Sensitive Data Encryption

Abstract

In a method for encryption of sensitive data, an encrypted user private key is received in a trusted execution environment (TEE) of a worker node in a container management system, the encrypted user private key being an encrypted version of the user private key for decrypting messages from a user in the container management system. The user private key is obtained in the TEE, and the encrypted user private key is decrypted to the user private key with a provider private key received from an encryption manager for managing the container management system. The user private key may be securely transmitted to the worker node, such that the worker node can use the user private key to decrypt messages from the user. Thus, a security level of the container management system may be increased.

Description

[Technical Field]

[0001] The present invention relates to data encryption, and more particularly to a method, system, and computer program product for encrypting and decrypting sensitive data in a container-managed environment. [Background technology]

[0002] Nowadays, container technology is widely used in the software industry. Various types of container management systems are provided to deploy containers on one or more worker nodes. Sensitive data such as passwords are provided in the container management systems to configure each container(s) and / or for other purposes. At present, the main focus is on how to protect sensitive data and how to improve the security level of container management systems. Summary of the Invention

[0003] According to an embodiment of the present invention, there is provided a computer-implemented method that may be performed by one or more processors, in which the one or more processors receive an encrypted user private key in a trusted execution environment (TEE) of a worker node in a container management system, the encrypted user private key being an encrypted version of the user private key for decrypting messages from a user in the container management system, and the one or more processors retrieve the user private key in the TEE, where the encrypted user private key is decrypted into the user private key with a provider private key received from an encryption manager for managing the container management system.

[0004] According to an embodiment of the present invention, there is provided a computer-implemented method that may be performed by one or more processors, in which the one or more processors encrypt a user private key with a provider public key received from a cryptography manager for managing a container management system, the user private key being for decrypting messages from users in the container management system, and the one or more processors transmit the encrypted user private key to a worker node in the container management system, such that the worker node obtains the user private key in a trusted execution system (TEE) of the worker node, and decrypts the user private key encrypted with the provider private key received from the cryptography manager back into the user private key.

[0005] According to another embodiment of the present invention, there is provided a computer-implemented system comprising a computer processor coupled to a computer-readable memory unit, the memory unit containing instructions that, when executed by the computer processor, perform the above-described method.

[0006] According to another embodiment of the present invention, there is provided a computer program product comprising a computer-readable storage medium having program instructions embodied therein, the program instructions being executable by an electronic device to cause the electronic device to perform the actions of the above-described method.

[0007] The above and other objects, features, and advantages of the present disclosure will become more apparent through a more detailed description of some embodiments of the present disclosure in the accompanying drawings, in which like reference numerals generally refer to like components in the embodiments of the present disclosure. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a diagram of a cloud computing node according to an embodiment of the present invention. [Figure 2]1 is a diagram of a cloud computing environment according to an embodiment of the present invention. [Figure 3] FIG. 2 is a diagram of abstraction model layers, according to an embodiment of the present invention. [Figure 4] 1 is an illustration of an example container management system in which embodiments of the present invention may be implemented; [Figure 5] FIG. 1 is a diagram of an example architecture for managing sensitive data with multiple keys, according to an embodiment of the present invention. [Figure 6] 3 is a diagram of an example procedure for encrypting sensitive data, according to an embodiment of the present invention. [Figure 7] FIG. 2 illustrates an example procedure for distributing multiple keys in a TEE, according to an embodiment of the invention. [Figure 8] FIG. 10 is a diagram of an example structure of a worker node, according to an embodiment of the present invention. [Figure 9] 3 is a diagram of an example procedure for encrypting and decrypting sensitive data, according to an embodiment of the present invention. [Figure 10] 4 is a flowchart of an example method for obtaining a user private key for decrypting a message from a user, according to an embodiment of the present invention. [Figure 11] 1 is a flowchart of an example method for transmitting a user private key to a worker node according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0009] Certain embodiments will be described in more detail with reference to the accompanying drawings, in which embodiments of the present disclosure are shown by way of example. However, the present disclosure may be embodied in various ways and therefore should not be construed as limited to the embodiments disclosed herein.

[0010] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings recited herein is not limited to cloud computing environments. Rather, embodiments of the present invention may be practiced in conjunction with any other type of computing environment now known or later developed.

[0011] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal administrative effort or interaction with the service provider. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0012] The characteristics are as follows:

[0013] On-demand self-service: Cloud users can unilaterally provide computing capacity, such as server time and network storage, automatically as needed, without the need for human interaction with the service provider.

[0014] Broad Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0015] Resource Pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with various physical and virtual resources dynamically allocated and reallocated according to demand. Location independence is meant in that consumers generally have no control or knowledge of the exact location of the resources provided, but may specify location at a higher level of abstraction (e.g., country, state, or data center).

[0016] Rapid Elasticity: Capacity is rapidly and elastically provisioned, sometimes automatically, to quickly scale out, and rapidly releasable to quickly scale in. To consumers, the capacity available to provision often appears unlimited, and can be purchased at any time and in any quantity.

[0017] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at several levels of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services used.

[0018] The service model is as follows:

[0019] Software as a Service (SaaS): The consumer is provided with the ability to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through a thin-client interface, such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or possibly individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0020] Platform as a Service (PaaS): The ability provided to a consumer is to deploy consumer-created or acquired applications, created using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application-hosting environment configuration.

[0021] Infrastructure as a Service (IaaS): The capability provided to a customer is the provision of processing, storage, networking, and other basic computing resources on which the customer can deploy and run any software, which may include operating systems and applications. The customer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and in some cases, limited control over selected networking components (e.g., host firewalls).

[0022] The deployment model is as follows:

[0023] Private Cloud: The cloud infrastructure is operated solely for the organization. The cloud infrastructure may be managed by the organization or a third party and may exist on-premise or off-premise.

[0024] Community Cloud: Cloud infrastructure is shared by several organizations to support a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). The cloud infrastructure may be managed by the organization or a third party and may exist on-premises or off-premises.

[0025] Public Cloud: Cloud infrastructure is made available to the general public or large industry groups and is owned by organizations that sell cloud services.

[0026] Hybrid Cloud: A cloud infrastructure is a composite of two or more clouds (private, community, or public) that remain unique entities but are tied together by standard or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0027] Cloud computing environments are service-oriented, with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0028] Referring now to Figure 1, a schematic diagram of an example cloud computing node is shown. Cloud computing node 10 is merely one example of a suitable cloud computing node and is not intended to suggest any limitation as to the scope of use or functionality of the embodiments of the invention described herein. Nevertheless, cloud computing node 10 is capable of performing and / or implementing any of the functions described above.

[0029] Cloud computing node 10 may be a computer system / server 12 or a portable electronic device, such as a communications device, operable in numerous other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof, that may be suitable for use with computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0030] Computer system / server 12 may be described in the general context of computer system-executable instructions, such as program modules, executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. Computer system / server 12 may also be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0031] 1, computer system / server 12 in cloud computing node 10 is shown in the form of a general-purpose computing device. Components of computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, system memory 28, and a bus 18 coupling various system components, including system memory 28, to processing unit 16.

[0032] Bus 18 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MCA) bus, the Enhanced ISA (EISA) bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0033] Computer system / server 12 typically includes a variety of computer system-readable media, which may be any available media that can be accessed by computer system / server 12 and includes both volatile and nonvolatile media, removable and non-removable media.

[0034] System memory 28 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer system / server 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a database system 34 may be provided for reading and writing to a non-removable, non-volatile magnetic medium (not shown, but typically referred to as a "hard drive"). Although not shown, a magnetic disk drive may be provided for reading and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive may be provided for reading and writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical medium. In such an example, one or more data media interfaces may each be connectable to bus 18. As further depicted and explained below, memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of embodiments of the present invention.

[0035] The programs / utilities 40 have a set (at least one) of program modules 42, which may be stored in memory 28, as well as, by way of example and not limitation, an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may comprise an implementation of a networked environment. The program modules 42 generally perform the functions and / or methods of embodiments of the present invention as described herein.

[0036] The computer system / server 12 may further communicate with one or more external devices 14, such as a keyboard, pointing device, display 24, one or more devices that allow a user to interact with the computer system / server 12, or any device (e.g., a network card, modem, etc.) that allows the computer system / server 12 to communicate with one or more other computing devices, or a combination thereof. Such communication may occur via an input / output (I / O) interface 22. Furthermore, the computer system / server 12 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet), or a combination thereof, via a network adapter 20. As depicted, the network adapter 20 communicates with other components of the computer system / server 12 via a bus 18. It should be understood that other hardware and / or software components, not shown, may be used in conjunction with the computer system / server 12. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive database systems.

[0037] Referring now to FIG. 2, an illustrative cloud computing environment 50 is depicted. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud users, such as, for example, a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof, may communicate. The nodes 10 may also communicate with each other. The nodes 10 may be physically or virtually grouped in one or more networks (not shown), such as private, community, public, or hybrid clouds, or combinations thereof, as described above. This enables the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service without requiring the cloud user to maintain resources on their local computing devices. The types of computing devices 54A-N shown in FIG. 2 are intended to be illustrative only, and it is understood that computing node 10 and cloud computing environment 50 can communicate with any type of computerized device over any type of network and / or network-addressable connection (e.g., using a web browser).

[0038] Referring now to Figure 3, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 2) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 3 are intended to be exemplary only, and embodiments of the present invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0039] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframe 61, RISC (reduced instruction set computer) architecture-based servers 62, servers 63, blade servers 64, storage devices 65, and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0040] The virtualization layer 70 provides an abstraction layer from which examples of virtual entities can be provided: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0041] In one example, management layer 80 may provide the following functions: Resource provisioning 81 dynamically procures computing and other resources utilized to perform tasks within the cloud computing environment; Metering and pricing 82 tracks costs as resources are utilized within the cloud computing environment and bills or invoices for the usage of these resources; In one example, these resources may include application software licenses; Security verifies the identity of cloud users and tasks and protects data and other resources; User portal 83 provides users and system administrators with access to the cloud computing environment; Service level management 84 allocates and manages cloud computing resources to ensure required service levels are met; and Service level agreement (SLA) planning and execution 85 pre-provisions and procures cloud computing resources to anticipate future requirements according to SLAs.

[0042] The workload tier 90 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instruction delivery 93, data analytics processing 94, transaction processing 95, and cryptographic processing 96.

[0043] It should be noted that the encryption process 96 according to an embodiment of the present invention can be performed by the computer system / server 12 of FIG. 1. For a brief description of a container management system, reference is made to FIG. 4. FIG. 4 depicts a diagram of an example container management system 400 in which an embodiment of the present invention can be implemented. Here, the container management system 400 may include a master node 410 and worker nodes 420 on which one or more containers 430 are deployed. The master node 410 may be used to manage the worker nodes 420. For example, if the workload of the worker node 420 increases to a predetermined threshold, another worker node may be launched by the master node 410 to share the workload of the worker node 420. If the workload decreases to a predetermined threshold, the master node 410 may terminate one of the launched worker nodes.

[0044] Here, the container management system 400 may include a Kubernetes® system, in which case sensitive data 440, such as a user 450 secret, may be provided for storing sensitive information. Here, the user 450 may include a customer of the container management system 400. Alternatively, or additionally, the user 450 may include an administrator of the container management system 400. The secret may be an environmental parameter or a file, or both, containing sensitive data such as a password, token, or key for managing containers. In existing Kubernetes® systems, the secret is encoded in a basic format, and during storage and transmission, the secret is easily decoded and therefore visible in the container management system 400. For example, the secret is in plaintext format in the master node's memory, and therefore anyone with access to the memory can read the secret from the memory. Therefore, it is desirable to encrypt the sensitive data 440 to improve the security level of the secret.

[0045] In consideration of the above drawbacks, embodiments of the present invention provide an effective solution for managing sensitive data. In some embodiments of the present invention, a provider key pair (including a provider public key and a provider private key) and a user key pair (including a user public key and a user private key) are provided for encrypting sensitive data. Referring to FIG. 5 for an overview of the present invention, FIG. 5 depicts an example architecture 500 for managing sensitive data with multiple keys in accordance with an embodiment of the present invention. In FIG. 5, a provider public key 512 and a provider private key 514 may be provided by an encryption manager 510. Furthermore, a user public key 522 and a user private key 524 may be defined by a user 450. For example, the user 450 may define the user public key 522 and the user private key 524 via a user client 520.

[0046] As shown in FIG. 5 , the worker node 420 may include a TEE, and the user private key 524 may be transmitted to the TEE 530 in a trusted manner by using the private key 514 to facilitate confidential data encryption. Furthermore, the confidential data may be first encrypted with the user public key 522, and thus the confidential data is stored and transmitted in an encrypted version outside the TEE 530. Therefore, since the user private key 524 exists only in the TEE 530, no one can decrypt the encrypted confidential data outside the TEE 530. Therefore, the encrypted confidential data is secure outside the TEE 530. Here, the encrypted confidential data may be decrypted back to confidential data only within the TEE 530. Because the TEE 530 is a fully trusted environment with a high level of security, the confidential data is secure within the TEE 530.

[0047] For further details of the present invention, reference is now made to FIG. 6, which depicts an example procedure 600 for encrypting sensitive data, according to an embodiment of the present invention. In FIG. 6, encryption manager 510 may transmit 610 provider public key 512 to user client 520, where provider public key 512 is a public key for encrypting user private key 524 and may be transmitted directly to user client 520. Meanwhile, encryption manager 510 may transmit 612 provider private key to worker node 420, where provider private key 514 is a private key corresponding to provider public key 512 (i.e., for decrypting data encrypted with provider public key 512) and may be obtained from encryption manager 510 and stored in a secure manner.

[0048] For further details of the distribution of multiple keys, refer to FIG. 7 , which depicts an example procedure 700 for distributing a user private key 524 to a TEE 530 in accordance with an embodiment of the present invention. As shown in FIG. 7 , the provider private key 514 may be stored in a hardware security module (HSM) 710, where HSM 710 refers to a physical computing device that protects and manages digital keys and performs encryption and decryption functions. The HSM 710 may provide a specialized “trusted” method for performing various cryptographic operations, such as key management, key exchange, and encryption. Thus, the HSM 710 may provide an efficient and secure method for storing the provider private key 514, and firmware associated with the worker node 420 may then access the provider private key 514 and decrypt the encrypted user private key into the user private key 524.

[0049] Referring again to FIG. 6 , the user client 520 may encrypt 614 the user private key 524 with the provider public key. The user private key 524 may be generated at the user client 520, and the user private key 524 may be encrypted directly with the provider public key 512. The user client 520 may then transmit 616 the encrypted user private key to the worker node 420. Various methods may be used to transmit the encrypted user private key. Referring again to FIG. 7 for further details, the user client 520 may insert the encrypted user private key 732 into a disk image 730 of a container to be deployed on the worker node 420. Here, the disk image 730 may first be stored in an image registry 720 for distribution to the worker node 420, and then the disk image 730 may be distributed to the worker node 420 according to conventional methods. In these embodiments, there is no need to set up a channel to distribute the encrypted user private key 732; instead, the image registry 720 in the container management system 400 may be reused to transmit the encrypted user private key 732 to the worker nodes 420.

[0050] While the above paragraphs describe a procedure for transmitting the encrypted user private key 732 through the image registry 720, alternatively and / or additionally, the encrypted user private key 732 may be distributed in another manner, provided that the encrypted user private key 732 reaches the worker node 420. Because the encrypted user private key 732 is in an encrypted version during transmission and the provider private key 514 resides only in the TEE 530, no one outside the TEE 530 can decrypt the encrypted user private key 732. Thus, the encrypted user private key 732 is transmitted in a secure and efficient manner.

[0051] In some embodiments, the encrypted user private key 732 may be transmitted to the TEE 530 via a storage device external to the TEE 530. For further details regarding the worker node 420, see FIG. 8 , which depicts an example worker node structure 800 according to an embodiment of the present invention. In FIG. 8 , the worker node 420 may be divided into two parts: one part within the TEE 530, whose operation is secure and inaccessible to any illicit attacker, and the other part outside the TEE 530. For example, a storage device 820 may be provided for this part to communicate with other objects (such as the image registry 720 and the user client 520) within the container management system 400. Here, the disk image 730 may first be transmitted to the storage device 820 of the worker node 420, and then the disk image 730 may be loaded from the storage device 820 into the TEE 530. In these embodiments, the storage device 820 may act as an intermediate device between the TEE 530 and an untrusted environment external to the TEE 530, and thus the security level 400 of the container management system may be ensured.

[0052] To load a disk image from the storage device 820 into the TEE 530, a virtual storage 810 may be created in the TEE 530 and mounted on the storage device 820. Thus, a disk image containing an encrypted user private key may be loaded into the virtual storage 810 in the TEE 530. In the TEE 530, the encrypted user private key may be extracted from the disk image by parsing the disk image. The encrypted user private key may then be decrypted into the user private key in the HSM 710 with the provider private key 514.

[0053] Referring again to FIG. 6 , in the TEE 530, the worker node 420 may obtain 618 the user private key, which is decrypted with the provider private key 514. Firmware associated with the worker node 420 may use the provider private key 514 in the HSM 710 to decrypt the encrypted user private key into the user private key 524. Here, the firmware may be the firmware of the worker node 420, or alternatively and / or additionally, the firmware may be the firmware of the computing device on which the worker node 420 resides. In some embodiments, the firmware may obtain the user private key when the worker node 420 is created. In other words, when the worker node 420 is created, the user private key resides in the TEE 530 of the created worker node. Once the user private key is decrypted, the user private key may be used to decrypt message(s) from the user 450. For these embodiments, the decrypted version of the user private key resides only in the TEE 530, and therefore the TEE 530 can protect the user private key from any illicit attacks.

[0054] To provide further protection to the container management system 400, Linux Unified Key Setup (LUKS) technology may be used in the worker node 420. At this point, the LUKS password may be sent to the worker node 420 along with the encrypted user private key 732 (e.g., the disk image may include both the encrypted user private key and the LUKS password). The LUKS password may then be used to access data created based on the LUKS technology. Referring to FIG. 8 , a LUKS-based virtual storage 830 may be created in the TEE 530. The virtual storage 830 may then be mounted on a storage device 840. At this point, the data in the storage device 840 may be further protected with the LUKS password, and the data may be accessed in the virtual storage 830 using the LUKS password.

[0055] The above paragraphs describe how to obtain the user private key in the TEE 530, and reference is made below to FIG. 6 for further details of encrypting and decrypting sensitive data. In FIG. 6, the user client 520 may encrypt the sensitive data 440 with the user public key 522 and then transmit 620 a message (including the encrypted sensitive data) to the worker node 420. Specifically, the message may be transmitted to the worker node 420 via the master node 410, and reference is made to FIG. 9 for further details. FIG. 9 depicts an example procedure 900 for encrypting and decrypting sensitive data, according to an embodiment of the present invention. In FIG. 9, the sensitive data may be encrypted with the user public key 522 into a message 910. Furthermore, the message 910 may be transmitted to the master node 410 via an existing link within the container management system 400. In other words, the message 910 may be transmitted in a similar manner as before; the difference from existing solutions is that the message 910 is an encrypted version and is not visible without the user private key. Therefore, the message 910 is secure during transmission, and the security level of the container management system 400 is increased.

[0056] In some embodiments, the sensitive data may include either environmental parameters or files. For environmental parameters, the master node 410 may forward a message 910 to the storage device 820 of the worker node 420, and the environmental parameters may then be loaded into a virtual storage 810 (e.g., memory) mounted on the storage device 820. At this point, the encrypted environmental parameters included in the message 910 may be decrypted with the user private key 524 in the TEE 530. The decrypted version of the sensitive data is now visible only in the TEE 530, and thus the TEE 530 may provide complete protection to the sensitive data. Thus, the sensitive data may be used to install and configure containers on the worker node 420. In some embodiments, if the sensitive data relates to a file, the message may be loaded into a LUKS-based virtual storage 830. The LUKS password may then be used to access the encrypted file in the TEE 530. Thus, LUKS technology may provide further protection to the sensitive data.

[0057] For these embodiments, the provider key pair may facilitate transmitting the user private key 524 from the user client 520 to the TEE 530 of the worker node 420. Furthermore, the user key pair may facilitate encrypting and decrypting sensitive data. Thus, sensitive data may be transmitted in an encrypted version outside the TEE 530, and the sensitive data may be stored and used in a decrypted version inside the TEE 530. Thus, the security level of the container management system 400 may be greatly improved.

[0058] The present invention may be a system, method, or computer program product, or a combination thereof, at any possible level of technical detail of integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions for causing a processor to perform aspects of the present invention. The above paragraphs describe communication between worker node 420 and user client 520. In some embodiments, the above procedures may be implemented as methods in worker node 420 and user client 520, respectively.

[0059] For further details regarding an embodiment of the present invention, reference will be made to FIG. 10 , which depicts a flowchart of an example method 1000 for obtaining a user private key for decrypting a message from a user, according to an embodiment of the present invention, where method 1000 may be implemented on a worker node 420. In FIG. 10 , at block 1010, an encrypted user private key is received at a trusted execution environment (TEE) of a worker node in a container management system, where the encrypted user private key is an encrypted version of the user private key for decrypting a message from a user at the container management system. The user private key is received at the TEE, and the encrypted user private key is decrypted into the user private key with a provider private key received from an encryption manager for managing the container management system.

[0060] In some embodiments, a user private key is received in the TEE, and the user private key is decrypted by firmware associated with the worker node based on a provider private key stored in a hardware security module connected between the worker node and the cryptographic manager. In some embodiments, to receive the encrypted user private key, a disk image is received in a storage device external to the TEE of the worker node, the disk image including the encrypted user private key from an image registry of a container management system, the image registry storing at least one disk image to be deployed to the worker node. Further, the encrypted user private key is extracted from the disk image in the TEE. In some embodiments, to extract the encrypted user private key in the TEE, virtual storage of the TEE is attached to the storage device, the disk image is loaded from the storage device into the virtual storage of the TEE, and the encrypted user private key is then extracted in the TEE by parsing the disk image loaded into the virtual storage.

[0061] In some embodiments, a message is received at the TEE from a user of the container management system, the message including sensitive data encrypted with a user public key corresponding to the user private key. The message is then decrypted into the sensitive data with the user private key in the TEE. In some embodiments, to receive the message at the TEE, the message is first received at a storage device of a worker node external to the TEE, and then virtual storage of the TEE is attached to the storage device to load the message from the storage device into virtual storage of the TEE. In some embodiments, a password for accessing the message in the virtual storage of the TEE is received. In some embodiments, the container management system includes a Kubernetes® system, and the user of the container management system includes one of a customer and an administrator of the Kubernetes® system. In some embodiments, the user's sensitive data includes one of environment parameters and files for deploying a container associated with a disk image within the work node, and the disk image is installed on the work node based on the sensitive data.

[0062] FIG. 11 depicts a flowchart of an example method 1100 for transmitting a user private key to a worker node, according to an embodiment of the present invention. Method 1100 may be implemented in user client 520. In FIG. 11 , at block 1110, a user private key is encrypted with a provider public key received from an encryption manager for managing the container management system, where the user private key is for decrypting messages from a user in the container management system. At block 1120, the encrypted user private key is transmitted to a worker node in the container management system, whereby the worker node obtains the user private key in the worker node's TEE and decrypts the encrypted user private key with the provider private key received from the encryption manager into the user private key.

[0063] In some embodiments, to transmit the encrypted user private key to the TEE, the encrypted user private key is inserted into a disk image of a container to be deployed within a worker node, and the disk image is then transmitted to the worker node, so that the worker node extracts the encrypted user private key from the disk image. In some embodiments, the user's confidential data is encrypted with a user public key corresponding to the user private key, and a message including the encrypted confidential data is then transmitted to the worker node, so that the worker node decrypts the encrypted confidential data with the user private key into confidential data in the TEE. In some embodiments, a message for managing the worker node in the container management system is transmitted to the worker node via the master node. In some embodiments, a password is transmitted to the worker node, so that the worker node accesses the message in the TEE. In some embodiments, the container management system includes a Kubernetes® system, and the user of the container management system includes one of a customer and an administrator of the Kubernetes® system. In some embodiments, the user's confidential data includes one of an environment and a file for deploying a container associated with the disk image within the worker node.

[0064] A computer-readable storage medium can be any tangible device capable of retaining and storing instructions for use by an instruction-execution device. A computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disks (DVDs), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge-in-groove structures having instructions recorded thereon, and any suitable combination of the foregoing. Computer-readable storage media as used herein should not be construed as being ephemeral signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through fiber optic cable), or electrical signals transmitted through wires.

[0065] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium within the respective computing / processing device.

[0066] Computer-readable program instructions for carrying out the operations of the present invention may be source or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine language instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or object-oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a stand-alone software packet, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer readable program instructions by utilizing state information of the computer readable program instructions to individualize the electronic circuitry to implement aspects of the present invention.

[0067] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0068] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, the instructions of which execute on the processor of the computer or other programmable data processing apparatus to produce means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may further be stored on a computer-readable storage medium, such that the computer-readable storage medium comprises an article of manufacture including instructions for performing aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams, and can direct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner.

[0069] The computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device to perform a series of operational steps on the computer, other programmable apparatus, or other device to produce a computer-executed process, the instructions executing on the computer, other programmable apparatus, or other device to perform the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0070] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing specific logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be performed as a single step performed concurrently, substantially concurrently, partially, or fully in a time-overlapping manner, or the blocks may sometimes be performed in the reverse order depending on the functionality involved. It will be further noted that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, can be implemented by a dedicated hardware-based system that performs specific functions or operations or executes a combination of dedicated hardware and computer instructions.

[0071] The description of various embodiments of the present invention has been presented for purposes of illustration and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, practical applications, or technical improvements over technology found in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A computer-implemented method comprising: receiving, by one or more processors, an encrypted user private key in a trusted execution environment (TEE) of a worker node in a container management system, the encrypted user private key being an encrypted version of a user private key for decrypting messages from a user in the container management system; obtaining, by one or more processors, the user private key in the TEE, wherein the encrypted user private key is decrypted into the user private key with a provider private key received from a cryptography manager for managing the container management system; 20. A computer-implemented method comprising:

2. 2. The method of claim 1, wherein obtaining the user private key comprises receiving, by one or more processors, the user private key decrypted by firmware associated with the worker node based on the provider private key stored in a hardware security module connected between the worker node and the cryptographic manager.

3. Receiving the encrypted user private key receiving, by one or more processors, in a storage device external to the TEE of the worker node, a disk image including the encrypted user private key from an image registry of the container management system, the image registry storing at least one disk image to be deployed to the worker node; extracting, by one or more processors, in the TEE, the encrypted user private key from the disk image; The method of claim 1 , comprising:

4. extracting the encrypted user private key in the TEE; Attaching, by one or more processors, virtual storage of the TEE to the storage device; loading, by one or more processors, the disk image from the storage device into the virtual storage of the TEE; extracting, by one or more processors, in the TEE, the encrypted user private key by parsing the disk image loaded into the virtual storage; The method of claim 3, comprising:

5. receiving, by one or more processors, at the TEE, the message from the user of the container management system, the message including sensitive data encrypted with a user public key corresponding to the user private key; decrypting, by one or more processors, the message into the secret data in the TEE with the user private key; The method of claim 3 further comprising:

6. receiving the message at the TEE, receiving, by one or more processors, the message at the storage device external to the TEE of the worker node; Attaching, by one or more processors, virtual storage of the TEE to the storage device; loading, by one or more processors, the message from the storage device into the virtual storage of the TEE; The method of claim 5 , comprising:

7. receiving, by one or more processors, a password for accessing the message in the virtual storage of the TEE; accessing, by one or more processors, the message in the virtual storage of the TEE with the password; The method of claim 6 further comprising:

8. the container management system includes a Kubernetes® system, and the user of the container management system includes one of a customer and an administrator of the Kubernetes® system; 10. The method of claim 1, wherein the user's confidential data includes any of environment parameters and files for deploying a container associated with a disk image within a work node, and the method further includes installing, by one or more processors, the disk image on the work node based on the confidential data.

9. 1. A computer-implemented method comprising: encrypting, by one or more processors, a user private key with a provider public key received from an encryption manager for managing a container management system, the user private key being for decrypting messages from a user at the container management system; transmitting, by one or more processors, an encrypted user private key to a worker node in the container management system, such that the worker node obtains the user private key in a trusted execution environment (TEE) of the worker node, and the encrypted user private key is decrypted to the user private key with a provider private key received from the encryption manager; 20. A computer-implemented method comprising:

10. transmitting the encrypted user private key to the TEE; inserting, by one or more processors, the encrypted user private key into a disk image of a container to be deployed within the worker node; transmitting, by one or more processors, the disk image to the worker nodes, such that the worker nodes extract the encrypted user private key from the disk image; 10. The method of claim 9, comprising:

11. encrypting, by one or more processors, confidential data of the user with a user public key corresponding to the user private key; transmitting, by one or more processors, a message including encrypted sensitive data to said worker node; The method of claim 10 further comprising:

12. The method of claim 11 , wherein the worker node decrypts the encrypted sensitive data with the user private key in the TEE to the sensitive data.

13. 1. A computer-implemented system comprising: a computer processor coupled to a computer-readable memory unit, said memory unit, when executed by said computer processor, receiving an encrypted user private key in a trusted execution environment (TEE) of a worker node in a container management system, the encrypted user private key being an encrypted version of a user private key for decrypting messages from a user in the container management system; obtaining the user private key in the TEE, wherein the encrypted user private key is decrypted to the user private key with a provider private key received from an encryption manager for managing the container management system; A computer-implemented system having instructions for performing a method comprising:

14. 14. The computer-implemented system of claim 13, wherein obtaining the user private key comprises receiving the user private key decrypted by firmware associated with the worker node based on the provider private key stored in a hardware security module connected between the worker node and the cryptographic manager.

15. Receiving the encrypted user private key receiving, in a storage device external to the TEE of the worker node, a disk image including the encrypted user private key from an image registry of the container management system, the image registry storing at least one disk image to be deployed to the worker node; extracting, in the TEE, the encrypted user private key from the disk image; 14. The computer-implemented system of claim 13, comprising:

16. extracting the encrypted user private key in the TEE; Attaching virtual storage of the TEE to the storage device; loading the disk image from the storage device into the virtual storage of the TEE; extracting, in the TEE, the encrypted user private key by parsing the disk image loaded into the virtual storage; 16. The computer-implemented system of claim 15, comprising:

17. The method comprises: receiving, in the TEE, the message from the user of the container management system, the message including confidential data encrypted with a user public key corresponding to the user private key; decrypting the message into the confidential data in the TEE with the user private key; 15. The computer-implemented system of claim 14, further comprising:

18. receiving the message at the TEE, receiving the message at a storage device external to the TEE of the worker node; Attaching virtual storage of the TEE to the storage device; loading the message from the storage device into the virtual storage of the TEE; 20. The computer-implemented system of claim 17, comprising:

19. receiving a password to access the message in the virtual storage of the TEE; accessing the message in the virtual storage of the TEE with the password; 20. The computer-implemented system of claim 18, further comprising:

20. the container management system includes a Kubernetes® system, and the user of the container management system includes one of a customer and an administrator of the Kubernetes® system; 14. The computer-implemented system of claim 13, wherein the user's confidential data includes any of environment parameters and files for deploying a container associated with a disk image within a work node, and the method further includes installing, by one or more processors, the disk image on the work node based on the confidential data.

Images