A method, device, electronic device and medium for integrating a cryptographic module into a Docker container

Abstract

The present invention discloses a method, device, electronic device, and medium for integrating a cryptographic module within Docker. The method includes: extracting business data from a Docker container's image file; parsing a configuration module in the image file to determine a target instruction; determining a directory mapping relationship between a storage volume and a target server in a storage volume based on the target instruction; and reading a cryptographic module from a corresponding directory on the target server based on the directory mapping relationship between the storage volume and the target server; wherein the Docker container mounts the storage volume; the target instruction is an instruction to run the cryptographic module from the storage volume; and encrypting the business data based on the cryptographic module. This technical solution, through a storage volume mechanism, achieves separation of business data and the cryptographic module, allowing the business data and the cryptographic module to be independently packaged, deployed, and updated.

Description

Technical Field

[0001] The present invention relates to the field of container technology, and in particular to a method, device, electronic device, and medium for integrating a cryptographic module into a Docker container. Background Art

[0002] As cloud computing evolves, computing hardware resources are increasingly being virtualized, with virtual machines and containers being the most common technologies. Virtual machines can split a physical server into multiple logical hosts, each running a different operating system and application. However, these operations are cumbersome and can easily lead to resource waste, leading to the development of lightweight virtualization technologies like containers.

[0003] As a mainstream container technology, Docker does not require an integrated operating system. It encapsulates the dependent resources of business applications into image files, deploys middleware to load and run them on the target machine, and achieves separation of business applications from underlying devices and process-level isolation. It has become the main technical means of cloud computing.

[0004] Cryptography is fundamental to business application and data security. When migrating to the cloud, users rely on cryptographic modules for protection. When using Docker technology, the conventional approach of creating a cryptographic module library and packaging it with the business application into an image file presents challenges such as difficulty synchronizing development progress, complex packaging, and difficulty and high cost in coordinating cryptographic module updates. Summary of the Invention

[0005] The present invention provides a method, device, electronic device and medium for integrating a cryptographic module in Docker. Through a storage volume mechanism, the separation of business data and the cryptographic module is achieved, and the business data and the cryptographic module can be independently packaged, deployed and updated.

[0006] According to one aspect of the present invention, a method for integrating a cryptographic module into a Docker container is provided, the method comprising:

[0007] Extract business data from the Docker container image file;

[0008] Parsing the configuration module in the image file to determine a target instruction, determining a directory mapping relationship between the storage volume and the target server in the storage volume based on the target instruction, and reading a cryptographic module from a corresponding directory on the target server based on the directory mapping relationship between the storage volume and the target server; wherein the Docker container is mounted to the storage volume; and the target instruction is an instruction to run the cryptographic module from the storage volume;

[0009] The business data is encrypted based on the password module.

[0010] According to another aspect of the present invention, a device for integrating a cryptographic module into a Docker container is provided, the device comprising:

[0011] Business data extraction module, used to extract business data from the image file of the Docker container;

[0012] a cryptographic module reading module, configured to parse the configuration module in the image file to determine a target instruction, determine a directory mapping relationship between the storage volume and the target server in the storage volume based on the target instruction, and read the cryptographic module from a corresponding directory on the target server based on the directory mapping relationship between the storage volume and the target server; wherein the Docker container is mounted to the storage volume; and the target instruction is an instruction to run the cryptographic module from the storage volume;

[0013] An encryption module is used to encrypt the business data based on the password module.

[0014] According to another aspect of the present invention, an electronic device is provided, comprising:

[0015] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform a method for integrating a cryptographic module in a Docker as described in any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a method for integrating a cryptographic module in a Docker as described in any embodiment of the present invention when executed.

[0017] The technical solution of this embodiment of the present invention extracts business data from the Docker container's image file, then parses the configuration module in the image file to determine the target instructions. Based on the target instructions, the storage volume determines the directory mapping relationship between the storage volume and the target server. Based on the directory mapping relationship between the storage volume and the target server, the cryptographic module is read from the corresponding directory on the target server, and the business data is encrypted based on the cryptographic module. This technical solution, through the storage volume mechanism, achieves the separation of business data and cryptographic modules, allowing the business data and cryptographic modules to be independently packaged, deployed, and updated.

[0018] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 This is a flowchart of a method for integrating a cryptographic module into a Docker container according to a first embodiment of the present invention;

[0021] Figure 2 This is a schematic diagram of an integrated cryptographic module in Docker provided in Example 1 of the present application;

[0022] Figure 3 A schematic diagram of another cryptographic module integrated into Docker provided in Example 1 of the present application;

[0023] Figure 4 A flowchart of a process for integrating a cryptographic module into a Docker container, provided in the second embodiment of the present invention;

[0024] Figure 5 2 is a schematic diagram of a device for integrating a cryptographic module into a Docker container according to a third embodiment of the present invention;

[0025] Figure 6 The present invention is a schematic structural diagram of an electronic device for implementing a method for integrating a cryptographic module into a Docker container according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "object" and "target" in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Example 1

[0029] Figure 1 This is a flow chart of a method for integrating a cryptographic module in Docker according to the first embodiment of the present invention. This embodiment is applicable to the case of integrating a cryptographic module in Docker. The method can be executed by a device for integrating a cryptographic module in Docker. The device for integrating a cryptographic module in Docker can be implemented in the form of hardware and / or software. The device for integrating a cryptographic module in Docker can be configured in a device. For example, the device can be a background server or other device with communication and computing capabilities. Figure 1 As shown, the method includes:

[0030] S110. Extract business data from the image file of the Docker container.

[0031] In this solution, the Docker container encapsulates the dependent resources of the business data into an image file, and deploys the Docker container middleware on the target server. The Docker container middleware can load the image file and run it as a separate process in the target server.

[0032] In this embodiment, the image file consists of the container basic environment, business data, and the resources that the business data depends on. Among them, business data covers user business applications, which refer to various software applications or systems developed and used to meet user needs in specific business scenarios.

[0033] in, Figure 2 This is a schematic diagram of an integrated cryptographic module in Docker provided in Example 1 of the present application. Figure 2 As shown, a configuration module I1 can be written to package the basic container environment, business data, configuration module I1 and other dependent resources into an image file B1. The configuration module is composed of script files.

[0034] Specifically, a Docker container instance R1 is run through the Docker service middleware, the image file B1 is read in, and the business data therein is extracted.

[0035] S120. Parse the configuration module in the image file to determine a target instruction, determine a directory mapping relationship between the storage volume and the target server in the storage volume based on the target instruction, and read the password module from the corresponding directory of the target server based on the directory mapping relationship between the storage volume and the target server; wherein the Docker container is mounted with the storage volume; and the target instruction is an instruction to run the password module from the storage volume.

[0036] In this embodiment, the target instruction is an instruction for running the password module from the storage volume, and the target instruction is a configuration module stored in the image file.

[0037] In Docker, volumes are a mechanism for persisting data. The data in a container is temporary and will be lost if the container is deleted. Volumes, however, allow you to store data outside the container. This way, even if the container is deleted, the data remains intact and can be shared between different containers.

[0038] Further, such as Figure 2 As shown in the figure, there are two main ways to mount storage volumes in a container in Docker: using bind mounts and using volumes. A bind mount directly mounts a directory or file on the target server into the container. A volume is storage managed by Docker and stored in a specific directory on the target server.

[0039] Specifically, such as Figure 2 As shown, a Docker container instance R1 is run through the Docker service middleware, the container mounts the storage volume D1, and maps the storage volume D1 to the directory D0 of the target server.

[0040] Furthermore, the Docker container instance R1 runs and reads the image file B1; R1 starts the business data software according to the configuration module I1, and starts the cryptographic module software from the storage volume D1. Through the above steps, the business data software and the cryptographic module software are able to run collaboratively within the same container instance R1, building a complete and flexible application execution environment.

[0041] Optionally, parsing the configuration module in the image file to determine a target instruction, determining a directory mapping relationship between the storage volume and the target server in the storage volume according to the target instruction, and reading a password module from a corresponding directory of the target server according to the directory mapping relationship between the storage volume and the target server includes:

[0042] Storing the target instruction in the configuration module of the image file; storing the password module in the corresponding directory of the target server; and storing the mapping relationship between the storage volume and the directory of the target server in the storage volume;

[0043] When running the configuration module in the image file, the configuration module in the image file is parsed to determine the target instruction; the target instruction is executed to determine the directory mapping relationship between the storage volume and the target server in the storage volume; and based on the directory mapping relationship between the storage volume and the target server, the password module is read from the corresponding directory of the target server.

[0044] In this solution, the target instruction is an instruction to run the password module from the storage volume. A storage volume D1 is set for the Docker container, and a configuration module I1 is written to add an instruction to run the password module from the storage volume D1.

[0045] Furthermore, the container basic environment, business data, configuration module I1 and other dependent resources are packaged into an image file B1.

[0046] On the target server, a new directory D0 is created under the directory of the logged-in user, and the password module software is stored in D0.

[0047] Furthermore, a Docker container instance R1 is run through the Docker service middleware. This container mounts storage volume D1 and maps storage volume D1 to directory D0 on the target server. Docker container instance R1 runs and reads image file B1. Based on configuration module I1, R1 starts the business data software and the cryptographic module software from storage volume D1.

[0048] The storage volume mechanism enables the separation of business data and cryptographic modules, which can be packaged, deployed, and updated independently.

[0049] Optionally, store the password module in the corresponding directory on the target server, including:

[0050] In response to the operation instruction, the password module is modified to generate a new password module, and the new password module is stored in a corresponding directory of the target server.

[0051] In this solution, when the password module needs to be updated, the password module is modified in response to an operation instruction, a new password module is generated, and the new password module is written to the corresponding directory of the target server.

[0052] After writing the new cryptographic module to the corresponding directory on the target server, Docker container instance R1 is restarted. The built-in cryptographic module software in this instance is then started using storage volume D1. This deployment method effectively isolates the impact of system restarts on business data, enabling independent operation of basic services and the business development environment. This ensures stable operation of the cryptographic module while providing flexible operating space for iterative upgrades of business data.

[0053] S130: Encrypt the business data based on the cryptographic module.

[0054] Among them, the cryptographic module includes symmetric encryption algorithm, asymmetric encryption algorithm or hash algorithm, etc.

[0055] In this solution, the cryptographic module is implemented as a standalone software program with an IP (Internet Protocol) network communication interface. The business data is a separate software program that communicates with the cryptographic module through the IP network interface. The business application software and the cryptographic module software define a set of interactive protocol messages to implement cryptographic security interaction services.

[0056] In this embodiment, business data is encrypted according to the encryption strategy and algorithm pre-set in the cryptographic module. Specifically, the cryptographic module performs format verification and integrity checks on the input business data to ensure the accuracy and integrity of the data before encryption. The most appropriate encryption algorithm is then selected from a rich library of encryption algorithms based on the sensitivity of the data and business requirements. After selecting the algorithm, the cryptographic module generates the corresponding encryption key. Driven by the key, the cryptographic module performs bit-by-bit or segment-by-segment encryption operations on the business data, converting the original, readable business data into ciphertext, making it difficult to illegally obtain and decipher during transmission and storage.

[0057] Optionally, encrypting the business data based on the cryptographic module includes:

[0058] Determining a network interface of a cryptographic module and a network interface of business data, and establishing a communication connection between the cryptographic module and the business data based on the network interface of the cryptographic module and the network interface of the business data;

[0059] The cryptographic module is called to encrypt the business data.

[0060] Specifically, the cryptographic module is an independent software with an IP (Internet Protocol) network communication interface; the business data is separately packaged into an image file, and its configuration module is set to start the cryptographic module software through the storage volume; when the image file is loaded and run, the configuration module will be read to start the cryptographic module software. In this way, both the business data and the cryptographic module software are run in the container at the same time, and the two sides interact through the IP network interface.

[0061] In this plan, Figure 3 This is a schematic diagram of another cryptographic module integrated into Docker provided in Example 1 of this application, as shown in FIG. Figure 3 As shown in the figure, the process of integrating the cryptographic module into Docker consists of a packaging phase and a deployment and operation phase. During the packaging phase, a storage volume named dm1 is configured for Docker. Next, a configuration module is written for the business data, and a command is added to the module to start the cryptographic module from the specified storage volume dm1. The business data, configuration module, and required runtime resources are then packaged to generate an image file. During the deployment and operation phase, assuming the login user on the target server is user1, a new directory named cm1 is created in the home directory of user1 on the target server, and the cryptographic module software is written to this directory. Subsequently, the Docker instance's storage volume dm1 is mapped to the cm1 directory. Using the Docker service middleware on the target server, the user starts a Docker instance named r1. The startup command explicitly requests that the storage volume dm1 be mounted. When the Docker instance r1 starts and loads the previously generated image file, the configuration module is automatically executed, enabling the business data and cryptographic module software to run within the Docker instance. Business data will establish a connection with the password module application through a specific IP port and interact based on the negotiated network protocol messages to achieve password security functions.

[0062] Furthermore, if the cryptographic module software needs to be updated, simply write the updated software to the cm1 directory on the target server and restart the Docker instance r1. Since the storage volume dm1 is mapped to the cm1 directory, the Docker instance will start the updated cryptographic module through the storage volume dm1.

[0063] The technical solution of this embodiment of the present invention extracts business data from the Docker container's image file, then parses the configuration module in the image file to determine the target instructions. Based on the target instructions, the directory mapping relationship between the storage volume and the target server is determined within the storage volume. Based on the directory mapping relationship between the storage volume and the target server, the cryptographic module is read from the corresponding directory on the target server, and the business data is encrypted based on the cryptographic module. By implementing this technical solution, the business data and the cryptographic module are separated through the storage volume mechanism, allowing the business data and the cryptographic module to be independently packaged, deployed, and updated.

[0064] Example 2

[0065] Figure 4 This is a flowchart of a process of integrating a password module in Docker provided by the second embodiment of the present invention. The relationship between this embodiment and the above embodiment is a detailed supplement to the process of integrating a password module in Docker. Figure 4 As shown, the method includes:

[0066] S410: Extract business data from the image file of the Docker container.

[0067] S420: Parse the configuration module in the image file to determine a target instruction, and read the password module from the storage volume according to the target instruction; wherein the target instruction is an instruction to run the password module from the storage volume.

[0068] In this embodiment, the target instruction is an instruction for running the password module from the storage volume, and the target instruction is a configuration module stored in the image file.

[0069] In Docker, volumes are a mechanism for persisting data. The data in a container is temporary and will be lost if the container is deleted. Volumes, however, allow you to store data outside the container. This way, even if the container is deleted, the data remains intact and can be shared between different containers.

[0070] Furthermore, there are two main ways to mount storage volumes in a container in Docker: using bind mounts and using volumes. Bind mounts directly mount a directory or file on the target server into the container. Volumes are Docker-managed storage stored in a specific directory on the target server.

[0071] Specifically, a Docker container instance R1 is run through the Docker service middleware, and the container is mounted with a storage volume D1.

[0072] Furthermore, the Docker container instance R1 runs and reads the image file B1; R1 starts the business data software according to the configuration module I1, and starts the cryptographic module software from the storage volume D1. Through the above steps, the business data software and the cryptographic module software are able to run collaboratively within the same container instance R1, building a complete and flexible application execution environment.

[0073] Optionally, reading a password module from a storage volume according to the target instruction includes:

[0074] Storing the target instruction in the configuration module of the image file; and storing the password module in the storage volume;

[0075] When the configuration module in the image file is run, the configuration module in the image file is parsed to determine a target instruction; the target instruction is executed, and a password module is read from the storage volume.

[0076] In this solution, the target instruction is an instruction to run the password module from the storage volume. A storage volume D1 is set for the Docker container, and a configuration module I1 is written to add an instruction to run the password module from the storage volume D1.

[0077] The basic container environment, business data, configuration module I1 and other dependent resources are packaged into an image file B1.

[0078] In this embodiment, the cryptographic module is stored in the storage volume D1.

[0079] Furthermore, a Docker container instance R1 is run through the Docker service middleware, and the container is mounted with storage volume D1. Docker container instance R1 runs and reads image file B1. R1 starts the business data software according to configuration module I1 and reads the cryptographic module software from storage volume D1.

[0080] The storage volume mechanism enables the separation of business data and cryptographic modules, which can be packaged, deployed, and updated independently.

[0081] Optionally, store the cryptographic module in a storage volume, including:

[0082] In response to the operation instruction, the password module is modified to generate a new password module, and the new password module is stored in the storage volume.

[0083] In this solution, when the password module needs to be updated, the password module is modified in response to an operation instruction, a new password module is generated, and the new password module is written into the storage volume.

[0084] After writing the new cryptographic module to storage volume D1, Docker container instance R1 is restarted. The instance's built-in cryptographic module software is then started using storage volume D1. This deployment method effectively isolates the impact of system restarts on business data, enabling independent operation of basic services and the business development environment. This ensures stable operation of the cryptographic module while providing flexible operating space for iterative upgrades of business data.

[0085] In this solution, during the software development phase, the business data software and the cryptographic module software were developed in parallel, each progressing according to plan within its own independent development environment. The cryptographic module software, developed as an independent unit, features a standard IP network interface and focuses on implementing cryptographic security functions. The business data software, also developed as an independent module, is configured with an IP network interface and handles core business logic. Both parties jointly defined a set of standardized protocol messages to enable secure interaction between the business data software and the cryptographic module over the IP network, ensuring seamless integration of cryptographic functions. A configuration script was written within the business data software, embedding a command to launch the cryptographic module from a specified storage volume. The business data software, configuration script, and required runtime resources were integrated and packaged into a single image file for easy deployment.

[0086] Furthermore, in the target server environment, Docker container technology is used to achieve efficient software deployment and dynamic management. Specifically, a dedicated directory is created on the target server as the storage volume for the Docker instance, and the cryptographic module software and the packaged image file are written to it separately. The user executes a startup command through the Docker service middleware on the target server, specifying to mount the aforementioned storage volume, triggering the creation of the Docker instance. When the Docker instance starts, it automatically loads the image file and executes the configuration script therein, thereby running the business data software and the cryptographic module software simultaneously within the container. The business data software establishes a connection with the cryptographic module via a preset IP port, and exchanges data based on pre-negotiated protocol packets to complete the cryptographic security function. When the cryptographic module software needs to be updated, it only needs to write the new version to the storage volume and restart the Docker instance to complete the upgrade, without the need to redeploy the entire business system.

[0087] S430: Encrypt the business data based on the cryptographic module.

[0088] The technical solution of this embodiment of the present invention extracts business data from the Docker container's image file, then parses the configuration module in the image file to determine the target instructions. Based on the target instructions, the cryptographic module is read from the storage volume, and the business data is encrypted based on the cryptographic module. By implementing this technical solution, the business data and the cryptographic module are separated through the storage volume mechanism, allowing them to be independently packaged, deployed, and updated.

[0089] Example 3

[0090] Figure 5 This is a schematic diagram of a device for integrating a password module into a Docker container according to the third embodiment of the present invention. Figure 5 As shown, the device includes:

[0091] A business data extraction unit 510 is used to extract business data from the image file of the Docker container;

[0092] The cryptographic module reading unit 520 is configured to parse the configuration module in the image file to determine a target instruction, determine a directory mapping relationship between the storage volume and the target server in the storage volume based on the target instruction, and read the cryptographic module from the corresponding directory on the target server based on the directory mapping relationship between the storage volume and the target server; wherein the Docker container is mounted to the storage volume; and the target instruction is an instruction to run the cryptographic module from the storage volume;

[0093] The encryption unit 530 is configured to encrypt the business data based on the password module.

[0094] Optionally, the password module reading unit 520 includes:

[0095] The storage subunit is used to store the target instruction in the configuration module of the image file; store the password module in the corresponding directory of the target server; and store the mapping relationship between the storage volume and the directory of the target server in the storage volume;

[0096] The password module reading subunit is used to parse the configuration module in the image file to determine the target instruction when running the configuration module in the image file; execute the target instruction to determine the directory mapping relationship between the storage volume and the target server in the storage volume; and read the password module from the corresponding directory of the target server based on the directory mapping relationship between the storage volume and the target server.

[0097] Optionally, a storage subunit is used to:

[0098] In response to the operation instruction, the password module is modified to generate a new password module, and the new password module is stored in a corresponding directory of the target server.

[0099] Optionally, the device further includes:

[0100] The password module determination unit is used to parse the configuration module in the image file to determine the target instruction, and read the password module from the storage volume according to the target instruction; wherein the target instruction is an instruction to run the password module from the storage volume.

[0101] Optionally, the cryptographic module determination unit includes:

[0102] A configuration subunit, configured to store the target instruction in the configuration module of the image file; and store the password module in the storage volume;

[0103] The password module determination subunit is used to parse the configuration module in the image file to determine the target instruction when running the configuration module in the image file; execute the target instruction, and read the password module in the storage volume.

[0104] Optionally, the cryptographic module determines a subunit, specifically for:

[0105] In response to the operation instruction, the password module is modified to generate a new password module, and the new password module is stored in the storage volume.

[0106] Optionally, the encryption unit 530 is specifically configured to:

[0107] Determining a network interface of a cryptographic module and a network interface of business data, and establishing a communication connection between the cryptographic module and the business data based on the network interface of the cryptographic module and the network interface of the business data;

[0108] The cryptographic module is called to encrypt the business data.

[0109] The device for integrating a cryptographic module in a Docker provided by an embodiment of the present invention can execute a method for integrating a cryptographic module in a Docker provided by any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0110] Example 4

[0111] Figure 6A schematic diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0112] like Figure 6 As shown, electronic device 10 includes at least one processor 11 and memory, such as read-only memory (ROM) 12 and random access memory (RAM) 13, communicatively connected to at least one processor 11. The memory stores computer programs executable by the at least one processor. Processor 11 can perform various appropriate actions and processes based on the computer programs stored in ROM 12 or loaded from storage unit 18 into RAM 13. RAM 13 can also store various programs and data required for the operation of electronic device 10. Processor 11, ROM 12, and RAM 13 are interconnected via bus 14. An input / output (I / O) interface 15 is also connected to bus 14.

[0113] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0114] Processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any other suitable processor, controller, microcontroller, etc. Processor 11 executes the various methods and processes described above, such as a method for integrating a cryptographic module within Docker.

[0115] In some embodiments, a method for integrating a cryptographic module within a Docker container can be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the method for integrating a cryptographic module within a Docker container described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the method for integrating a cryptographic module within a Docker container in any other suitable manner (e.g., via firmware).

[0116] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0117] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0118] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or apparatus. A computer-readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0119] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device that has: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0120] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0121] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0122] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0123] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for integrating a cryptographic module into a Docker container, characterized in that: include: Extract business data from the Docker container image file; Parsing the configuration module in the image file to determine a target instruction, determining a directory mapping relationship between the storage volume and the target server in the storage volume based on the target instruction, and reading a cryptographic module from a corresponding directory on the target server based on the directory mapping relationship between the storage volume and the target server; wherein the Docker container is mounted to the storage volume; and the target instruction is an instruction to run the cryptographic module from the storage volume; encrypting the business data based on the cryptographic module; The method includes parsing the configuration module in the image file to determine the target instruction, determining the directory mapping relationship between the storage volume and the target server in the storage volume according to the target instruction, and reading the password module from the corresponding directory of the target server according to the directory mapping relationship between the storage volume and the target server, including: Storing the target instruction in the configuration module of the image file; storing the password module in the corresponding directory of the target server; and storing the mapping relationship between the storage volume and the directory of the target server in the storage volume; When running the configuration module in the image file, the configuration module in the image file is parsed to determine a target instruction; the target instruction is executed to determine, in the storage volume, a directory mapping relationship between the storage volume and the target server; and based on the directory mapping relationship between the storage volume and the target server, a password module is read from a corresponding directory of the target server; After extracting the service data from the image file of the Docker container, the method further includes: Parsing the configuration module in the image file to determine a target instruction, and reading the password module from the storage volume according to the target instruction; wherein the target instruction is an instruction to run the password module from the storage volume; Reading the password module from the storage volume according to the target instruction includes: Storing the target instruction in the configuration module of the image file; and storing the password module in the storage volume; When the configuration module in the image file is run, the configuration module in the image file is parsed to determine a target instruction; the target instruction is executed, and a password module is read from the storage volume.

2. The method according to claim 1, characterized in that Store the password module in the corresponding directory of the target server, including: In response to the operation instruction, the password module is modified to generate a new password module, and the new password module is stored in a corresponding directory of the target server.

3. The method according to claim 1, characterized in that Store the cryptographic module in a storage volume, including: In response to the operation instruction, the password module is modified to generate a new password module, and the new password module is stored in the storage volume.

4. The method according to claim 1, wherein Encrypting the business data based on the password module includes: Determining a network interface of a cryptographic module and a network interface of business data, and establishing a communication connection between the cryptographic module and the business data based on the network interface of the cryptographic module and the network interface of the business data; The cryptographic module is called to encrypt the business data.

5. A device for integrating a cryptographic module into a Docker container, characterized in that: include: A business data extraction unit, used to extract business data from the image file of the Docker container; a cryptographic module reading unit, configured to parse the configuration module in the image file to determine a target instruction, determine a directory mapping relationship between the storage volume and the target server in the storage volume based on the target instruction, and read the cryptographic module from a corresponding directory on the target server based on the directory mapping relationship between the storage volume and the target server; wherein the Docker container is mounted to the storage volume; and the target instruction is an instruction to run the cryptographic module from the storage volume; an encryption unit, configured to encrypt the service data based on the cryptographic module; The password module reading unit includes: The storage subunit is used to store the target instruction in the configuration module of the image file; store the password module in the corresponding directory of the target server; and store the mapping relationship between the storage volume and the directory of the target server in the storage volume; a password module reading subunit, configured to parse the configuration module in the image file to determine a target instruction when running the configuration module in the image file; execute the target instruction to determine, in the storage volume, a directory mapping relationship between the storage volume and the target server; and read the password module from a corresponding directory on the target server based on the directory mapping relationship between the storage volume and the target server; Wherein, the device further includes: a password module determining unit, configured to parse the configuration module in the image file to determine a target instruction, and read the password module from the storage volume according to the target instruction; wherein the target instruction is an instruction to run the password module from the storage volume; The password module determination unit includes: A configuration subunit, configured to store the target instruction in the configuration module of the image file; and store the password module in the storage volume; The password module determination subunit is used to parse the configuration module in the image file to determine the target instruction when running the configuration module in the image file; execute the target instruction, and read the password module in the storage volume.

6. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so as to enable the at least one processor to perform a method for integrating a cryptographic module in a Docker according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a method for integrating a cryptographic module in a Docker according to any one of claims 1 to 4 when executed.

Images