acquisition request to the bastion host Proxy. The bastion host Proxy responds to the request, encrypts the identity credentials of the target session associated with the working process, and then passes the current identity credentials to the container through a security protocol, and only acts on the current operation session. The identity credentials are encrypted to ensure the security of the credentials and prevent unauthorized access. The session-level isolation feature of the container ensures that the identity credentials are invisible to other users of the same container and are only visible to the current operating user. The current container operation session holds the identity credentials of the currently logged-in user. The container can implement access control and auditing of file resources inside the container based on user identity, which greatly improves the safety of container operation and maintenance and ensures the data security inside the container.

[0065] According to the solution of the embodiment of the present disclosure, secure and trusted transmission of identity credentials at the container session isolation level is achieved.

[0066] In a possible implementation, S203: obtaining the startup parameters of the root process according to the session characteristics of the current session further includes the steps of:

[0067] Generate the first public key and the first private key for the current session.

[0068] A session feature of the current session is obtained according to the first public key and at least one of a session ID, a process ID, a user name, and a session start timestamp.

[0069] Get the startup parameters of the root process based on the session characteristics.

[0070] In the disclosed embodiment, when a user logs in to the container bastion machine through the console, the bastion machine proxy will generate the first public key and the first private key of the current session. The process of generating the first public key and the first private key can use existing encryption algorithms, such as RSA, ECDSA, etc. The first public key is used to encrypt communication to ensure session security, while the first private key is used for decryption and signing.

[0071] The bastion proxy generates session characteristics for the current session based on at least one of the following information:

[0072] Session ID (sessionId): A unique identifier for the current session.

[0073] Process ID (pid): The unique identifier of the root process of the current session.

[0074] Username: The username of the logged in user.

[0075] Session start timestamp: The timestamp when the current session starts.

[0076] The bastion host proxy can combine the above information with the first public key to generate a string or data structure containing the current session characteristics, which is constructed as the startup parameters of the root process. The root process generated by the current session and the subsequent derived child processes can obtain the startup parameters according to the process tree relationship, thereby obtaining the session characteristics of the current session.

[0077] According to the solution of the embodiment of the present disclosure, the characteristics related to the current session are passed into the container and attached to the root process startup parameters generated by the session, which can ensure the correct transmission and use of the session characteristics within the container, thereby realizing subsequent access control and permission management.

[0078] In a possible implementation, S205: in response to a credential acquisition request of any work process, encrypting the identity credential of the target session associated with the work process and sending it to the work process further includes the steps of:

[0079] In response to a credential acquisition request of any work process, a target session associated with the work process is determined according to session characteristics.

[0080] A shared key is generated according to the first private key of the target session and the second public key included in the credential acquisition request.

[0081] The target session's credentials are encrypted using a shared key.

[0082] Send the encrypted credentials to the worker process.

[0083] In the disclosed embodiment, at the same time, the bastion host Proxy may have multiple ongoing sessions. When a working process in the container needs to obtain identity credentials, it will send a credential acquisition request to the bastion host Proxy. After receiving the request, the bastion host Proxy first determines the target session associated with the working process based on the session characteristics. The bastion host Proxy determines the target session by comparing the characteristic information of the working process with the characteristic information of the current session to confirm which session the working process belongs to.

[0084] The bastion proxy generates a shared key using the first private key of the target session and the second public key contained in the credential acquisition request sent by the worker process. The shared key can be generated using an existing key exchange algorithm, such as Diffie-Hellman key exchange or ECDH (Elliptic Curve Diffie-Hellman). The process of generating the shared key ensures that only the worker process and the bastion proxy can know the key.

[0085] The bastion proxy uses the generated shared key to encrypt the identity credentials of the target session. The encryption process can use a symmetric encryption algorithm, such as the Advanced Encryption Standard (AES). Through encryption, the identity credentials are ensured not to be accessed by unauthorized third parties during transmission.

[0086] The bastion proxy sends the encrypted identity credentials to the worker process through the bastion software development kit (SDK). The bastion SDK works with the bastion proxy to ensure that the encrypted credentials can be securely passed to the worker process. After the worker process receives the encrypted identity credentials, it can decrypt them using the shared key to obtain the identity credentials of the target session.

[0087] SDK is a set of tools used by software developers when building applications, which usually includes the following: API (Application Programming Interface), precompiled code libraries, documentation, sample codes, etc.

[0088] According to the solution of the embodiment of the present disclosure, when responding to the credential acquisition request of the working process, the bastion host proxy can securely pass the identity credentials of the target session, ensuring the security and flexibility of access control. The working process can use the decrypted identity credentials for resource access and permission management, which greatly improves the security of container operation and maintenance and ensures the data security inside the container.

[0089] In one possible implementation, the second public key is generated by the worker process calling the bastion host SDK.

[0090] In the disclosed embodiment, when a working process in the container needs to access the identity credentials of the current session, it will call the bastion host SDK to generate a second public key and a second private key. The bastion host SDK can use existing encryption algorithms, such as RSA, Elliptic Curve Digital Signature Algorithm (ECDSA), etc., to generate a new pair of public and private keys. The generated second public key is used for encrypted communication to ensure the security of communication with the bastion host Proxy, while the second private key is used for decryption and signing.

[0091] The worker process sends the generated second public key to the bastion host proxy through the bastion host SDK. The bastion host SDK is responsible for encapsulating the second public key in the credential acquisition request and sending the request to the bastion host proxy through the network. After receiving the credential acquisition request, the bastion host proxy extracts the second public key.

[0092] According to the solution of the embodiment of the present disclosure, the working process can generate a second public key by calling the bastion host SDK and send it to the bastion host Proxy. The bastion host Proxy uses the first private key of the target session and the second public key sent by the working process to generate a shared key, thereby ensuring the security and integrity of the identity credentials during transmission.

[0093] In a possible implementation, S201, in response to a session request, authenticates the first identity information included in the session request, further comprising the steps of:

[0094] In response to the session request of the console, the first identity information included in the session request is sent to the authority authentication interface.

[0095] Get the authentication result returned by the permission authentication interface.

[0096] In the disclosed embodiment, when a user submits a session request through the console, the console communicates with the bastion host Proxy based on the WebSocket protocol. After receiving the session request, the bastion host Proxy extracts the first identity information (such as user name, password, certificate, etc.) in the request, and communicates with the interface of the third-party user authority system through the bastion host Proxy. The bastion host Proxy encapsulates the first identity information in the request and sends it to the authority authentication interface. The authority authentication interface can be an API interface provided by a third-party user authority system, which is used to verify the identity and authority of the user, the issuance and authentication of identity credentials, and the management of user resource permissions.

[0097] After the authorization authentication interface completes the verification, the authentication result is returned to the bastion proxy. The authentication result can include the following:

[0098] Authentication successful: The user identity verification is successful and has the corresponding permissions.

[0099] Authentication failed: User identity authentication failed or the user has insufficient permissions.

[0100] After receiving the return result of the authorization authentication interface, the bastion host proxy decides whether to allow the user to perform subsequent operations based on the authentication result. If the authentication succeeds, the bastion host proxy will generate the identity credentials for the current session and continue to perform subsequent steps; if the authentication fails, the bastion host proxy will reject the user's session request and return the corresponding error information to the user.

[0101] It should be noted that, depending on the system design and security requirements, in a containerized environment, identity credentials can be generated by a third-party user permission system or by a bastion host proxy. Specifically:

[0102] If a proxy (such as a container bastion or API Gateway) is responsible for handling user authentication and authorization, it may generate identity credentials after authentication. You can directly control the generation and life cycle of credentials and perform fine-grained access control at the proxy level. The proxy can generate identity credentials in the form of session cookies, JWT (JSON Web Token), OAuth tokens, etc., and pass them to users or worker processes.

[0103] If the system uses external authentication services (such as OAuth, SAML, LDAP, etc.), these services usually generate identity credentials. Use existing mature authentication and authorization systems to improve security and reliability, and integrate with the company's existing identity management system to achieve single sign-on (SSO).

[0104] After the user logs in through an external authentication service, he obtains identity credentials (such as OAuth tokens, SAML assertions, etc.). These credentials can be passed to the Proxy or directly to the application or worker process.

[0105] In addition, in some complex systems, Proxy may cooperate with a third-party authentication system. Proxy performs preliminary identity authentication and then redirects the user to a third-party authentication service for further authentication and authorization. Combining the flexibility of Proxy and the security of external authentication services, different authentication methods can be selected according to different needs and scenarios. Proxy may generate a temporary credential when the user logs in, and the user uses this temporary credential to access the third-party authentication service. After the authentication service passes, a formal identity credential is returned to Proxy, and Proxy passes this credential to the worker process or application.

[0106] According to the solution of the embodiment of the present disclosure, the bastion host Proxy can respond to the session request of the console, communicate with the permission authentication interface of the third-party user permission system, obtain the identity authentication result, and collaborate with the third-party user permission system in a low-cost, convenient and fast manner, ensuring the legitimacy of the user identity and the validity of the permission.

[0107] In a possible implementation, the method further includes the steps of:

[0108] The operation behavior of the session is recorded to obtain a behavior log; wherein each record in the behavior log contains an operation instruction and a second identity information, and the second identity information is obtained by the authority authentication interface.

[0109] Send the behavior log to the behavior audit anomaly detection module for abnormal behavior analysis.

[0110] Based on the abnormal behavior analysis results, an abnormal behavior alert or report is obtained.

[0111] In the disclosed embodiment, the bastion host Proxy records the operation behavior of the session in real time and generates a behavior log. The behavior log includes information such as the executed commands, the resources accessed, and the timestamp of the operation. In addition, each record contains a second identity information, which can be obtained by the permission authentication interface of the third-party permission system, rather than relying on the first identity information provided by the console. The third-party permission system usually provides more accurate and comprehensive user identity information. By recording the identity information of the third-party permission system, the Proxy can ensure that each operation behavior is associated with the correct user identity, avoiding identity authentication problems caused by inaccurate or expired identity information provided by the console. The third-party permission system usually contains information such as the user's role and permission level. By recording this information, the Proxy can perform more fine-grained access control and behavior auditing based on the user's specific permissions, ensuring that the user can only perform operations within their authority, thereby improving the security of the system.

[0112] The bastion proxy sends the recorded behavior logs to the behavior audit and anomaly detection module through the internal communication mechanism or API. The frequency of sending behavior logs can be real-time or periodic (such as every minute, every hour, etc.). The behavior audit anomaly detection module receives the behavior logs and performs abnormal behavior analysis. The behavior logs can be analyzed according to the resource permissions and preset abnormal behavior rules specified by the third-party permission system. The analysis process includes detecting unauthorized access, abnormal operation frequency, illegal command execution and other behaviors. Abnormal behavior rules can be defined and implemented according to the business security requirement level. If abnormal behavior is found, abnormal behavior alarms or reports can be issued or the session can be interrupted immediately.

[0113] According to the solution of the embodiment of the present disclosure, the security of the system can be enhanced, the accuracy and efficiency of the audit can be improved, and a solid foundation can be provided for subsequent security incident investigations and compliance checks.

[0114] Figure 3 FIG. 1 is a flow chart of a container access control method provided by another embodiment of the present disclosure, which is applied to a container. Figure 3 As shown, the method comprises at least the following steps:

[0115] S301. Call the bastion host SDK to negotiate with the bastion host proxy module to obtain the shared key of the current session.

[0116] In this embodiment, when a worker process in the container needs to access the resources of the current session, it will call the bastion host SDK. The bastion host SDK communicates with the bastion host Proxy through the WebSocket protocol to negotiate and generate a shared key for the current session.

[0117] S302: Send a credential acquisition request to the bastion host proxy module to obtain an encrypted identity credential, wherein the identity credential is associated with the current session.

[0118] In this embodiment, the working process sends a credential acquisition request to the bastion server proxy through the bastion server SDK. The credential acquisition request contains the session characteristics of the current session, and the session characteristics may include at least one of the following: session ID, process ID, user name, session start timestamp, etc.

[0119] After receiving the credential acquisition request, the bastion host proxy determines the target session associated with the worker process based on the session characteristics and encrypts the identity credentials of the target session using the shared key. The encrypted identity credentials are sent to the worker process through the bastion host SDK.

[0120] S303: Decrypt the identity credential using the shared key in the current working process to obtain the identity credential.

[0121] In the disclosed embodiment, after receiving the encrypted identity credential, the work process uses the shared key generated by negotiation in step S301 to decrypt it to obtain the original identity credential, and the work process performs access control and authority management based on the decrypted identity credential.

[0122] According to the solution of the embodiment of the present disclosure, the working process on the container side can generate a shared key by calling the bastion host SDK to negotiate with the bastion host Proxy, and use the shared key to decrypt the identity credentials, thereby ensuring the security of access control and data security within the container, and realizing the secure and trusted transmission of identity credentials at the container session isolation level.

[0123] In a possible implementation, S301 calls the bastion host SDK to negotiate with the bastion host proxy module to obtain a shared key for the current session, further comprising the steps of:

[0124] Call the bastion host SDK to obtain the first public key of the current session.

[0125] A second private key and a second public key are generated.

[0126] A shared key for the current session is obtained according to the second private key and the first public key.

[0127] In the disclosed embodiment, the working process can query the startup parameters of the root process through the process tree relationship. The startup parameters include the first public key of the target session corresponding to the working process. The working process extracts the first public key from the startup parameters of the root process and prepares it for subsequent key exchange.

[0128] The bastion host SDK can use existing encryption algorithms, such as RSA, ECDSA, etc., to generate the second public key and the second private key. The generated second public key is used to encrypt communication to ensure the security of communication with the bastion host Proxy, while the second private key is used for decryption and signing.

[0129] The working process generates a shared key for the current session using the obtained first public key and the generated second private key. The shared key can be generated using an existing key exchange algorithm, such as Diffie-Hellman key exchange or ECDH.

[0130] The worker process uses the second private key and the first public key to exchange keys through the bastion host SDK. The key exchange algorithm calculates a shared key that both parties know.

[0131] According to the solution of the embodiment of the present disclosure, the working process can negotiate with the bastion host Proxy by calling the bastion host SDK to generate a shared key for the current session, ensuring the security of identity credential transmission and the effectiveness of encryption.

[0132] In a possible implementation, calling the bastion host SDK to obtain the first public key of the current session further includes the following steps:

[0133] According to the process tree relationship, determine the startup parameters of the root process of the current working process.

[0134] Get the session characteristics of the current session based on the startup parameters.

[0135] A first public key is obtained according to the session characteristics.

[0136] In the disclosed embodiment, when a working process in a container needs to access the resources of the current session, it will call the bastion host SDK. The bastion host SDK obtains the startup parameters of the root process of the current working process through the process tree relationship. The acquisition process includes:

[0137] The working process calls the system API in the bastion host SDK to obtain the process ID of the current working process.

[0138] Traverse the process tree according to the process ID, determine the process ID of its parent process based on the process ID of the current working process, and search upward level by level until the process ID of the root process is found.

[0139] Get the startup parameters of the root process according to the process ID of the root process. The startup parameters include the session characteristics of the current session.

[0140] The working process can extract the first public key from the session characteristics. The first public key can be directly included in the session characteristics and calculated through other information in the session characteristics. The session characteristic information includes the generation rules or parameters of the first public key, and the working process calculates the first public key based on this information.

[0141] In another implementation method, when the working process uses the bastion host SDK to negotiate the key with the bastion host Proxy, the session ID, user name and other parameters in the session characteristics can be used to find the corresponding target session on the bastion host Proxy, and the bastion host Proxy obtains the corresponding first public key.

[0142] According to the solution of the embodiment of the present disclosure, the working process can obtain the startup parameters of the root process from the process tree relationship by calling the bastion host SDK, extract the session characteristics, and obtain the first public key of the current session therefrom; within the same container, the identity credentials have session isolation, that is, the credentials of the current session are invisible to other session users of the same container.

[0143] In a possible implementation manner, the credential acquisition request includes the second public key.

[0144] Figure 4 FIG. 1 is a flow chart of a method for securely transmitting identity credentials according to an embodiment of the present disclosure. Figure 4 As shown, the method comprises the following steps:

[0145] Step 1: When the user logs in, the bastion host Proxy will generate a pair of public and private keys a (private key) and A (public key) for the current session, and the bastion host Proxy will attach the current session features to the process. The session features include the session ID (sessionId), process ID (pid), user name, session start timestamp features, and public key A as the startup parameter of the session root process, which is attached to the process.

[0146] Step 2: After the session is established, when the user logs into the container, the working processes started are all child processes of the session root process.

[0147] Step 3: Based on the Linux process tree relationship, the working process can use the bastion host SDK to obtain the characteristics of the current session.

[0148] Step 4: The bastion host SDK generates a pair of public and private keys b (private key) and B (public key), and then shares the public key B with the bastion host Proxy. The bastion host and the bastion host Proxy use the Diffie-HellMan protocol to exchange shared keys based on the current session characteristics, including:

[0149] 1) The bastion server Proxy generates a shared key p based on the private key a and the public key B;

[0150] 2) The bastion host SDK generates a shared key p based on the private key b and the public key A.

[0151] Step 5: The bastion host SDK obtains the user credentials encrypted with the shared key from the bastion host proxy and decrypts them using the shared key in the current working process.

[0152] During the above security protocol, if the worker process does not use the bastion host SDK, it cannot negotiate a shared key and cannot obtain user credentials. If the worker process uses the bastion host SDK, the SDK can only obtain the characteristics of the corresponding session when it is started, and cannot obtain the pid that starts other user sessions. Even if the pid and sessionId are visible to other users in the same container, it does not matter because other access users cannot change the worker process tree relationship.

[0153] According to the solution of the embodiment of the present disclosure, at least the following effects are achieved:

[0154] 1. It can ensure that each session has an independent shared key, further ensure the session-level isolation of user identity credentials, and ultimately ensure that the transmission process of user identity credentials is safe and reliable and will not be leaked.

[0155] 2. On the basis of ensuring the reliable transmission of user identity credentials, the container bastion host performs access control and auditing on the entire process of container operation and maintenance. At the same time, the container can further perform internal resource permission control based on the current session user identity credentials, ultimately ensuring the security of Kubernetes cluster operation and maintenance.

[0156] It should be noted that the common container login operation and maintenance methods include the following three:

[0157] 1) Log in to the container based on the Kubernetes native container login method. The permission control method of this method is based on the authentication and authorization of K8S's RBAC control method.

[0158] 2) Start a program that can simulate a terminal process (such as PtyProcess) in the container, communicate with the front-end program (such as xterm.js) through the WebSocket protocol, and log in to the container. Common products include CodeLab Terminal.

[0159] 3) Log in to view the container operation log based on the webssh solution.

[0160] Compared with the above-mentioned solutions, the technical solutions provided by any embodiment of the present disclosure have the following advantages:

[0161] 1. It can achieve low-cost, fast and convenient connection with the existing business permission system to avoid leakage of native Kubernetes credentials.

[0162] The container bastion host solution adds a proxy proxy to the socket connection channel between the console and the container. The proxy proxy is responsible for user authentication and permission control. The proxy side can directly adopt the existing permission authentication and control system of the business, and does not need to make any modifications to adapt to the k8s permission system. At the same time, the proxy uniformly manages the k8s cluster login credentials, and the credential exposure surface converges from the original user side to the proxy side, greatly reducing the risk of credential leakage.

[0163] 2. Trusted delivery of identity credentials at the container session isolation level.

[0164] After the Proxy-side user authentication, the container bastion machine passes the current user's identity credentials to the container through a security protocol and only acts on the current operation session, ensuring that the identity credentials are invisible to other users of the same container and only visible to the current operation user. The current container operation session holds the identity credentials of the currently logged-in user, and the container can implement access control and auditing of file resources inside the container based on user identity, greatly improving the safety of container operation and maintenance and ensuring the security of data inside the container.

[0165] 3. The entire process of container operation and maintenance is safe and controllable.

[0166] Compared with Solution 2 and Solution 3, which are difficult to audit user operations, the container bastion host adds user identity authentication, permission control, and behavior auditing on the proxy side. The container bastion host solution can achieve a safe and controllable whole process of pre-authorization, in-process monitoring, and post-audit.

[0167] It should be noted that the requirements for secure and trusted transmission of identity credentials at the container session isolation level include: within the current session, users cannot forge the identity credentials of other users. Within the same container, user identity credentials have session isolation, that is, the user credentials of the current session are invisible to other session users of the same container.

[0168] Figure 5 Schematic diagram of the structure of a container access control device provided according to an embodiment of the present disclosure, which is applied to a bastion host. Figure 5 As shown, the device 500 at least includes:

[0169] The authentication module 501 is used to respond to a session request and authenticate the first identity information included in the session request.

[0170] The credential determination module 502 is used to obtain the identity credential of the current session when the identity authentication is successful.

[0171] The parameter determination module 503 is used to obtain the startup parameters of the root process according to the session characteristics of the current session.

[0172] The sending module 504 is used to send a resource creation request including startup parameters to the container orchestration system to create resources for running the current session.

[0173] The encryption module 505 is used to respond to a credential acquisition request of any work process, encrypt the identity credential of the target session associated with the work process and send it to the work process.

[0174] In a possible implementation, the parameter determination module 503 is used to:

[0175] Generate the first public key and the first private key for the current session.

[0176] A session feature of the current session is obtained according to the first public key and at least one of a session ID, a process ID, a user name, and a session start timestamp.

[0177] Get the startup parameters of the root process based on the session characteristics.

[0178] In a possible implementation, the encryption module 505 is used to:

[0179] In response to a credential acquisition request of any work process, a target session associated with the work process is determined according to session characteristics.

[0180] A shared key is generated according to the first private key of the target session and the second public key included in the credential acquisition request.

[0181] The target session's credentials are encrypted using a shared key.

[0182] Send the encrypted credentials to the worker process.

[0183] In one possible implementation, the second public key is generated by the worker process calling the bastion host SDK.

[0184] In a possible implementation, the authentication module 501 is used to:

[0185] In response to the session request of the console, the first identity information included in the session request is sent to the authority authentication interface.

[0186] Get the authentication result returned by the permission authentication interface.

[0187] In a possible implementation, the device further includes an abnormality analysis module for:

[0188] The operation behavior of the session is recorded to obtain a behavior log, wherein each record in the behavior log includes the operation instruction and the second identity information, and the second identity information is obtained by the authority authentication interface.

[0189] The behavior log is sent to the behavior audit anomaly detection module for abnormal behavior analysis.

[0190] Based on the abnormal behavior analysis results, an abnormal behavior alert or report is obtained.

[0191] Figure 6 FIG. 1 is a schematic diagram of a container access control device according to another embodiment of the present disclosure, which is applied to a container. Figure 6 As shown, the device 600 at least includes:

[0192] The negotiation module 601 is used to call the bastion host SDK to negotiate with the bastion host proxy module to obtain the shared key of the current session.

[0193] The request module 602 is used to send a credential acquisition request to the bastion host proxy module to obtain an encrypted identity credential, wherein the identity credential is associated with the current session.

[0194] The decryption module 603 is used to decrypt the identity certificate using the shared key in the current working process to obtain the identity certificate.

[0195] In a possible implementation, the negotiation module 601 is used to:

[0196] Call the bastion host SDK to obtain the first public key of the current session.

[0197] A second private key and a second public key are generated.

[0198] A shared key for the current session is obtained according to the second private key and the first public key.

[0199] In a possible implementation, the negotiation module 601 is used to:

[0200] According to the process tree relationship, determine the startup parameters of the root process of the current working process.

[0201] Get the session characteristics of the current session based on the startup parameters.

[0202] A first public key is obtained according to the session characteristics.

[0203] In a possible implementation manner, the credential acquisition request includes the second public key.

[0204] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0205] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0206] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0207] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0208] like Figure 7 As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0209] A number of components in the device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0210] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as the container access control method. For example, in some embodiments, the container access control method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the container access control method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the container access control method in any other appropriate manner (e.g., by means of firmware).

[0211] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0212] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0213] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0214] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0215] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0216] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0217] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0218] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A container access control method, applied to a bastion host, comprising: In response to the session request, authenticating the first identity information included in the session request; When the identity authentication is passed, the identity credential of the current session is obtained; Obtaining a startup parameter of a root process according to the session characteristics of the current session; Sending a resource creation request including the startup parameters to a container orchestration system to create resources for running the current session; In response to a credential acquisition request of any work process, the identity credential of the target session associated with the work process is encrypted and sent to the work process.

2. The method according to claim 1, wherein: The step of obtaining the startup parameters of the root process according to the session characteristics of the current session includes: Generate a first public key and a first private key of the current session; Obtaining a session feature of the current session according to the first public key and at least one of a session ID, a process ID, a user name, and a session start timestamp; According to the session characteristics, the startup parameters of the root process are obtained.

3. The method according to claim 1 or 2, wherein: The step of responding to a credential acquisition request of any work process, encrypting the identity credential of the target session associated with the work process and sending it to the work process comprises: In response to a credential acquisition request of any work process, determining a target session associated with the work process according to the session characteristics; generating a shared key according to the first private key of the target session and the second public key included in the credential acquisition request; encrypting the identity credentials of the target session using the shared key; The encrypted identity credential is sent to the working process.

4. The method according to claim 3, wherein: The second public key is generated by the working process calling the bastion host software development kit SDK.

5. The method according to claim 1, wherein: The step of responding to the session request and authenticating the first identity information included in the session request includes: In response to a session request from the console, sending the first identity information included in the session request to the authority authentication interface; Get the authentication result returned by the permission authentication interface.

6. The method according to claim 5, further comprising: Recording the operation behavior of the session to obtain a behavior log; wherein each record in the behavior log contains the operation instruction and the second identity information, and the second identity information is obtained by the authority authentication interface; Sending the behavior log to the behavior audit anomaly detection module for abnormal behavior analysis; Based on the abnormal behavior analysis results, an abnormal behavior alert or report is obtained.

7. A container access control method, applied to a container, comprising: Call the bastion host SDK to negotiate with the bastion host proxy module to obtain the shared key of the current session; Sending a credential acquisition request to the bastion host proxy module to obtain an encrypted identity credential; wherein the identity credential is associated with the current session; The shared key is used in the current working process to decrypt the identity credential to obtain the identity credential.

8. The method according to claim 7, wherein: The calling of the bastion host SDK to negotiate with the bastion host proxy module to obtain the shared key of the current session includes: Call the bastion host SDK to obtain the first public key of the current session; Generate a second private key and a second public key; A shared key for the current session is obtained according to the second private key and the first public key.

9. The method according to claim 8, wherein: The calling of the bastion host SDK to obtain the first public key of the current session includes: According to the process tree relationship, determine the startup parameters of the root process of the current working process; According to the startup parameters, obtaining session characteristics of the current session; A first public key is obtained according to the session characteristics.

10. The method according to claim 8, wherein: The credential acquisition request includes the second public key.

11. A container access control device, applied to a bastion host, comprising: an authentication module, configured to, in response to a session request, authenticate the first identity information included in the session request; A credential determination module, used to obtain the identity credential of the current session if the identity authentication passes; A parameter determination module, used to obtain the startup parameters of the root process according to the session characteristics of the current session; A sending module, configured to send a resource creation request including the startup parameters to a container orchestration system to create resources for running the current session; The encryption module is used to respond to a credential acquisition request of any work process, encrypt the identity credential of the target session associated with the work process and send it to the work process.

12. The device according to claim 11, wherein The parameter determination module is used to: Generate a first public key and a first private key of the current session; Obtaining a session feature of the current session according to the first public key and at least one of a session ID, a process ID, a user name, and a session start timestamp; According to the session characteristics, the startup parameters of the root process are obtained.

13. The device according to claim 11 or 12, wherein: The encryption module is used for: In response to a credential acquisition request of any work process, determining a target session associated with the work process according to the session characteristics; generating a shared key according to the first private key of the target session and the second public key included in the credential acquisition request; encrypting the identity credentials of the target session using the shared key; The encrypted identity credential is sent to the working process.

14. The device according to claim 13, wherein: The second public key is generated by the working process calling the bastion host SDK.

15. The device according to claim 11, wherein the authentication module is used for: In response to a session request from the console, sending the first identity information included in the session request to the authority authentication interface; Get the authentication result returned by the permission authentication interface.

16. The apparatus according to claim 15, further comprising: An abnormality analysis module, used to record the operation behavior of the session and obtain a behavior log; wherein each record in the behavior log contains the operation instruction and the second identity information, and the second identity information is obtained by the authority authentication interface; Sending the behavior log to the behavior audit anomaly detection module for abnormal behavior analysis; Based on the abnormal behavior analysis results, an abnormal behavior alert or report is obtained.

17. A container access control device, applied to a container, comprising: The negotiation module is used to call the bastion host SDK to negotiate with the bastion host proxy module to obtain the shared key of the current session; A request module, used to send a credential acquisition request to the bastion host proxy module to obtain an encrypted identity credential; wherein the identity credential is associated with the current session; The decryption module is used to decrypt the identity certificate using the shared key in the current working process to obtain the identity certificate.

18. The device according to claim 17, wherein: The negotiation module is used for: Call the bastion host SDK to obtain the first public key of the current session; Generate a second private key and a second public key; A shared key for the current session is obtained according to the second private key and the first public key.

19. The device according to claim 18, wherein: The negotiation module is used for: According to the process tree relationship, determine the startup parameters of the root process of the current working process; According to the startup parameters, obtaining session characteristics of the current session; A first public key is obtained according to the session characteristics.

20. The device according to claim 18, wherein The credential acquisition request includes the second public key.

21. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 10.

22. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-10.

23. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 10.

Images