RU2785555C1 - Method of processing user data - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: invention relates to the field of computer technology for protecting user data, more specifically, to means for processing user data that provide protection against unauthorized access to information processed and stored in cloud computer information and computing systems. The technical result is achieved due to the fact that the transmission of user data is carried out through a closed VPN network, and the data is analyzed for the presence of malicious data. Data processing is carried out by a virtual machine into which a docker container with user data is loaded. The processing results are uploaded to the server, and the virtual machine is deleted, which eliminates the possibility of further data leakage. The user's access to the container is based on the user identifier obtained from the information about the user's current session when accessing the container. Checking the user's access rights to the container is carried out in accordance with the access permissions matrix. In addition, the claimed method includes the stage of analyzing data on the load of computing resources of the cloud infrastructure.

EFFECT: technical result consists in ensuring the secure processing of user data, taking into account load balancing between the nodes of the cloud environment.

5 cl

Description

Technical field

This invention relates to the field of computer technology that provides protection of user data, more specifically, to means for processing user data that provide protection against unauthorized access to information processed and stored in cloud computer information and computing systems. State of the art

The prior art method of managing container applications on the edge device, described in US 20220164177 A1, G06F 8/65, publ. May 26, 2022. According to the known solution, through the edge mechanism of the network device, control, request or receive information about the container engine running on the network device. The container mechanism retrieves and manages the application container. The container includes a trained machine learning model, and can be obtained from the app store. In a known method, a trained machine learning model is run to generate data and the data is output for display in a user interface. The docker engine contains a client and server connected with the ability to communicate through a high-level REST API. The client can run commands, each of which is translated using the REST API and sent to the server. This solution provides the ability to securely deploy containerized applications.

A known system for providing access to user data, described in US 20180121447 A1, G06F 21/60, publ. 05/03/2018. In the known solution, the service system implements a web-based customer relationship management (CRM) system that provides CRM services to users. The system includes application servers configured to implement and execute CRM software applications and provide related data, code, forms, web pages, and other information to and from client devices, as well as store and retrieve data, objects, and web page content. The system determines the policies that apply to the data. Certain policies specify the transformations that must be performed on the data to ensure user privacy. The system converts user data according to policies and provides the converted user data to the administrator. The known solution aims to protect the privacy of user data.

There is a known method for opening unverified content in a separate one-time virtualized environment using a temporary virtual machine (VM) (US 2015089497 A1, publ. 03/26/2015, class G06F 21/00). The known method includes intercepting a request to open/access unverified content from a third party remote server and comparing specific information/attributes of the unverified content with predefined criteria. The user device may connect using a remote presentation protocol to a temporary virtual machine in a separate disposable environment such that unverified content output can be transported and displayed in a separate disposable environment. The connection to the temporary virtual machine can be terminated, and a separate one-time environment can be cleaned up to reduce the risk of malicious code in unverified content.

The prior art data processing method described in CN 110471740 A, G06F 9/455, publ. 11/19/2019, taken as a prototype. In the known solution, the server is a cloud service provider capable of creating a virtual machine on a cloud server and performing machine learning tasks. After receiving a machine learning task from the user, the server determines the base image. The container image corresponding to the base image and corresponding to the machine learning task is determined. A virtual machine is created on the cloud server using the base image, and then a Docker container is instantiated in the created virtual machine using the generated image. After mounting the data corresponding to the machine learning task into the container instance, the container instance is launched to begin executing the machine learning task. The known solution is aimed at improving the efficiency of data processing and performing machine learning tasks.

These analogues do not describe and do not assume the analysis of data on the load of computing resources of the cloud infrastructure in order to obtain a load indicator and create a virtual machine based on it; and after loading the prepared docker container with user data into the virtual machine, performing user identification by obtaining the user ID from information about the current user session when accessing the container and checking access rights when accessing the container.

The task is to create a solution that allows you to distribute the load between the nodes of the cloud infrastructure and provides data protection from unauthorized access.

The technical result consists in ensuring the secure processing of user data, taking into account load balancing between the nodes of the cloud environment.

The essence of the invention

The specified technical result is achieved and the task is solved due to the fact that:

a method for processing user data, including transferring user data via a closed VPN network from a thin client,

made in the form of a web application, to the server part, where the server part interacts with the client through the REST API, and data is transmitted through the application server, contains a stage at which user data is analyzed for malicious data; as well as the stages consisting in placing the transferred user data in a private virtual storage network (SAN);

analysis of data on the load of computing resources of the cloud infrastructure to obtain a load indicator;

create a virtual machine based on the utilization rate;

loading the prepared docker container with user data into the virtual machine;

identifying the user and checking access rights when accessing the container, including obtaining a user identifier from information about the current session of the user when accessing the container and checking the user's access rights to the container;

processing the required data sets by a virtual machine under the control of the received user data;

uploading the results of processing the required data sets to the server;

deactivation of the virtual machine to process the received user data;

transferring the results of processing the required data sets to the storage system; providing user access to the results of processing the required data sets.

In addition, in the claimed solution, a closed VPN network can be built on VipNet technology.

In addition, in the claimed solution, the user data includes at least an artificial intelligence model and data sets for training the model.

In addition, in the claimed solution, access to user data can be defined only for the user who downloaded them.

In addition, checking the user's access rights to the container can be performed in accordance with the access permission matrix.

Implementation of the invention

Embodiments of the invention provide mechanisms for processing user data using a virtual machine.

The present disclosure describes a method for processing user data in a system that has a service architecture, which is a thin client in the form of a web application and a server part that implements interaction with the client through the REST API.

All connections of the client application to the server occur within a closed VPN network, thus excluding the possibility of compromising the transmitted and received information at the stage of data exchange.

All requests that come to the server from the thin client are analyzed for malicious data. All input parameters for interaction are strictly limited. Thus, the possibility of using malicious requests from the client side is not allowed.

Users are given the opportunity to upload their models and data sets to the system.

After analyzing the data for the presence of malicious data, user data is placed in a private virtual storage area network (SAN).

The movement of user files after they are downloaded to perform the functionality of the system occurs only within a closed cloud network between servers and services. To implement the work of the model on the provided data set, a new virtual machine is created, closed from external access.

The virtual machine is created based on data on the load on the computing resources of the cloud infrastructure.

A set of Load Balancing micro-applications running in the cloud infrastructure distributes user requests among end executors in order to balance the load. Using the modular principle allows you to use different approaches to implement the balancing mechanism. One of the options for such approaches can be the approach based on the standard deviation.

The service allows you to automate load balancing between nodes. It collects data, analyzes it and decides on the migration of virtual machines from one host to another. The service is part of the system, which allows you to call internal functions without using an external API.

The structure of the solution is as follows

- Statistical data collection module;

- Module for analyzing collected data and making decisions;

- Virtual machine balancing module (overload-algorithm);

- Module for determining the insufficiency of the workload of computing nodes (underload-algorithm);

- Auxiliary services (API, balancer rules);

These modules have base classes, which allows you to use your own class implementations.

For analysis, it is required to obtain data on the load of computing resources from each node. A node's CPU utilization is obtained using the psutil Python library. A node's free RAM is calculated as the sum of free, cached, and buffered memory. The libvirt virtualization management library allows you to get up-to-date data on the resource usage of a virtual machine. The service is modified in such a way that at a certain interval it sends data on the node load (percentage CPU load, RFAM load in megabytes) and the load of each virtual machine (processor time, RAM load in megabytes) located on it to the process manager that provides interaction with a database. The received information is recorded in the corresponding database tables. Data on the workload of virtual machines and hosts is populated using the atomic UPSERT method.

Based on the CPU and RAM indicators, the threshold values of the standard deviation are set in the configuration file. This module is launched with a frequency defined in the configuration file. The collected data is converted into percentages. It is necessary to normalize indicators within the limits [0, 1]. To do this, the processor time is converted into CPU utilization using the following formula:

where:

cpu_time - CPU time spent by the virtual machine processing processes (tasks). Expressed in nanoseconds.

oldcpu_time - CPU time spent by the virtual machine at the previous point in time (during time_old).

time_current - the time at which the cpu_time was taken. Expressed in seconds.

time_old - time at which oldcpu_time was taken. Expressed in seconds.

vcpus - the number of cores allocated to this virtual machine.

RAM utilization is calculated as the ratio of used memory to the total amount of memory in the node. After processing the load on all nodes, the arithmetic mean for CPU and RAM and the standard deviation are calculated. The obtained values are compared with the threshold values specified in the configuration file, on the basis of which a conclusion is made about the need to stabilize the cluster. If the obtained values are below the threshold, the balancer will check the cluster for energy efficiency using the underload algorithm. Otherwise, the virtual machine balancing module is launched.

The virtual machine load balancing module allows you to create your own balancing implementations, or use an implementation based on the standard deviation.

The balancer receives the current load values of all nodes and their virtual machines. Based on the received data, the simulation of moving each virtual machine to each node (except for the original node for the virtual machine) is performed, during which the load indicators are changed to determine the new probable standard deviation. The simulation results are written to the list as a dictionary {host, VM, variance}. This list, at the end of all simulations, is sorted in ascending order with the key standard deviation. The resulting list characterizes all possible cases of moving virtual machines, of which we are interested in those that minimize the deviation. The pair {node, virtual machine} taken must be filtered. Filters allow you to determine whether it is possible to run a virtual machine on a given host. If one of the filters fails, the {host, virtual machine} pair skips further filtering and is discarded.

If the pair passed the filtering, the live-migration method is called, which moves the virtual machine from the source node to the target node. During the migration, a new domain is created in libvirt, into which the contents of the virtual machine's RAM are copied. When the copy is close to completion, the hypervisor pauses the virtual machine, copies the remaining data, and activates the virtual machine's domain, bringing it back online. At the end of the migration, the balancing module stops its work until the next call in case of overload.

If the pair is not filtered by the service, the next pair is taken from the list. Such an implementation allows you to gradually stabilize the load in the cluster until the standard deviation for the nodes is below the threshold value. Changing the threshold value allows you to adjust the "sensitivity" of the balancer to overloads.

After creating a virtual machine based on the load indicator, the prepared docker container with user data is loaded into the virtual machine.

The claimed method of data processing involves performing the stage of user identification and checking access rights when accessing the container.

The main components of the access control and delimitation subsystem are the user identification module and the access rights verification module. The user identification module performs identification of users authenticated in the operating system using information about the current user session when accessing the obfuscated container. The access rights check module implements checking of user access rights to the obfuscated container. The access permission matrix is stored in a secure container format as an additional section of the executable file.

The purpose of the functioning of the subsystem of the isolated software environment is to provide protection against unauthorized access to the files of the environment and databases in RAM and on storage media during their processing.

The OS of the Linux family (Ubuntu 18.04) was chosen as the base operating system for the implementation of the system of controlled access control to files in documentary formats. This is due to the fact that these operating systems are open source and are widely used in various government organizations and departmental structures.

On the basis of the proposed architecture, a structural model of the functioning of the system for controlled access control to data arrays was developed.

It should be noted that the data array extracted from the obfuscated container is placed in the sandbox space. Thus, an attacker cannot make unauthorized access to it, since the document is not stored in RAM accessible to user-level applications.

According to the structural model of the functioning of the system of controlled access to data, the following steps are assumed:

1. The data processing model attempts to access data in an obfuscated container. The access control and delimitation subsystem performs user identification and verification of access rights. If access is granted, the document is retrieved from the secure container and placed in the "input_buf" directory, which is simultaneously attached to the sandbox.

2. The data processing model works with data in an isolated software environment. At the end of the work, the system assigns data access rights similar to those that were previously. The document is then saved to the "output_buf" directory, which is the sandbox directory but attached to the underlying OS. The user does not have rights to access the "output_buf" directory, only the access control and demarcation subsystem can access this directory.

3. When a document appears in the "output_buf" directory, the data conversion subsystem embeds the document and access rights into the executable file template, and then the indistinguishable obfuscation procedure is applied.

To implement the isolated software environment, an approach based on Linux Containers (LXC) technology was chosen. LXC technology is an OS-level virtualization system that creates a virtual environment with its own process space and network stack. LXC has built-in mechanisms for controlling and restricting access to memory and file system resources. To access LXC, it is proposed to use the Docker system (software for automating the deployment and management of applications in an OS-level virtualization environment). It allows you to encapsulate an application with all its environment and dependent libraries in a container that can be ported to any OS of the Linux family, with support for the cgroups kernel mechanism.

The client part allows you to manage containers from the command line interface. The server part provides complete isolation of containers running on the host at the file system level (each container has its own root file system), at the process level (processes have access only to the container's own file system, and resources are separated by LXC tools), at the network level (each container has access only to the network namespace associated with it and the corresponding virtual network interfaces). The Docker container runs in the user space of the underlying OS as an isolated process and shares kernel resources with other containers. At the same time, each Docker container is a sandbox, which is a secure platform for extracting documents from obfuscated containers and working with them.

An important point in the implementation of a system of controlled data access control is the formation of an executable file template. An executable file consists of a number of headers containing service data designed to inform the OS loader about the structure and size of data; file sections containing data and machine code that implements the functional purpose of this program. The file header (.header) has a fixed location at the beginning of the file and contains a general description of the file structure and its main characteristics, such as: type, format version, processor architecture, virtual entry point address, sizes and offsets of the rest of the file.

File sections are blocks of data containing information about the location of machine code and program data in the file, as well as the location of these data in the virtual address space and the data itself.

The .code section contains the following main functions that implement the basic functionality of the access control and delimitation system:

• RunApp() - designed to load and initialize all components of the container and access control system;

• UserID() - designed to get the user ID from information about the current user session when accessing the obfuscated container;

• CheckRights() - designed to check the user's access rights to the document in the obfuscated container in accordance with the access permissions matrix stored with the document;

• Extract() - designed to extract a document from an obfuscated container.

After processing the required data sets by the virtual machine, under the control of the received user data, the results of processing the required data sets are loaded onto the server, and the virtual machine is completely destroyed, eliminating the possibility of further leakage of any data.

The results of processing the required data sets are transferred to the storage system and become available to the user.

A closed VPN network can be built on the basis of VipNet technology.

The user data includes at least an artificial intelligence model and datasets for training the model. Access to user data is limited only to the user who uploaded it.

The cloud environment may include computing devices, where each of the devices has a processor to control the operation of the computing device and its associated components, including random access memory (RAM), read only memory (ROM), communication module. The computing device may include a variety of computer-readable media. Computer-readable media can be any available media that can be accessed by a computing device, can be persistent, and can include volatile and non-volatile, removable and non-removable media.

The computing device may operate in a network environment that supports connections to one or more remote computing devices. Computing devices may be personal computing devices or servers that include many or all of the elements described above in relation to a computing device.

The steps of the method described above provide the possibility of secure processing of user data, taking into account load balancing between the nodes of the cloud environment.

Claims (16)

1. The method of processing user data, including: transfer of user data via a closed VPN network from a thin client, made in the form of a web application, to the server part, and the interaction of the server part with the client is carried out via the REST API, the data is transmitted through the application server, and the user data is analyzed for the presence of malicious data; placement of the transferred user data in a private virtual storage area network (SAN); analysis of data on the load of computing resources of the cloud infrastructure to obtain a load indicator; create a virtual machine based on the utilization rate; loading a prepared docker container with user data into a virtual machine; identifying the user and checking access rights when accessing the container, including obtaining a user identifier from information about the current session of the user when accessing the container and checking the user's access rights to the container; processing the required data sets by a virtual machine under the control of the received user data; uploading the results of processing the required data sets to the server; deactivation of the virtual machine to process the received user data; transferring the results of processing the required data sets to the storage system; providing user access to the results of processing the required data sets. 2. The method according to claim 1, in which the closed VPN network is built on VipNet technology. 3. The method of claim 1, wherein the user data at least includes an artificial intelligence model and training datasets for the model. 4. The method according to claim 1, in which access to user data is defined only for the user who downloaded them. 5. The method according to claim. 1, in which the check of the user's access rights to the container is carried out in accordance with the matrix of access rights.