Container access control method, device, apparatus and storage medium

Abstract

The present disclosure provides a container access control method, device, equipment and storage medium, relates to the technical field of computers, and particularly relates to the fields of container technology and cloud technology. A specific implementation scheme is as follows: in response to a session request, authenticating first identity information contained in the session request; in the case that the identity authentication is passed, obtaining identity credentials of a current session; obtaining starting parameters of a root process according to a session feature of the current session; sending a resource creation request containing the starting parameters to a container orchestration system to create a resource running the current session; and in response to a credential acquisition request of any worker process, sending identity credentials of a target session associated with the worker process to the worker process after the identity credentials are encrypted. According to the present disclosure, secure and trusted transmission of identity credentials of a container session isolation level can be implemented.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to container technology and cloud technology. Background Art

[0002] Kubernetes (k8s) is an open-source container orchestration system used to automate the deployment, scaling, and management of containerized applications. Kubernetes is also a key component of cloud technology, providing the ability to manage and orchestrate containerized applications in cloud environments. Container security directly impacts the security of information technology (IT) assets and production data within an enterprise's production environment. Container security measures often involve image security, container isolation, host security, access control, and auditing. Container bastion hosts help enterprises achieve secure operations and maintenance of IT assets, such as production servers, within Kubernetes cluster cloud environments through access control and auditing, as well as exception alarms. This ensures data security and ultimately improves the security of Kubernetes clusters. Summary of the Invention

[0003] The present disclosure provides a container access control method, apparatus, device, and storage medium.

[0004] According to one aspect of the present disclosure, a container access control method is provided, which is applied to a bastion host and includes:

[0005] In response to the session request, authenticating the first identity information included in the session request;

[0006] If the identity authentication is successful, the identity credentials of the current session are obtained;

[0007] According to the session characteristics of the current session, the startup parameters of the root process are obtained;

[0008] Send a resource creation request containing startup parameters to the container orchestration system to create resources to run the current session;

[0009] In response to a credential acquisition request from any work process, the identity credential of the target session associated with the work process is encrypted and sent to the work process.

[0010] According to another aspect of the present disclosure, a container access control method is provided, which is applied to a container and includes:

[0011] Call the bastion host SDK to negotiate with the bastion host proxy module to obtain the shared key for the current session;

[0012] Send a credential acquisition request to the bastion host proxy module to obtain the encrypted identity credentials; the identity credentials are associated with the current session;

[0013] Decrypt the identity credential using the shared key within the current working process to obtain the identity credential.

[0014] According to another aspect of the present disclosure, a container access control device is provided, which is applied to a bastion host and includes:

[0015] an authentication module, configured to, in response to a session request, authenticate the first identity information included in the session request;

[0016] The credential determination module is used to obtain the identity credential of the current session if the identity authentication is successful;

[0017] A parameter determination module is used to obtain the startup parameters of the root process according to the session characteristics of the current session;

[0018] The sending module is used to send a resource creation request containing startup parameters to the container orchestration system to create resources for running the current session;

[0019] The encryption module is used to respond to a credential acquisition request of any work process, encrypt the identity credential of the target session associated with the work process and send it to the work process.

[0020] According to another aspect of the present disclosure, a container access control device is provided, which is applied to a container and includes:

[0021] The negotiation module is used to call the bastion host SDK and negotiate with the bastion host proxy module to obtain the shared key for the current session;

[0022] The request module is used to send a credential acquisition request to the bastion host proxy module to obtain an encrypted identity credential; wherein the identity credential is associated with the current session;

[0023] The decryption module is used to decrypt the identity credential using the shared key in the current working process to obtain the identity credential.

[0024] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0025] at least one processor; and

[0026] a memory communicatively connected to the at least one processor; wherein,

[0027] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform any method in the embodiments of the present disclosure.

[0028] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any method according to the embodiments of the present disclosure.

[0029] According to another aspect of the present disclosure, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the computer program implements any one of the methods according to the embodiments of the present disclosure.

[0030] According to the present disclosure, secure and trusted transmission of identity credentials at the container session isolation level can be achieved.

[0031] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0033] Figure 1 is an exemplary system architecture according to an embodiment of the present disclosure;

[0034] Figure 2 is a flowchart of a container access control method according to an embodiment of the present disclosure;

[0035] Figure 3 is a flowchart of a container access control method according to another embodiment of the present disclosure;

[0036] Figure 4 is a flowchart of a method for securely transmitting identity credentials according to an embodiment of the present disclosure;

[0037] Figure 5 is a structural diagram of a container access control device according to an embodiment of the present disclosure;

[0038] Figure 6 is a structural diagram of a container access control device according to another embodiment of the present disclosure;

[0039] Figure 7 is a block diagram of an electronic device for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0040] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0041] Figure 1 An exemplary system architecture 100 is shown to which an embodiment of the container access control method or container access control apparatus disclosed herein may be applied.

[0042] like Figure 1 As shown, system architecture 100 may include a container bastion host 110 and a Kubernetes cluster 120. Container bastion host 110 and Kubernetes cluster 120 communicate with each other via a network. The network may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0043] Users can use terminal devices (such as smartphones, tablets, laptops, etc.) to interact with the container bastion host 110 over the network to log in to and operate containers in the Kubernetes cluster 120. Various client applications can be installed on the terminal devices, such as web browser applications, remote desktop applications, SSH clients, etc.

[0044] The container bastion host 110 can include the following components:

[0045] Console: Users log in to the container bastion host through the console and perform various operations and management tasks through the console.

[0046] Bastion host proxy module: The bastion host proxy acts as an intermediary between the user and the container environment, responsible for processing user requests, managing sessions, recording behaviors, etc. The bastion host proxy communicates with the console, the behavior audit anomaly detection module, and the third-party user authority system interface 130 through the network.

[0047] Behavior audit anomaly detection module: This module is responsible for monitoring and recording user operations on the container bastion host, and detecting and issuing warnings for abnormal behaviors.

[0048] Kubernetes cluster 120 can be a distributed cluster consisting of multiple servers or a single server. Kubernetes cluster 120 includes an application programming interface server (API server) and other components for managing the lifecycle, scaling, updating, and maintenance of containers. API server 121 can communicate with the bastion proxy server over the network.

[0049] The terminal device can be hardware or software. When the terminal device is hardware, it can be various electronic devices with a display screen and supporting web browsing or remote connection, including but not limited to smartphones, tablet computers, laptops, desktop computers, etc. When the terminal device is software, it can be installed in the electronic devices listed above. It can be implemented as multiple software or software modules (for example, to provide distributed services), or it can be implemented as a single software or software module. No specific limitation is made here.

[0050] It should be noted that the container bastion host 110 can be a server in a distributed system or a server integrated with blockchain. The container bastion host can also be a cloud server or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology.

[0051] It should be understood that Figure 1 The number of users, networks, bastion servers, Kubernetes container groups (Pods), and nodes shown in the diagram is for illustrative purposes only. Any number of devices, networks, servers, Kubernetes nodes, and Pods can be used as needed.

[0052] Figure 2 This is a flow chart of a container access control method provided according to an embodiment of the present disclosure, which is applied to a bastion host. Figure 2 As shown, the method comprises at least the following steps:

[0053] S201: In response to a session request, authenticate first identity information included in the session request.

[0054] In this embodiment, the container bastion host serves as the unified login portal for the entire Kubernetes cluster. Users submit session requests through the console. Session requests include at least the user's primary identity information, which can be the login account information used to log in to the console. Users can submit session requests through the console's graphical interface or through the command line.

[0055] The bastion host console communicates with the bastion host proxy using the WebSocket protocol, providing a visual command interface. Services can also connect to the bastion host proxy using the WebSocket protocol from any interface to send session requests to the bastion host proxy.

[0056] After receiving a session request, the bastion proxy can forward the request to a third-party user permission system for identity authentication. The user permission system is responsible for issuing and authenticating user identity credentials and managing user resource permissions.

[0057] S202: If the identity authentication is successful, obtain the identity credential of the current session.

[0058] In this embodiment, after identity authentication is successful, the third-party user permission system generates a session credential and passes it to the container bastion host through the bastion host proxy. The container bastion host can store the session credential for subsequent access control and permission management.

[0059] S203: Obtain startup parameters of the root process according to the session characteristics of the current session.

[0060] In this embodiment, when a user logs in, the bastion host proxy attaches the session characteristics of the current session to the root process of the container to be created. Session characteristics may include the session ID (sessionId), process ID (pid), user name, session start timestamp, etc. Attaching one or more of these characteristics to the process as startup parameters is used for subsequent process management and resource access control.

[0061] S204: Send a resource creation request including startup parameters to the container orchestration system to create resources for running the current session.

[0062] In this example, the bastion proxy forwards a resource creation request, including startup parameters, to the Kubernetes cluster's API server. Based on the request, the Kubernetes cluster creates the corresponding resources, such as containers and pods, to support the current session. The bastion proxy also passes session-related characteristics to the container and appends them to the root process startup parameters generated by the session.

[0063] S205 : In response to a credential acquisition request from any work process, encrypt the identity credential of the target session associated with the work process and send it to the work process.

[0064] In this embodiment, when any working process in the container needs to access the identity credentials of the current session, it will send a credential acquisition request to the bastion host Proxy. The bastion host Proxy responds to the request, encrypts the identity credentials of the target session associated with the working process, and then passes the current identity credentials to the container through a security protocol, and only applies to the current operation session. The identity credentials are encrypted to ensure the security of the credentials and prevent unauthorized access. The container session-level isolation feature ensures that the identity credentials are invisible to other users of the same container and are only visible to the current operating user. The current container operation session holds the identity credentials of the currently logged-in user, and the container can implement access control and auditing of file resources inside the container based on user identity, which greatly improves the security of container operation and maintenance and ensures the security of data inside the container.

[0065] According to the solution of the embodiment of the present disclosure, secure and trusted transmission of identity credentials at the container session isolation level is achieved.

[0066] In a possible implementation, S203: obtaining the startup parameters of the root process according to the session characteristics of the current session further includes the steps of:

[0067] Generate the first public key and first private key for the current session.

[0068] A session feature of the current session is obtained according to the first public key and at least one of a session ID, a process ID, a user name, and a session start timestamp.

[0069] Get the startup parameters of the root process based on the session characteristics.

[0070] In this disclosed embodiment, when a user logs in to a container bastion host through the console, the bastion host proxy generates a first public key and a first private key for the current session. This process can use existing encryption algorithms, such as RSA and ECDSA. The first public key is used to encrypt communications and ensure session security, while the first private key is used for decryption and signing.

[0071] The bastion proxy generates session characteristics for the current session based on at least one of the following information:

[0072] Session ID (sessionId): uniquely identifies the current session.

[0073] Process ID (pid): The unique identifier of the root process of the current session.

[0074] Username: The username of the logged-in user.

[0075] Session start timestamp: The timestamp when the current session starts.

[0076] The bastion host proxy combines this information with the first public key to generate a string or data structure containing the current session's characteristics, which it then uses as startup parameters for the root process. The root process generated by the current session and any subsequent child processes derived from it can retrieve these startup parameters based on the process tree, thereby obtaining the session characteristics of the current session.

[0077] According to the solution of the embodiment of the present disclosure, the characteristics related to the current session are passed into the container and attached to the root process startup parameters generated by the session, which can ensure the correct transmission and use of the session characteristics within the container, thereby realizing subsequent access control and permission management.

[0078] In one possible implementation, S205: in response to a credential acquisition request from any work process, encrypting the identity credential of the target session associated with the work process and sending it to the work process further includes the steps of:

[0079] In response to a credential acquisition request of any work process, a target session associated with the work process is determined according to session characteristics.

[0080] Generate a shared key based on the first private key of the target session and the second public key included in the credential acquisition request.

[0081] The target session's credentials are encrypted using a shared key.

[0082] Send the encrypted credentials to the worker process.

[0083] In the disclosed embodiment, the bastion host proxy may have multiple ongoing sessions at the same time. When a worker process within a container needs to obtain identity credentials, it sends a credential acquisition request to the bastion host proxy. After receiving the request, the bastion host proxy first determines the target session associated with the worker process based on the session characteristics. The bastion host proxy compares the worker process's characteristic information with the characteristic information of the current session to determine which session the worker process belongs to, thereby determining the target session.

[0084] The bastion proxy generates a shared key using the target session's first private key and the second public key included in the credential acquisition request sent by the worker process. This shared key can be generated using existing key exchange algorithms, such as Diffie-Hellman or ECDH (Elliptic Curve Diffie-Hellman). This shared key generation process ensures that only the worker process and the bastion proxy know the key.

[0085] The bastion proxy uses the generated shared key to encrypt the target session's identity credentials. Symmetric encryption algorithms, such as the Advanced Encryption Standard (AES), can be used for encryption. This encryption ensures that the identity credentials are protected from unauthorized third parties during transmission.

[0086] The bastion proxy sends the encrypted credentials to the worker process via the bastion software development kit (SDK). The bastion SDK works with the bastion proxy to ensure the encrypted credentials are securely delivered to the worker process. After receiving the encrypted credentials, the worker process decrypts them using the shared key to obtain the credentials for the target session.

[0087] An SDK is a set of tools used by software developers when building applications. It typically includes the following: an API (Application Programming Interface), precompiled code libraries, documentation, sample code, and more.

[0088] According to the solution of the embodiment of the present disclosure, the bastion host proxy can securely pass the identity credentials of the target session when responding to the credential acquisition request of the working process, ensuring the security and flexibility of access control. The working process can use the decrypted identity credentials for resource access and permission management, which greatly improves the security of container operation and maintenance and ensures the security of data inside the container.

[0089] In one possible implementation, the second public key is generated by the worker process calling the bastion host SDK.

[0090] In the disclosed embodiment, when a worker process within a container needs to access the identity credentials of the current session, it will call the bastion host SDK to generate a second public key and a second private key. The bastion host SDK can use existing encryption algorithms, such as RSA and the Elliptic Curve Digital Signature Algorithm (ECDSA), to generate a new pair of public and private keys. The generated second public key is used to encrypt communications, ensuring secure communication with the bastion host proxy, while the second private key is used for decryption and signing.

[0091] The worker process sends the generated second public key to the bastion proxy through the bastion SDK. The bastion SDK encapsulates the second public key in a credential acquisition request and sends the request to the bastion proxy over the network. After receiving the credential acquisition request, the bastion proxy extracts the second public key.

[0092] According to the solution of the embodiment of the present disclosure, the working process can generate a second public key by calling the bastion host SDK and send it to the bastion host Proxy. The bastion host Proxy uses the first private key of the target session and the second public key sent by the working process to generate a shared key, ensuring the security and integrity of the identity credentials during transmission.

[0093] In a possible implementation, S201 responds to a session request and authenticates the first identity information included in the session request, further comprising the steps of:

[0094] In response to the session request from the console, the first identity information included in the session request is sent to the authority authentication interface.

[0095] Get the authentication result returned by the permission authentication interface.

[0096] In the embodiment of the present disclosure, when a user submits a session request through the console, the console communicates with the bastion host Proxy based on the WebSocket protocol. After the bastion host Proxy receives the session request, it extracts the first identity information (such as user name, password, certificate, etc.) in the request, and communicates with the interface of the third-party user authority system through the bastion host Proxy. The bastion host Proxy encapsulates the first identity information in the request and sends it to the authority authentication interface. The authority authentication interface can be an API interface provided by the third-party user authority system, which is used to verify the user's identity and authority, the issuance and authentication of identity credentials, and the management of user resource permissions.

[0097] After the authorization authentication interface completes the verification, it returns the authentication result to the bastion proxy. The authentication result may include the following:

[0098] Authentication successful: The user identity verification is successful and has the corresponding permissions.

[0099] Authentication failed: User identity verification failed or user permissions are insufficient.

[0100] After receiving the result from the authentication API, the bastion proxy decides whether to allow the user to proceed based on the result. If authentication succeeds, the bastion proxy generates session credentials and proceeds with subsequent steps. If authentication fails, the bastion proxy rejects the user's session request and returns an error message.

[0101] It should be noted that, depending on the system design and security requirements, in a containerized environment, identity credentials can be generated by a third-party user permission system or by the bastion host proxy. Specifically:

[0102] If a proxy (such as a container bastion or API Gateway) is responsible for handling user authentication and authorization, it may generate identity credentials after successful authentication. You can directly control the generation and lifecycle of credentials, enabling fine-grained access control at the proxy level. The proxy can generate identity credentials in the form of session cookies, JWTs (JSON Web Tokens), OAuth tokens, and other formats, and pass them to users or worker processes.

[0103] If the system uses external authentication services (such as OAuth, SAML, LDAP, etc.), these services usually generate identity credentials. Leveraging existing mature authentication and authorization systems improves security and reliability and can be integrated with the company's existing identity management system to achieve single sign-on (SSO).

[0104] After the user logs in through the external authentication service, they obtain identity credentials (such as OAuth tokens, SAML assertions, etc.). These credentials can be passed to the Proxy or directly to the application or worker process.

[0105] Furthermore, in some complex systems, the Proxy may collaborate with a third-party authentication system. The Proxy performs preliminary identity authentication and then redirects the user to the third-party authentication service for further authentication and authorization. Combining the flexibility of the Proxy with the security of the external authentication service, different authentication methods can be selected based on different needs and scenarios. The Proxy may generate temporary credentials when the user logs in, which the user uses to access the third-party authentication service. After successful authentication, the service returns a formal identity credential to the Proxy, which then passes this credential to the worker process or application.

[0106] According to the solution of the embodiment of the present disclosure, the bastion host proxy can respond to the session request of the console, obtain the identity authentication result by communicating with the permission authentication interface of the third-party user permission system, and collaborate with the third-party user permission system in a low-cost, convenient and fast manner to ensure the legitimacy of the user identity and the validity of the permission.

[0107] In a possible implementation, the method further includes the steps of:

[0108] The operation behavior of the session is recorded to obtain a behavior log; wherein each record in the behavior log contains an operation instruction and a second identity information, and the second identity information is obtained from the authority authentication interface.

[0109] Send the behavior log to the behavior audit anomaly detection module for abnormal behavior analysis.

[0110] Based on the abnormal behavior analysis results, abnormal behavior alerts or reports are obtained.

[0111] In the disclosed embodiment, the bastion host Proxy records the operational behavior of the session in real time and generates a behavioral log. The behavioral log includes information such as the executed commands, the accessed resources, and the timestamp of the operation. In addition, each record contains a second identity information, which can be obtained by the permission authentication interface of the third-party permission system, rather than relying on the first identity information provided by the console. The third-party permission system usually provides more accurate and comprehensive user identity information. By recording the identity information of the third-party permission system, the Proxy can ensure that each operation behavior is associated with the correct user identity, avoiding identity authentication problems caused by inaccurate or expired identity information provided by the console. The third-party permission system usually contains information such as the user's role and permission level. By recording this information, the Proxy can perform more fine-grained access control and behavior auditing based on the user's specific permissions, ensuring that the user can only perform operations within the scope of their permissions, thereby improving the security of the system.

[0112] The bastion host proxy sends the recorded behavior logs to the behavior audit and anomaly detection module through the internal communication mechanism or API. The frequency of sending behavior logs can be real-time or periodic (such as every minute, every hour, etc.). The behavior audit anomaly detection module receives the behavior logs and performs abnormal behavior analysis. The behavior logs can be analyzed according to the resource permissions and preset abnormal behavior rules specified by the third-party permission system. The analysis process includes detecting unauthorized access, abnormal operation frequency, illegal command execution and other behaviors. Abnormal behavior rules can be defined and implemented according to the level of business security requirements. If abnormal behavior is found, an abnormal behavior alarm or report can be issued or the session can be immediately interrupted.

[0113] The solutions according to the embodiments of the present disclosure can enhance the security of the system, improve the accuracy and efficiency of auditing, and also provide a solid foundation for subsequent security incident investigations and compliance checks.

[0114] Figure 3 This is a flow chart of a container access control method provided by another embodiment of the present disclosure, which is applied to a container. Figure 3 As shown, the method comprises at least the following steps:

[0115] S301. Call the bastion host SDK to negotiate with the bastion host proxy module to obtain the shared key of the current session.

[0116] In this embodiment, when a worker process in a container needs to access resources in the current session, it calls the bastion host SDK. The bastion host SDK communicates with the bastion host proxy via the WebSocket protocol to negotiate and generate a shared key for the current session.

[0117] S302: Send a credential acquisition request to the bastion host proxy module to obtain an encrypted identity credential, wherein the identity credential is associated with the current session.

[0118] In this embodiment, the worker process sends a credential acquisition request to the bastion server proxy through the bastion server SDK. The credential acquisition request includes session characteristics of the current session, which can include at least one of the following: session ID, process ID, user name, session start timestamp, etc.

[0119] After receiving the credential request, the bastion host proxy determines the target session associated with the worker process based on the session characteristics and encrypts the target session's identity credentials using the shared key. The encrypted identity credentials are then sent to the worker process via the bastion host SDK.

[0120] S303: Decrypt the identity certificate using the shared key in the current working process to obtain the identity certificate.

[0121] In the disclosed embodiment, after receiving the encrypted identity credential, the work process uses the shared key generated by negotiation in step S301 to decrypt it to obtain the original identity credential. The work process performs access control and authority management based on the decrypted identity credential.

[0122] According to the solution of the embodiment of the present disclosure, the working process on the container side can generate a shared key by calling the bastion host SDK and negotiating with the bastion host Proxy, and use the shared key to decrypt the identity credentials, ensuring the security of access control and data security within the container, and realizing the secure and reliable transmission of identity credentials at the container session isolation level.

[0123] In one possible implementation, S301 calls the bastion host SDK to negotiate with the bastion host agent module to obtain a shared key for the current session, further including the following steps:

[0124] Call the bastion host SDK to obtain the first public key of the current session.

[0125] A second private key and a second public key are generated.

[0126] A shared key for the current session is obtained based on the second private key and the first public key.

[0127] In an embodiment of the present disclosure, the working process can query the startup parameters of the root process through the process tree relationship. The startup parameters include the first public key of the target session corresponding to the working process. The working process extracts the first public key from the startup parameters of the root process and prepares it for subsequent key exchange.

[0128] The bastion host SDK can use existing encryption algorithms, such as RSA and ECDSA, to generate a second public key and a second private key. The generated second public key is used to encrypt communications with the bastion host proxy, ensuring secure communication with it, while the second private key is used for decryption and signing.

[0129] The worker process uses the obtained first public key and the generated second private key to generate a shared key for the current session. The shared key can be generated using an existing key exchange algorithm, such as Diffie-Hellman key exchange or ECDH.

[0130] The worker process uses the second private key and the first public key to perform a key exchange via the bastion host SDK. The key exchange algorithm calculates a shared key known to both parties.

[0131] According to the solution of the embodiment of the present disclosure, the working process can generate a shared key for the current session by calling the bastion host SDK and negotiating with the bastion host Proxy, ensuring the security of identity credential transmission and the effectiveness of encryption.

[0132] In one possible implementation, calling the bastion host SDK to obtain the first public key of the current session further includes the following steps:

[0133] According to the process tree relationship, determine the startup parameters of the root process of the current working process.

[0134] Get the session characteristics of the current session based on the startup parameters.

[0135] A first public key is obtained according to the session characteristics.

[0136] In this embodiment, when a worker process in a container needs to access resources in the current session, it will call the bastion host SDK. The bastion host SDK obtains the startup parameters of the root process of the current worker process through the process tree relationship. The acquisition process includes:

[0137] The worker process calls the system API in the bastion host SDK to obtain the process ID of the current worker process.

[0138] Traverse the process tree according to the process ID, determine the process ID of its parent process based on the process ID of the current working process, and search upward level by level until the process ID of the root process is found.

[0139] Get the startup parameters of the root process based on its process ID. The startup parameters contain the session characteristics of the current session.

[0140] The working process can extract the first public key from the session characteristics. The first public key can be directly included in the session characteristics and calculated based on other information in the session characteristics. The session characteristic information includes the generation rules or parameters of the first public key. The working process calculates the first public key based on this information.

[0141] In another implementation method, when the working process uses the bastion host SDK to negotiate the key with the bastion host Proxy, the session ID, user name and other parameters in the session characteristics can be used to find the corresponding target session on the bastion host Proxy, and the bastion host Proxy obtains the corresponding first public key.

[0142] According to the solution of the embodiment of the present disclosure, the working process can obtain the startup parameters of the root process from the process tree relationship by calling the bastion host SDK, extract the session characteristics, and obtain the first public key of the current session from it; within the same container, the identity credentials have session isolation, that is, the credentials of the current session are invisible to other session users of the same container.

[0143] In a possible implementation, the credential acquisition request includes the second public key.

[0144] Figure 4 FIG. 1 is a flow chart of a secure transmission method of identity credentials according to an embodiment of the present disclosure. Figure 4 As shown, the method includes the following steps:

[0145] Step 1: When a user logs in, the bastion host proxy generates a pair of public and private keys, a (private key) and A (public key), for the current session. The bastion host proxy also attaches the current session characteristics to the process. These characteristics include the session ID (sessionId), process ID (pid), username, session start timestamp, and public key A, which is used as startup parameters for the session root process and then attached to the process.

[0146] Step 2: After the session is established, when the user logs into the container, all the working processes started are child processes of the session root process.

[0147] Step 3: Based on the Linux process tree relationship, the working process can use the bastion host SDK to obtain the characteristics of the current session.

[0148] Step 4: The bastion host SDK generates a pair of public and private keys, b (private key) and B (public key), and then shares public key B with the bastion host proxy. The bastion host and bastion host proxy use the Diffie-HellMan protocol to exchange shared keys based on the current session characteristics, including:

[0149] 1) The bastion proxy generates a shared key p based on the private key a and the public key B;

[0150] 2) The bastion host SDK generates a shared key p based on the private key b and the public key A.

[0151] Step 5: The bastion host SDK obtains the user credentials encrypted with the shared key from the bastion host proxy and decrypts them using the shared key within the current working process.

[0152] During the security protocol described above, if the worker process does not use the bastion host SDK, a shared key cannot be negotiated and user credentials cannot be obtained. If the worker process uses the bastion host SDK, the SDK only retrieves the characteristics of the corresponding session during startup and cannot retrieve the PID used to initiate other user sessions. Even if the PID and session ID are visible to other users in the same container, this is irrelevant because other users cannot modify the worker process tree.

[0153] The solution according to the embodiment of the present disclosure has at least the following effects:

[0154] 1. It can ensure that each session has an independent shared key, further ensuring the session-level isolation of user identity credentials, and ultimately ensuring that the transmission process of user identity credentials is safe and reliable and will not be leaked.

[0155] 2. The container bastion host ensures reliable transmission of user identity credentials and performs access control and auditing on the entire container operation and maintenance process. At the same time, the container can further perform internal resource permission control based on the current session user identity credentials, ultimately ensuring the security of Kubernetes cluster operation and maintenance.

[0156] It should be noted that common container login and maintenance methods include the following three:

[0157] 1) Log in to the container using the Kubernetes native container login method. This method uses authentication and permission management based on Kubernetes' RBAC control method.

[0158] 2) Start a program that simulates a terminal process (such as PtyProcess) in the container and communicate with a front-end program (such as xterm.js) via the WebSocket protocol to log in to the container. Common products include CodeLab Terminal.

[0159] 3) Log in to view the container operation log based on the webssh solution.

[0160] Compared with the above-mentioned solutions, the technical solutions provided by any embodiment of the present disclosure have the following advantages:

[0161] 1. It can quickly and easily connect with the existing business permission system at low cost, preventing the leakage of native Kubernetes credentials.

[0162] The container bastion host solution adds a proxy to the socket connection channel between the console and the container. The proxy is responsible for user authentication and permission management. The proxy side can directly adopt the business's existing permission authentication and management system, without any modification to adapt to the Kubernetes permission system. The proxy also centrally manages Kubernetes cluster login credentials, converging credential exposure from the original user side to the proxy side, significantly reducing the risk of credential leakage.

[0163] 2. Trusted delivery of identity credentials at the container session isolation level.

[0164] After user authentication and authorization on the proxy side, the container bastion host passes the current user's credentials to the container via a secure protocol. These credentials are only visible to the current user in the current operation session, making them invisible to other users of the same container. The current container operation session holds the credentials of the currently logged-in user, enabling user-identity-based access control and auditing of file resources within the container. This significantly improves container operation and maintenance security and ensures data security within the container.

[0165] 3. The entire container operation and maintenance process is safe and controllable.

[0166] Compared to solutions 2 and 3, which make it difficult to audit user operations, the container bastion host adds user identity authentication, permission control, and behavior auditing to the proxy side. This solution ensures a secure and controllable full process from pre-authorization, in-process monitoring, to post-audit.

[0167] It's important to note that the secure and trusted transmission of credentials at the container session isolation level requires that users within the current session cannot forge the credentials of other users. Within the same container, user credentials are session-isolated, meaning that the user credentials of the current session are invisible to users in other sessions within the same container.

[0168] Figure 5 This is a schematic diagram of the structure of a container access control device provided according to an embodiment of the present disclosure, which is applied to a bastion host. Figure 5 As shown, the device 500 at least includes:

[0169] The authentication module 501 is configured to respond to a session request and authenticate the first identity information included in the session request.

[0170] The credential determination module 502 is used to obtain the identity credential of the current session when the identity authentication is successful.

[0171] The parameter determination module 503 is used to obtain the startup parameters of the root process according to the session characteristics of the current session.

[0172] The sending module 504 is configured to send a resource creation request including startup parameters to the container orchestration system to create resources for running the current session.

[0173] The encryption module 505 is configured to respond to a credential acquisition request from any work process, encrypt the identity credential of the target session associated with the work process, and then send the encrypted credential to the work process.

[0174] In a possible implementation, the parameter determination module 503 is configured to:

[0175] Generate the first public key and first private key for the current session.

[0176] A session feature of the current session is obtained according to the first public key and at least one of a session ID, a process ID, a user name, and a session start timestamp.

[0177] Get the startup parameters of the root process based on the session characteristics.

[0178] In one possible implementation, the encryption module 505 is configured to:

[0179] In response to a credential acquisition request of any work process, a target session associated with the work process is determined according to session characteristics.

[0180] Generate a shared key based on the first private key of the target session and the second public key included in the credential acquisition request.

[0181] The target session's credentials are encrypted using a shared key.

[0182] Send the encrypted credentials to the worker process.

[0183] In one possible implementation, the second public key is generated by the worker process calling the bastion host SDK.

[0184] In one possible implementation, the authentication module 501 is configured to:

[0185] In response to the session request from the console, the first identity information included in the session request is sent to the authority authentication interface.

[0186] Get the authentication result returned by the permission authentication interface.

[0187] In a possible implementation, the device further includes an anomaly analysis module configured to:

[0188] The operation behavior of the session is recorded to obtain a behavior log, wherein each record in the behavior log includes the operation instruction and the second identity information, and the second identity information is obtained by the authority authentication interface.

[0189] The behavior log is sent to the behavior audit anomaly detection module for abnormal behavior analysis.

[0190] Based on the abnormal behavior analysis results, abnormal behavior alerts or reports are obtained.

[0191] Figure 6 This is a schematic diagram of the structure of a container access control device provided according to another embodiment of the present disclosure, which is applied to a container. Figure 6 As shown, the device 600 at least includes:

[0192] The negotiation module 601 is used to call the bastion host SDK and negotiate with the bastion host agent module to obtain the shared key of the current session.

[0193] The request module 602 is used to send a credential acquisition request to the bastion host proxy module to obtain an encrypted identity credential, wherein the identity credential is associated with the current session.

[0194] The decryption module 603 is used to decrypt the identity certificate using the shared key in the current working process to obtain the identity certificate.

[0195] In a possible implementation, the negotiation module 601 is configured to:

[0196] Call the bastion host SDK to obtain the first public key of the current session.

[0197] A second private key and a second public key are generated.

[0198] A shared key for the current session is obtained based on the second private key and the first public key.

[0199] In a possible implementation, the negotiation module 601 is configured to:

[0200] According to the process tree relationship, determine the startup parameters of the root process of the current working process.

[0201] Get the session characteristics of the current session based on the startup parameters.

[0202] A first public key is obtained according to the session characteristics.

[0203] In a possible implementation, the credential acquisition request includes the second public key.

[0204] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, please refer to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0205] In the technical solutions disclosed herein, the acquisition, storage, and application of user personal information involved comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0206] According to embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0207] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present disclosure described and / or claimed in this document.

[0208] As shown in Figure 7 The device 700 includes a computing unit 701 that can perform various appropriate actions and processes in accordance with a computer program stored in a read-only memory (ROM) 702 or a computer program loaded into a random access memory (RAM) 703 from a storage unit 708. Various programs and data required for the operation of the device 700 can also be stored in the RAM 703. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0209] Various components in the device 700 are connected to the I / O interface 705, including an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0210] The computing unit 701 can be a variety of general-purpose and / or specialized processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as the container access control method. For example, in some embodiments, the container access control method can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the container access control method described above can be performed. Alternatively, in other embodiments, the computing unit 701 can be configured to perform the container access control method by any other suitable means (e.g., by means of firmware).

[0211] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system comprising at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0212] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0213] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0214] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0215] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0216] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0217] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not limited herein.

[0218] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A container access control method, applied to a bastion host, comprising: In response to the session request, authenticating the first identity information included in the session request; If the identity authentication is successful, obtain the identity credentials of the current session; Obtaining startup parameters of a root process according to session characteristics of the current session; Sending a resource creation request including the startup parameters to a container orchestration system to create resources for running the current session; In response to a credential acquisition request from any work process, the identity credential of the target session associated with the work process is encrypted and sent to the work process.

2. The method according to claim 1, wherein The step of obtaining the startup parameters of the root process according to the session characteristics of the current session includes: Generate a first public key and a first private key for the current session; Obtaining a session feature of the current session based on the first public key and at least one of a session ID, a process ID, a user name, and a session start timestamp; According to the session characteristics, startup parameters of the root process are obtained.

3. The method according to claim 1 or 2, wherein: The step of responding to a credential acquisition request of any work process, encrypting the identity credential of the target session associated with the work process and sending the credential to the work process, comprises: In response to a credential acquisition request of any work process, determining a target session associated with the work process based on the session characteristics; generating a shared key based on the first private key of the target session and the second public key included in the credential acquisition request; encrypting the identity credentials of the target session using the shared key; Send the encrypted identity credential to the work process.

4. The method according to claim 3, wherein: The second public key is generated by the worker process calling the bastion machine software development kit SDK.

5. The method according to claim 1, wherein The step of authenticating the first identity information included in the session request in response to the session request includes: In response to a session request from the console, sending the first identity information included in the session request to the authority authentication interface; Get the authentication result returned by the authorization interface.

6. The method according to claim 5, further comprising: Recording the operation behavior of the session to obtain a behavior log; wherein each record in the behavior log contains the operation instruction and the second identity information, and the second identity information is obtained by the authority authentication interface; Sending the behavior log to the behavior audit anomaly detection module for abnormal behavior analysis; Based on the abnormal behavior analysis results, abnormal behavior alerts or reports are obtained.

7. A container access control method, applied to a container, comprising: Call the bastion host SDK to negotiate with the bastion host proxy module to obtain the shared key for the current session, including: Call the bastion host SDK to obtain the first public key of the current session; Generate a second private key and a second public key; Obtaining a shared key for the current session based on the second private key and the first public key; Sending a credential acquisition request to the bastion host proxy module to obtain an encrypted identity credential; wherein the identity credential is associated with the current session; Decrypting the identity credential using the shared key in the current working process to obtain the identity credential; The calling of the bastion host SDK to obtain the first public key of the current session includes: According to the process tree relationship, determine the startup parameters of the root process of the current working process; Obtaining session characteristics of the current session according to the startup parameters; A first public key is obtained according to the session characteristics.

8. The method according to claim 7, wherein: The credential acquisition request includes the second public key.

9. A container access control device, applied to a bastion host, comprising: an authentication module, configured to, in response to a session request, authenticate the first identity information included in the session request; A credential determination module, configured to obtain the identity credential of the current session if the identity authentication passes; A parameter determination module, configured to obtain startup parameters of a root process based on session characteristics of the current session; A sending module, configured to send a resource creation request including the startup parameters to a container orchestration system to create resources for running the current session; The encryption module is used to respond to a credential acquisition request of any work process, encrypt the identity credential of the target session associated with the work process and send it to the work process.

10. The device according to claim 9, wherein The parameter determination module is used to: Generate a first public key and a first private key for the current session; Obtaining a session feature of the current session based on the first public key and at least one of a session ID, a process ID, a user name, and a session start timestamp; According to the session characteristics, startup parameters of the root process are obtained.

11. The device according to claim 9 or 10, wherein: The encryption module is used for: In response to a credential acquisition request of any work process, determining a target session associated with the work process based on the session characteristics; generating a shared key based on the first private key of the target session and the second public key included in the credential acquisition request; encrypting the identity credentials of the target session using the shared key; Send the encrypted identity credential to the work process.

12. The device according to claim 11, wherein The second public key is generated by the worker process calling the bastion host SDK.

13. The apparatus according to claim 9, wherein the authentication module is configured to: In response to a session request from the console, sending the first identity information included in the session request to the authority authentication interface; Get the authentication result returned by the authorization interface.

14. The apparatus according to claim 13, further comprising: An anomaly analysis module, configured to record the operation behavior of the session and obtain a behavior log; wherein each record in the behavior log contains the operation instruction and the second identity information, and the second identity information is obtained by the authority authentication interface; Sending the behavior log to the behavior audit anomaly detection module for abnormal behavior analysis; Based on the abnormal behavior analysis results, abnormal behavior alerts or reports are obtained.

15. A container access control device, applied to a container, comprising: The negotiation module is used to call the bastion host SDK and negotiate with the bastion host proxy module to obtain the shared key for the current session; The negotiation module is used to: Call the bastion host SDK to obtain the first public key of the current session; Generate a second private key and a second public key; Obtaining a shared key for the current session based on the second private key and the first public key; A request module, configured to send a credential acquisition request to the bastion host proxy module to obtain an encrypted identity credential; wherein the identity credential is associated with the current session; A decryption module, configured to decrypt the identity credential using the shared key within the current working process to obtain the identity credential; The negotiation module is used to: According to the process tree relationship, determine the startup parameters of the root process of the current working process; Obtaining session characteristics of the current session according to the startup parameters; A first public key is obtained according to the session characteristics.

16. The device according to claim 15, wherein The credential acquisition request includes the second public key.

17. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 8.

18. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-8.

19. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 8.

Images