KR102322312B1 - Container security management system using Kubernetes RBAC - Google Patents

Abstract

The present invention relates to a container security management system and a container security management method using Kubernetes role based access control (RBAC). According to one embodiment of the present invention, the container security management system using the Kubernetes RBAC includes: a storage unit that provides an external resource including a CPU, a memory, a network, and a storage space to one or more implemented virtual containers; a host operating system unit that provides a main operating system of a virtual cloud server that manages the containers, and provides operating systems to the one or more virtual containers, respectively; and a container control management unit that interworks with the virtual cloud server to control and manage a container management platform accessed from an outside, employs a Kubernetes orchestration tool, and controls and manages the virtual containers through the RBAC, wherein the container control management unit includes: an account verification unit for receiving an ID and a password to access the virtual container, and verifying whether an account is registered in the container control management unit in advance; an account impartment unit for selecting one of a cluster or a namespace role to impart the selected one to a newly opened account; and an account management unit for controlling and managing the account registered in the container control management unit. Accordingly, security of the virtual container is enhanced.

Description

Container security management system using Kubernetes RBAC (Role Based Access Control)

The present invention relates to a container security management system and method using Kubernetes RBAC. More particularly, it relates to a container security management system and method using Kubernetes RBAC for enhancing security of virtual containers using Kubernetes' orchestration tool and RBAC (Role Based Access Control).

With the technological development of computer networks, the existing computing environment, which relied on the independent hardware performance of each terminal, utilizes all computing resources on the network to provide simple and easy use of the service according to the request of the user terminal. It has evolved in the form of (Cloud Computing). Currently, when constructing an IT infrastructure, cloud computing technology is commonly used when configuring servers or systems because of the advantages of sharing IT resources and efficiently using idle resources. Virtualization technology can be cited as a core base technology of cloud computing, and Xen and KVM, which are called hypervisor-based, exist as open server virtualization technologies widely used in the server field. Virtual machine-based server virtualization technology installs an operating system (hereafter, host OS) on a physical server, creates a virtual machine by dividing resources based on the hypervisor, and then installs the operating system (hereafter, the guest OS) again. How to run the application. Although this method has the advantage of being able to have a plurality of servers that can be independently operated in one physical system, there is a disadvantage in that resources are wasted greatly when the host OS and the guest OS are operating independently of each other.

Accordingly, the container method, which is a virtualization technology different from the virtual machine method, is recently popular. Since the container-based system shares the operating system kernel, it is much lighter than the virtual machine method, so it has excellent portability, starts up much faster, and occupies much less memory than the entire operating system boot. As described above, in the cloud service environment, you can select and use virtual machine servers and resources as much as you want at the desired time through the cloud system in which the necessary resources such as CPU, memory, storage, and application programs are provided with virtualization technology. Advanced services can also be provided, but problems such as security, stability, and guarantee of service performance have arisen.

Republic of Korea Patent Publication No. 10-2016-0068108

An object of the present invention is to provide a container security management system and method using Kubernetes RBAC for enhancing security of virtual containers using Kubernetes orchestration tools and RBAC (Role Based Access Control).

In order to solve the above problem,

A container security management system using Kubernetes RBAC according to an embodiment of the present invention includes: a storage unit that provides external resources including CPU, memory, network, and storage space to one or more implemented virtual containers;

a host operating system that provides a main operating system of a virtual cloud server that manages the containers, and provides an operating system to each of the one or more virtual containers;

Container control that controls and manages a container management platform that can be accessed from the outside in conjunction with the virtual cloud server, and applies a Kubernetes orchestration tool, but controls and manages the virtual container through RBAC (Role Based Access Control) Management; including,

The container control and management unit includes: an account verification unit that receives an ID and a password to access the virtual container and checks whether an account is previously registered with the container control and management unit;

Whether to grant an account to a newly opened account by selecting one of a cluster or namespace role; and

an account management unit for controlling and managing accounts registered in the container control management unit; may include.

In addition, in the container security management system using Kubernetes RBAC according to an embodiment of the present invention, the account management unit includes: an account generator for creating at least one of an administrator account and a general account;

an expiration determination unit for determining whether an account expires among the administrator accounts to which the role is assigned in the account granting unit;

an account extension unit for extending account use among the accounts created by the account creation unit or the accounts whose use has expired as determined by the expiration determination unit;

an account deletion unit configured to delete an account limited to the account for which the account use has been determined by the expiration determination unit; may include.

In addition, in the container security management system using Kubernetes RBAC according to an embodiment of the present invention, the account created in the account generator creates a general account and an administrator account that can use the Kubernetes orchestration tool, respectively, , one of a cluster or namespace role can be assigned to the administrator account.

In addition, in the container security management system using Kubernetes RBAC according to an embodiment of the present invention, the container control and management unit, the role assigned to the administrator account when the expired account determined by the expiration determination unit is rejected for extension can only be deleted.

In addition, in the container security management system using Kubernetes RBAC according to an embodiment of the present invention, the container control and management unit does not use the account for more than a certain period of time by limiting the account for which the account expiration is determined by the expiration determining unit. , when the container control and management unit requests deletion of the administrator account, the administrator account and the general account may be deleted together.

A container security management method using Kubernetes RBAC according to an embodiment of the present invention includes the steps of (a) inputting an account ID and password into a container management platform interworking with a container control management unit;

(b) determining whether the account expires by the container control management unit limited to the account received from the container management platform;

(c) determining whether the period of use has expired by the container control and management unit, and connecting an account during the period of use to the container management platform; including,

In step (b), when the account determined by the container control and management unit has expired, it is possible to receive an input of whether to extend the account through the container management platform, and delete the role assigned to the administrator account for the account that refused to extend the use of the account. have.

In addition, in the container security management method using Kubernetes RBAC according to an embodiment of the present invention, if there is no account to access the container management platform in step (a), the account management unit uses a general account and a Kubernetes orchestration tool You can create an administrator account that can use , and assign a role to each account.

In addition, in the container security management method using Kubernetes RBAC according to an embodiment of the present invention, in the step (b), whether to apply for an account extension is determined by limiting the account use to the expired account through the container management platform. The management unit may inquire about it, and the account may not be used for a certain period of time or more, or the administrator account and general account of an account that has requested deletion of the administrator account from the container control management unit may be deleted.

These solutions will become more apparent from the following detailed description of the invention based on the accompanying drawings.

Prior to this, the terms or words used in the present specification and claims should not be construed in their ordinary and dictionary meanings, and the inventor may properly define the concept of the term in order to best describe his invention. It should be interpreted as meaning and concept consistent with the technical idea of the present invention based on the principle that it is possible.

That is, according to an embodiment of the present invention, by registering a usage expiration period in the account of the container management platform and deleting the role granted to the administrator account upon expiration, the right to access Kubernetes resources in the future can be prevented. If the account does not use the container management platform, the right to access Kubernetes resources can be prevented in advance by deleting the general account and the administrator account together.

1 is a schematic diagram showing a virtual cloud server of a container security management system using Kubernetes RBAC according to an embodiment of the present invention.
2 is a block diagram illustrating a container security management system cluster component using Kubernetes RBAC according to an embodiment of the present invention.
3 is a block diagram illustrating components of a container control management unit of a container security management system using Kubernetes RBAC according to an embodiment of the present invention.
4 to 6 are flowcharts illustrating an account creation and account management sequence of a container security management method using Kubernetes RBAC according to an embodiment of the present invention.

The specific aspects and specific technical features of the present invention will become more apparent from the following detailed description and embodiments in conjunction with the accompanying drawings. In the present specification, in adding reference numerals to the components of each drawing, it should be noted that the same components are given the same reference numerals as possible even if they are indicated on different drawings. In addition, in describing an embodiment of the present invention, if it is determined that a detailed description of a related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

In addition, in describing the components of the present invention, terms such as first, second, A, B, (a), (b), etc. may be used. These terms are only for distinguishing the elements from other elements, and the essence, order, or order of the elements are not limited by the terms. When a component is described as being “connected”, “coupled” or “connected” to another component, the component may be directly connected to or connected to the other component, but another component may exist between each component. It should be understood that elements may be “connected,” “coupled,” or “connected.”

Hereinafter, an embodiment of the present invention will be described in detail based on the accompanying drawings.

As shown in FIG. 1 , the container security management system using Kubernetes RBAC according to an embodiment of the present invention provides a virtual container 4 with external resources including CPU, memory, network, and storage space. A branch unit 1, a host operating system unit 2 that provides an operating system to the virtual container 4, and a main operating system of a virtual cloud server that manages the virtual container is provided, and a container control management unit that manages the virtual container 4 ( 3) may be included.

The storage unit 1 provides the CPU, memory, network, and storage space installed in the virtual cloud server to the virtual container 4 so that the application 5 or the registry 6 installed in the virtual container 4 can be driven. The virtual cloud server can perform the function of lending external resources. In addition, the storage unit 1 may additionally include a resource capable of lending a resource to the virtual container 4 , and may include a graphic card and an IP address.

The host operating system unit 2 may include a host operating system installed in the virtual cloud server, and each of the host operating systems installed in the virtual cloud server may be provided to the virtual containers 4 in which one or more are built. That is, the host operating system installed in the virtual cloud server and the operating system provided to the virtual container 4 are the same, but not limited thereto, and the operating system provided to the virtual container 4 may be installed in the virtual cloud server and provided separately. have.

The container control management unit 3 is configured to control and manage one or more virtual containers 4 implemented in the virtual cloud server, and the container management platform is interlocked with the virtual cloud server so that a user can access the virtual container 4 . It can be implemented so that

In addition, the container control and management unit 3 implements a Kubernetes orchestration tool, but by implementing RBAC (Role Based Access Control), the permissions for container management provided by Kubernetes are implemented based on a role. , you can create a service account and assign additional roles to control the use rights of Kubernetes.

The container control management unit 3 may be implemented by including a cluster role (or an administrator role) that can access the entire cluster and a namespace role that can access only the namespace.

As shown in FIG. 2 , when a cluster Role is granted, the authority to control the master node 11 , the worker node 13 , and the namespace 12 included in the cluster 10 is granted, and the namespace When the Role is assigned, the authority to control only the namespace 12 may be given.

Here, the master node 11 is a node that manages all nodes belonging to the cluster 10, the worker node 13 is a node where containers are actually deployed, and the namespace 12 is a logical node in the Kubernetes cluster. refers to the unit of distinction. That is, the cluster role is the role given to the administrator, and the namespace role is the role given to the user who uses the virtual container.

As shown in FIG. 3 , the container control and management unit 3 receives an ID and a password to access the virtual container and checks whether an account is registered in advance with the container control and management unit 3 . and an account granting unit 22 that selects and grants a cluster or namespace role to a newly opened account, and an account management unit 23 that controls and manages accounts registered in the container control management unit 3 can be

The account verification unit 21 receives the account ID and password input from the container management platform and performs a function of checking whether an account is registered in the container control management unit 3 , and the account registered in the container control management unit 3 is If not, you can create a new account through a new subscription provided by the container management platform. In this case, when creating a new account, the account expiration period can also be set.

Here, when creating a new account through the container management platform, the account verification unit 21 may create a general account and an administrator account, respectively, and assign a role to each account through the account verification unit 21 . Here, the general account refers to an account ID and password input in the container management platform, and the administrator account can be given a range of access rights by granting either a cluster or a namespace role.

For example, if the administrator account grants a cluster role, access to the entire cluster is granted. If the first namespace role is granted, the authority to grant the entire namespace in the cluster is granted, and the second name When a space role is granted, it can be structured in a structure in which some of the resources are granted within the namespace within the cluster.

For example, when the second namespace role is granted to the administrator account, some privileges of the namespace are granted according to the role. In the general account that manages and staging development applications within the namespace, a part of the second namespace role ( Namespace permission related to application management and staging can be granted, and part of the second space role (namespace permission related to operating environment deployment) can be granted to the general account that deploys the operating environment of the application in the staging within the namespace. ) can be given.

A general account and an administrator account are created in the above manner, and an account to which a cluster or namespace role is assigned may be registered in the container control management unit 3 , and an account registered in the container control management unit 3 may be registered in the account management unit 23 ) through which accounts can be controlled and managed.

The account management unit 23 may include an account creation unit 24 , an expiration determination unit 25 , an account extension unit 26 , and an account deletion unit 27 .

The account creation unit 24 may create at least one of a general account and an administrator account, and may create a general account created through the container management platform and an administrator account that can be granted by the account granting unit 22 . can

The expiration determination unit 25 performs a function of determining whether an account expires among the administrator accounts to which a Role (either a role of a cluster or a namespace) is granted among the accounts registered in the container control management unit 3, and the account expiration The account used may be extended through the account extension unit 26 . In this case, the account extension unit 26 may set an account expiration period for the account created by the account creation unit 24 .

The account deletion unit 27 performs a function of deleting an account whose usage period has expired, and may delete the account after the expiration determination unit 25 determines whether the usage has expired. Specifically, the account deletion unit 27 If the account is not used for more than the period set in advance by the container control and management unit 3, or the container control and management unit 3 requests to delete the account, limited to the account that has expired as determined by the expiration determination unit 25, the general account and You can also delete the administrator account.

On the other hand, in the container security management method using Kubernetes RBAC, inputting an account ID and password to a container management platform interlocked with the container control management unit 3, and controlling the container limited to the account input from the container management platform It may include the steps of determining whether the account is expired by the management unit 3 , determining whether the usage period has expired by the container control management unit 3 , and connecting the account during the usage period to the container management platform.

For example, if there is no account to access the container management platform, as shown in FIG. 4 , an account and an expiration period of use can be registered in the account creation in the container management platform login window (S11, S12). The account created in the container management platform may register a general account that can log in to the container management platform with the container management platform (S13), and create an administrator account that can use the Kubernetes orchestration tool (S14).

After the administrator account is created, either the cluster role or the namespace role is assigned (S16, S17). If the role is assigned to the administrator account, the account creation procedure is completed and you can log in to the container management platform.

When a general user logs in to the container management platform, as shown in FIG. 5 , when an account ID and password are entered into the container management platform to log in (S21), the container control management unit 3 determines whether the account has expired. It can be determined through the expiration determination unit 25 (S22), and an account that has not expired can be logged in (S23). Expiration of use may be notified (S24).

Thereafter, the container control management unit 3 receives an input of whether to extend the account use through the container management platform and, for example, rejects the account use extension, may delete the role assigned to the administrator account that can use the Kubernetes orchestration tool (S26). ). Also, for example, if the account use extension is approved, the account use extension application may be approved by additionally setting an expiration period for the expired account ( S27 ).

On the other hand, the method of managing the account registered in the container management platform, as shown in FIG. 6 , inquires the account registered in the container management platform through the container control management unit 3 to request an account use extension (S31, S32) , it is determined whether one or more accounts that have applied for extension of account use are users registered in the virtual cloud server (S33), and if they are users registered in the virtual cloud server, the extension of use of general accounts and administrator accounts is approved to be added to the administrator account. The assigned role may also be newly assigned, or the period of use of an existing assigned role may be extended (S34, S35).

In addition, in the case of a user not registered in the virtual cloud server, the general account and the administrator account may be deleted, and the role assigned to the administrator account may also be deleted (S36 and S37).

Here, the criterion for determining the user registered in the virtual cloud server or the user not registered in the virtual cloud server is whether a user logging in through the container management platform is a retired person, but is not limited thereto.

That is, according to an embodiment of the present invention, by registering a usage expiration period in the account of the container management platform and deleting the role granted to the administrator account upon expiration, the right to access Kubernetes resources in the future can be prevented. If the account does not use the container management platform, the right to access Kubernetes resources can be prevented in advance by deleting the general account and the administrator account together.

Although the present invention has been described in detail through one embodiment, this is intended to describe the present invention in detail, and the container security management system and method using Kubernetes RBAC according to the present invention is not limited thereto. And, terms such as "include", "comprise", or "have" described above mean that the component may be embedded unless otherwise stated, so excluding other components is It should be construed as being able to further include other components rather than other components, and all terms including technical or scientific terms are generally understood by those of ordinary skill in the art to which the present invention belongs, unless otherwise defined. has the same meaning as being

In addition, the above description is merely illustrative of the technical idea of the present invention, and various modifications and variations are possible by those skilled in the art to which the present invention pertains without departing from the essential characteristics of the present invention. Accordingly, one embodiment disclosed in the present invention is not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by this one embodiment. The protection scope of the present invention should be construed by the following claims, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

1 - storage unit 2 - host operating system unit
3 - Container control management unit 4 - Virtual container
5 - Application 6 - Registry
10 - Cluster 11 - Masternode
12 - Namespace 13 - Workernode
21 - Account verification section 22 - Account grant status
23 - Account Management Department 24 - Account Creation Department
25 - Expiration judgment unit 26 - Account extension unit
27 - Account Deletion Department

Claims (8)

a storage unit that provides external resources including CPU, memory, network, and storage space to one or more implemented virtual containers;
a host operating system that provides a main operating system of a virtual cloud server that manages the containers, and provides an operating system to each of the one or more virtual containers;
Container control that controls and manages a container management platform that can be accessed from the outside in conjunction with the virtual cloud server, and applies a Kubernetes orchestration tool, but controls and manages the virtual container through RBAC (Role Based Access Control) Management; including,
The container control and management unit includes: an account verification unit for receiving an ID and a password to access the virtual container and confirming whether an account is previously registered with the container control and management unit;
Whether to grant an account to a newly opened account by selecting one of a cluster or namespace role; and
an account management unit for controlling and managing accounts registered in the container control management unit; includes,
The account management unit, an account generation unit for generating at least one account of the manager account and the general account;
an expiration determination unit for determining whether an account expires among the administrator accounts to which the role is assigned in the account granting unit;
an account extension unit for extending account use from among the accounts created by the account creation unit or the accounts whose use has expired as determined by the expiration determination unit;
an account deletion unit configured to delete an account limited to the account for which the account use has been determined by the expiration determination unit; Container security management system using Kubernetes RBAC, including.
delete The method according to claim 1,
The account created in the account creation unit creates a general account and an administrator account that can use the Kubernetes orchestration tool, respectively, and assigns either a cluster or namespace role to the administrator account, using Kubernetes RBAC. Container Security Management System.
4. The method according to claim 3,
The container security management system using Kubernetes RBAC, wherein the container control and management unit deletes only the role assigned to the administrator account when the expired account determined by the expiration determination unit is rejected.
4. The method according to claim 3,
The container control and management unit deletes the administrator account and the general account together when the account is not used for a certain period of time or longer by limiting the account for which the expiration determination unit determines the account expiration, or when the container control and management unit requests to delete the administrator account. Container security management system using Kubernetes RBAC.
In the container security management method using the container security management system using the Kubernetes RBAC according to claim 1,
(a) inputting an account ID and password into a container management platform linked with a container control management unit;
(b) determining whether the account expires by the container control management unit limited to the account received from the container management platform;
(c) determining whether the period of use has expired by the container control and management unit, and connecting an account during the period of use to the container management platform; including,
In the step (b), when the account determined by the container control and management unit expires, it is inputted through the container management platform whether to extend the account use, and the role assigned to the administrator account is deleted for the account that has rejected whether to extend the account use, ,
If there is no account to access the container management platform in step (a) above, the account management department creates a general account and an administrator account that can use the Kubernetes orchestration tool, respectively, and assigns a role to each account, Kubernetes RBAC How to manage container security using
delete 7. The method of claim 6,
In step (b), the account management unit inquires whether to apply for an extension of account use by limiting the account use to the expired account through the container management platform, and does not use the account for more than a certain period of time, or the container control management unit selects the administrator account How to manage container security using Kubernetes RBAC, which deletes the administrator account and general account of the account that requested deletion.

Images