WO2018095240A1 - 一种在集群中建立安全通道的方法和装置 - Google Patents

一种在集群中建立安全通道的方法和装置 Download PDF

Info

Publication number
WO2018095240A1
WO2018095240A1 PCT/CN2017/110785 CN2017110785W WO2018095240A1 WO 2018095240 A1 WO2018095240 A1 WO 2018095240A1 CN 2017110785 W CN2017110785 W CN 2017110785W WO 2018095240 A1 WO2018095240 A1 WO 2018095240A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
secure channel
docker container
specified
user space
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/110785
Other languages
English (en)
French (fr)
Inventor
秦海博
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Publication of WO2018095240A1 publication Critical patent/WO2018095240A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • the present invention relates to a method for establishing a secure channel, and in particular to a method and device for establishing a secure channel in a cluster, and a method and device for deploying a docker container with a secure channel configuration, and a boot tape Method and apparatus for a docker container with a secure channel configuration.
  • the cluster usually contains different user spaces, including containers (such as docker containers), virtual machines and physical machines, and communication between different user spaces or the same user space. In order to ensure information security, it needs to be different.
  • a secure channel is established between the user spaces or the same user space for information exchange.
  • the secure channel usually adopts asymmetric encryption to ensure information security.
  • the secure channel of the asymmetric encryption includes the source end and the destination end.
  • the source end is the user space where the source end user is located, and the destination end is the user space that the source end user wants to access remotely.
  • the source side stores the public key and the private key, and the destination side stores the public key.
  • the source user can access the destination end as the destination user (the authority is assigned by the system administrator of the destination).
  • the channel is unidirectional and can only be accessed by the source end. Otherwise, it is not established.
  • a source and destination of a secure channel For a source and destination of a secure channel, generate a pair of key pairs containing a public key and a private key, and store the key pair in the corresponding file through the existing secure channel, through the existing The secure channel stores the public key in the corresponding file on the destination.
  • multiple key pairs may exist in the cluster corresponding to different secure channels.
  • the file storing the key will be deleted after the docker container is deleted.
  • the present application provides a method of establishing a secure channel in a cluster.
  • the present application also provides an apparatus for establishing a secure channel in a cluster; and a method of deploying a docker container with a secure channel configuration requirement, and a device for deploying a docker container with a secure channel configuration requirement;
  • a method of launching a docker container with a secure channel configuration is provided, along with a means for launching a docker container with a secure channel configuration.
  • the method for establishing a secure channel in a cluster includes the following steps:
  • a secure channel is established between the respective designated user spaces using the key.
  • the user space includes a docker container
  • the key required for each specified user space is transmitted to each specified user space in a form corresponding to the corresponding user space, including:
  • the storing the key corresponding to the corresponding form of the required key to the specified user space includes:
  • the decoded key is stored in a corresponding designated docker container.
  • the attributes of the secure channel include: a source end of the secure channel;
  • the encoded text of the key includes the encoded text of the public key and the encoded text of the private key.
  • the attributes of the secure channel include: a destination end of the secure channel;
  • the encoded text of the key includes the encoded text of the public key.
  • the user space includes a virtual machine or a physical machine
  • the key required for each specified user space is transmitted to each specified user space in a form corresponding to the corresponding user space, including:
  • the storing the key corresponding to the corresponding form of the required key to the specified user space includes:
  • a key corresponding to the attributes of the security channel of each specified virtual machine or physical machine is stored to the corresponding virtual machine or physical machine.
  • the secure channel includes an SSH secure channel.
  • the key pair is a key pair.
  • the method provided by the present application for deploying a docker container with a secure channel configuration requirement includes the following steps:
  • the property of the secure channel of the docker container includes a source of the secure channel
  • the encoded text of the key includes the encoded text of the public key and the encoded text of the private key.
  • the property of the secure channel of the docker container includes a destination of the secure channel
  • the encoded text of the key includes the encoded text of the public key.
  • the secure channel includes an SSH secure channel.
  • the method provided by the present application for starting a docker container with a secure channel configuration includes the following steps:
  • the key is stored to the docker container.
  • the device provided in the application for establishing a secure channel in a cluster includes:
  • An obtaining unit configured to obtain a request for establishing a secure channel between each specified user space in the specified cluster
  • a key generation unit configured to generate a key pair of the secure channel corresponding to the request, where the key pair includes a public key Key and private key;
  • a transmitting unit configured to transmit a key required for each specified user space to each specified user space in a form corresponding to the corresponding user space;
  • a storage unit configured to store a key corresponding to the corresponding form of the required key to each specified user space
  • a establishing unit configured to establish a secure channel between the specified user spaces by using the key.
  • the user space includes a docker container
  • the sending unit includes:
  • a coding subunit for encoding a key corresponding to an attribute of a secure channel of each specified docker container to obtain a coded text of a key corresponding to an attribute of a secure channel of each docker container;
  • the coded text of the key corresponding to the attribute of the secure channel of each docker container is placed in an environment variable of the corresponding docker container;
  • a deployment subunit configured to deploy each specified docker container with the environment variable to each host specified in the cluster
  • the storage unit includes:
  • a decoding subunit configured to decode the encoded text of the key included in the environment variable of each specified docker container to obtain a key after the specified docker container is started;
  • a storage subunit configured to store the decoded key into a corresponding designated docker container.
  • the key generating unit is specifically configured to generate a key pair of the secure channel corresponding to the request, where the key pair includes a public key and a private key.
  • the present application provides a device for deploying a docker container with a secure channel configuration requirement, including:
  • a coding unit configured to encode a key corresponding to an attribute of a secure channel of the docker container, to obtain a coded text of a key corresponding to an attribute of a secure channel of each docker container;
  • a configuration unit configured to put encoded text of a key corresponding to an attribute of the secure channel of the docker container into an environment variable of the docker container
  • a deployment unit for deploying a docker container with the environment variable to a pre-designated host is a deployment unit for deploying a docker container with the environment variable to a pre-designated host.
  • the invention provides a device for starting a docker container with a safe channel configuration, comprising:
  • a startup unit configured to start the docker container
  • a decoding unit configured to decode encoded text of a key included in an environment variable of the docker container, to obtain a key
  • a storage unit for storing the key to the docker container.
  • the method provided by the present application for establishing a secure channel in a cluster has the following advantages:
  • unifying the birth key pair can reduce the complexity of establishing a secure channel and improve the efficiency of establishing a secure channel.
  • Function; transmitting the key in the form corresponding to the user space can simplify the workload of establishing a secure channel in the cluster, and achieve the effect of improving the efficiency of establishing a secure channel.
  • the method provided by the present application for deploying a docker container with a secure channel configuration requirement has the following advantages:
  • the method provided by the present application for starting a docker container with a safe channel configuration has the following advantages:
  • Decoding and restoring the key of the secure channel after booting can be stored, which can simplify the process of establishing a secure channel and improve the efficiency of establishing a secure channel.
  • FIG. 1 is a schematic flowchart of a method for establishing a secure channel in a cluster according to a first embodiment of the present application
  • FIG. 2 is a schematic diagram of a method for establishing a secure channel for a docker container in a cluster according to a method for establishing a secure channel in a cluster according to a first embodiment of the present application;
  • FIG. 3 is a schematic flowchart of a method for deploying a docker container with a security channel configuration requirement according to a second embodiment of the present application
  • FIG. 4 is a schematic flow chart of a method for starting a docker container with a secure channel configuration according to a third embodiment of the present application
  • FIG. 5 is a structural block diagram of an apparatus for establishing a secure channel in a cluster according to a fourth embodiment of the present application.
  • FIG. 6 is a structural block diagram of an apparatus for deploying a docker container with a security channel configuration requirement according to a fifth embodiment of the present application.
  • FIG. 7 is a structural block diagram of an apparatus for starting a docker container with a secure channel configuration according to a sixth embodiment of the present application.
  • the first embodiment of the present application provides a method for establishing a secure channel in a cluster, and a schematic flowchart thereof is shown in FIG. 1.
  • the embodiment includes the following steps:
  • Step S101 Acquire a request for establishing a secure channel for each specified user space in the specified cluster.
  • the user space may be a physical computer (referred to as a physical machine), a virtual computer (referred to as a virtual machine), or a container, such as a docker container (referred to as docker).
  • a physical machine referred to as a physical machine
  • a virtual computer referred to as a virtual machine
  • a container such as a docker container (referred to as docker).
  • SSH Secure Shell
  • An SSH channel consists of four elements: the source end, the destination end, the source end user, and the destination end user.
  • the source end user is the initiator of the established channel
  • the source end is the computer used by the source end user
  • the destination end is the source end user wants to remotely.
  • the source user can operate the destination by the identity of the destination user (the authority is assigned by the system administrator of the destination).
  • the channel is unidirectional, and the destination can only be operated by the source. Otherwise, invalid.
  • Step S102 Generate a key pair of the secure channel corresponding to the request, where the key pair includes a public key and a private key.
  • Asymmetric encryption requires a pair of a private key (referred to as a private key) and a public key (referred to as a public key). Key pair.
  • a private key referred to as a private key
  • a public key referred to as a public key
  • Key pair the public key and the private key using the RSA algorithm are taken as an example for description.
  • the RSA algorithm is used to generate a pair of keys for the secure channel to be established.
  • the key pair includes a public key and a private key.
  • Step S103 the keys required for each specified user space are transmitted to the designated user spaces in a form corresponding to the corresponding user space.
  • Each user space has different attributes as the security channel, and the required keys are different.
  • the required key is a complete key pair, that is, the public key and the private key are required. .
  • the user space of the destination of the secure channel only the public key in the key pair is needed.
  • the key associated with the attribute of the secure channel is transmitted to the corresponding user space, which ensures the security of the network.
  • the key corresponding to the attribute of the secure channel of each docker container is encoded by the text encoding tool to obtain the encoded text of the key.
  • the private key of the RSA algorithm generated in the previous step can be encoded by the following command:
  • the pkeyfile is a file in which the private key is stored, and the output of the command is the encoded text of the private key. For example, if the content of the pkeyfile is “abcdefg”, that is, the private key is “abcdefg”, the above command is executed.
  • the generated public key and private key are both text-encoded to generate the encoded text of the public key and the encoded text of the private key; for the docker container only as the destination, only the public key can be used. Text encoding is performed to generate encoded text of the public key.
  • the key corresponding to the attribute of the secure channel of each docker container is placed in the environment variable of the corresponding docker container. That is, the encoded text of the public key needs to be placed in the environment variable of all the docker containers to be deployed that need to establish an SSH secure channel. The encoded text of the private key only needs to be placed in the environment variable of the docker container to be deployed as the source. .
  • the encoded text of the private key of the generated RSA algorithm can be passed to the environment variable SSH_PRIVATE_KEY of the docker container in the following manner.
  • docker-compose.yml file of the docker container configuration file Only the key parameters related to the key in the docker-compose.yml file of the docker container configuration file are given here.
  • the complete docker container configuration file docker-compose.yml file can be determined by referring to the relevant documentation of the docker compose tool. .
  • Adding the encoded text of the public key to the environment variable of the docker container is similar to adding the encoded text of the private key to the environment variable of the docker container, and will not be described here.
  • the designated docker containers with the environment variables are deployed to pre-designated hosts within the cluster.
  • the host includes a physical machine or even a virtual machine in the cluster that needs to deploy a docker container, and the docker container needs to establish a secure channel with other user spaces.
  • the docker container configured with the environment variables can be deployed to the host in the following manner:
  • the expost command sets the host information, "10.1.1.1” is the IP address of the host, "4243" is the port of the docker container daemon docker deamon on the host machine, and the docker-compose command is remotely described according to the docker-compose.yml file. Deploy the docker container. Docker-compose.yml contains the yellow static variable of the docker container, which contains the encoded text of the key.
  • the complete command can be determined according to the actual situation of the docker container deployment and the documentation related to the docker container. There are other ways to deploy the docker container.
  • the key can be directly stored in the file, and the file whose content is the key is sent to the corresponding user space, that is, the file whose content is the public key is sent to all the needs to be established.
  • the specified physical machine and virtual machine of the SSH secure channel send the file with the private key to all the specified physical machines and virtual machines that need to establish an SSH secure channel and serve as the source of the SSH secure channel.
  • Step S104 Store a key corresponding to the corresponding form of the key into each specified user space.
  • the startup is started.
  • the encoded text of the key contained in the environment variable of each specified docker container is decoded to obtain a key.
  • the corresponding environment variables generated in the previous step can be decoded in the following manner:
  • the output of the above command is the private key.
  • the value of the private key can be decoded by executing the above command: "abcdefg".
  • the method of decoding the encoded text of the public key to obtain the public key is similar to the method of decoding the encoded text of the private key to obtain the private key, which is not described herein.
  • the decoded key is stored in the appropriate form into the corresponding designated docker container. If the decoded private key is stored in the .ssh ⁇ id_rsa file in the user directory of the docker container as the source, the decoded public key is stored in the .ssh ⁇ id_rsa.pub in the user directory of the docker container as the source. In the file. For the docker container as the destination, store the decoded public key in the .ssh ⁇ id_rsa.pub file in the user directory of the docker container as the destination.
  • the key file is transferred to the specified physical machine or virtual machine, the file whose content is the corresponding key is saved to the corresponding location.
  • the file with the public key as the .ssh ⁇ id_rsa.pub file of the user who uses the secure channel, and save the file with the private key as the use file.
  • the .ssh ⁇ id_rsa file of the user of the secure channel For a physical or virtual machine that is the destination end of the SSH secure channel, save the file with the public key as the .ssh ⁇ zuthorized_keys file of the user using the SSH secure channel.
  • the saved key can also be managed by rights, and only the authorized user can access the key to enhance security.
  • Step S105 using the key to establish a secure channel between the specified user spaces.
  • a secure channel can be established to communicate according to the corresponding security protocol.
  • the RSA key required for the SSH secure channel to be established in the cluster has been generated.
  • the corresponding key is first encoded according to the SSH secure channel attribute of the docker container. . If the docker container needs to be the source of the SSH secure channel in the cluster, encode the public and private keys to obtain the encoded text of the public key and the encoded text of the private key; if the docker container needs to serve as the SSH secure channel in the cluster End, encode the public key to get the encoded text of the public key.
  • the coded text of the corresponding key obtained is added to the environment variable of the docker container by using the docker compose tool.
  • the docker container Deploy the docker container with the above environment variables to a pre-specified host within the cluster. After starting the docker container, the encoded text of the corresponding key in the environment variable is decoded to obtain the corresponding key. Store the corresponding key in the appropriate file in the corresponding docker container. For example, if the docker container is the source of the SSH secure channel, the public key is stored in the .ssh ⁇ id_rsa.pub file of the corresponding user of the docker container, and the private key is stored in the .ssh of the corresponding user of the docker container. ⁇ id_rsa file; if the docker container is the destination of the SSH secure channel, the public key will be stored in the .ssh ⁇ id_rsa.pub file of the corresponding user of the docker container.
  • the corresponding key After the corresponding key is stored in the corresponding file of the docker container, the corresponding key can be set to the key file, so that only the authorized user can access the key file, thereby increasing security.
  • the key required to establish the SSH secure channel is successfully deployed to the docker container, and the corresponding SSH secure channel can be established to communicate with the docker container.
  • the foregoing is an embodiment of a method for establishing a secure channel in a cluster according to the present application.
  • the method When a secure channel is established between user spaces in a cluster, the method generates a key uniformly, which can reduce the complexity of establishing a secure channel. Improve the efficiency of establishing a secure channel; transmitting keys in a form corresponding to user space can simplify the workload of establishing a secure channel within the cluster and achieve the effect of improving the efficiency of establishing a secure channel.
  • the second embodiment of the present application provides a method for deploying a docker container with a security channel configuration requirement.
  • the schematic flowchart of the application is as shown in FIG. 3, and includes the following steps:
  • Step S201 obtaining a request to deploy a docker container with a secure channel configuration requirement.
  • the user space When it is necessary to establish a secure channel between different user spaces in the cluster, the user space includes a docker container, that is, the docker container can serve as a source of the secure channel or as a destination.
  • This step gets a request to deploy the docker container to the specified host in the cluster, which needs to establish a secure channel with other user spaces in the cluster.
  • an SSH secure channel is taken as an example for description.
  • the key required for the SSH secure channel is an RSA key, which has been generated.
  • Step S202 encoding a key corresponding to the attribute of the secure channel of the docker container, and obtaining encoded text of the key corresponding to the attribute of the secure channel of each docker container.
  • both the public key and the private key are encoded to obtain the encoded text of the public key and the encoded text of the private key.
  • the public key is encoded to obtain the encoded text of the public key.
  • Step S203 the encoded text of the key corresponding to the attribute of the secure channel of the docker container is placed in the environment variable of the docker container.
  • step S103 For the specific operation of this step, reference may be made to the description in step S103 in the first embodiment of the present application, and details are not described herein.
  • Step S204 deploying the docker container with the environment variable to a pre-designated host.
  • step S103 For the specific operation of this step, reference may be made to the description in step S103 in the first embodiment of the present application, and details are not described herein.
  • the third embodiment of the present application provides a method for starting a docker container with a secure channel configuration.
  • the schematic diagram of the process is as shown in FIG. 4, and includes the following steps:
  • Step S301 starting the docker container.
  • the docker container is launched after the Docker container with the secure channel configuration is deployed to the host.
  • the secure channel configuration includes a required key that is present in the environment variable of the docker container in the form of encoded text.
  • the secure channel is an SSH secure channel.
  • the key is an RSA algorithm key.
  • Step S302 decoding the encoded text of the key included in the environment variable of the docker container to obtain a key.
  • the encoded text of the key carried in the yellow static variable of the docker container is decoded to obtain a corresponding key.
  • step S104 For a specific operation of this step, reference may be made to the corresponding description in step S104 of the first embodiment of the present application, and details are not described herein again.
  • Step S303 storing the key to the docker container.
  • the decoded key is stored in the corresponding file in the docker container.
  • the decoded key is stored in the corresponding file in the docker container.
  • the fourth embodiment of the present application provides an apparatus for establishing a secure channel in a cluster.
  • the structural block diagram is as shown in FIG. 5, and includes: an obtaining unit U401, a key generating unit U402, a transmitting unit U403, a storage unit U404, and an establishing unit U405. .
  • the obtaining unit U401 is configured to acquire a request for establishing a secure channel between each specified user space in the specified cluster.
  • the user space includes a docker container.
  • the key generation unit U402 is configured to generate a key pair of the secure channel corresponding to the request, where the key pair includes a public key and a private key.
  • the key generation unit may be specifically configured to generate a key pair of the secure channel corresponding to the request, where the key pair includes a public key and a private key.
  • the transmitting unit U403 is configured to transmit a key required for each specified user space to each specified user space in a form corresponding to the corresponding user space.
  • the transfer unit may include: a coding subunit, a placement subunit, and a deployment subunit.
  • the encoding subunit is configured to encode a key corresponding to an attribute of a security channel of each specified docker container, to obtain a coded text of a key corresponding to an attribute of a secure channel of each docker container;
  • the placing subunit is configured to put the encoded text of the key corresponding to the attribute of the secure channel of each docker container into an environment variable of the corresponding docker container;
  • the deployment subunit is configured to deploy the specified docker containers with the environment variables to each host pre-designated in the cluster;
  • the storage unit U404 is configured to store a key corresponding to the corresponding form of the required key to each specified user space.
  • the storage unit may include a decoding subunit and a storage subunit.
  • the decoding subunit after the specified docker container is started, decodes the encoded text of the key included in the environment variable of each specified docker container to obtain a key;
  • the storage subunit is configured to store the decoded key into a corresponding designated docker container.
  • the establishing unit U405 is configured to establish a secure channel between the specified user spaces by using the key.
  • the fifth embodiment of the present invention provides an apparatus for deploying a docker container with a security channel configuration requirement.
  • the structural block diagram is as shown in FIG. 6, and includes an obtaining unit U501, an encoding unit U502, a configuration unit U503, and a deployment unit U504.
  • the obtaining unit U501 is configured to acquire a request for deploying a docker container with a secure channel configuration requirement.
  • the encoding unit U502 is configured to encode a key corresponding to the attribute of the secure channel of the docker container, and obtain encoded text of a key corresponding to the attribute of the secure channel of each docker container.
  • the configuration unit U503 is configured to put the encoded text of the key corresponding to the attribute of the secure channel of the docker container into the environment variable of the docker container.
  • the deployment unit U504 is configured to deploy a docker container with the environment variable to a pre-designated host.
  • the sixth embodiment of the present application provides an apparatus for starting a docker container with a secure channel configuration.
  • the structural block diagram is as shown in FIG. 7, and includes: a starting unit U601, a decoding unit U602, and a storage unit U603.
  • the startup unit U601 is configured to start the docker container
  • the decoding unit U602 is configured to decode the encoded text of the key included in the environment variable of the docker container to obtain a key;
  • the storage unit U603 is configured to store the key to the docker container.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media including both permanent and non-persistent, removable and non-removable media may be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include non-transitory computer readable media, such as modulated data signals and carrier waves.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种在集群中建立安全通道的方法，特征在于，包括以下步骤：获取为指定集群内各指定的用户空间之间建立安全通道的请求；生成所述请求所对应的安全通道的密钥对，所述密钥对包括公钥和私钥；将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间；将所述密钥的相应形式所对应的密钥存储到所述各指定的用户空间；利用所述密钥在所述各个指定的用户空间之间建立安全通道。本申请提供的方法能够起到降低安全通道建立的复杂度，提高建立安全通道的效率的作用；以与用户空间相应的形式传送密钥，能够起到简化集群内建立安全通道的工作量作用，达到提高建立安全通道的效率的效果。

Description

一种在集群中建立安全通道的方法和装置
本申请要求2016年11月24日递交的申请号为201611052641.7、发明名称为“一种在集群中建立安全通道的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及一种建立安全通道的方法，具体涉及一种在集群中建立安全通道的方法和装置，还涉及一种部署带有安全通道配置的docker容器的方法和装置，还涉及一种启动带有安全通道配置的docker容器的方法和装置。
背景技术
集群中通常会包含有不同的用户空间，包括容器(如docker容器)，虚拟机和物理机，不同的用户空间之间或相同的用户空间之间需要通信交换信息，为了保证信息安全，需要在不同的用户空间之间或相同的用户空间之间建立安全通道进行信息交换，所述安全通道，通常采用非对称加密的方式来保证信息的安全性。
非对称加密的安全通道包含源端和目的端，源端是源端用户所处的用户空间，目的端为源端用户想要远程访问的用户空间。源端保存有公钥和私钥，目的端保存有公钥。
安全通道建立之后，源端用户可以以目的端用户的身份(权限由目的端的系统管理员来分配)来访问目的端，通道为单向，只能由源端访问目的端，反之则不成立。
现有的在集群内为不同的用户空间之间或相同的用户空间之间建立安全通道通常采用以下方式：
对于一条安全通道的源端和目的端，生成包含公钥和私钥的一对密钥对，通过现有的安全通道将所述密钥对存储到源端相应的文件中，通过现有的安全通道将公钥存储到目的端相应的文件中。这样集群中可能会存在多个密钥对分别对应不同的安全通道。特别地，对于用户空间为docker容器的用户空间，由于docker容器删除后，存储密钥的文件会被删除。重新部署同一个docker容器时还是需要通过安全通道登录到docker容器的宿主机重新传输存储相应的密钥。
可见现有在集群内建立安全通道的方式具有密钥管理和安全通道建立流程复杂，建立安全通道的工作量大，效率低下的问题。
发明内容
本申请提供一种在集群中建立安全通道的方法。本申请同时提供一种在集群中建立安全通道的装置；还提供一种部署带有安全通道配置需求的docker容器的方法，同时提供一种部署带有安全通道配置需求的docker容器的装置；还提供一种启动带有安全通道配置的docker容器的方法，同时提供一种启动带有安全通道配置的docker容器的装置。
本申请提供的一种在集群中建立安全通道的方法，包括以下步骤：
获取为指定集群内各指定的用户空间之间建立安全通道的请求；
生成所述请求所对应的安全通道的密钥对，所述密钥对包括公钥和私钥；
将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间；
将所述密钥的相应形式所对应的密钥存储到所述各指定的用户空间；
利用所述密钥在所述各个指定的用户空间之间建立安全通道。
可选地，所述用户空间包括docker容器；
相应地，所述将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间包括：
对各指定的docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本；
将所述与各个docker容器的安全通道的属性相对应的密钥的编码文本放入相应docker容器的环境变量中；
将所述带有所述环境变量的各指定的docker容器部署到所述集群内预先指定的各宿主机；
所述将所需的密钥的相应形式所对应的密钥存储到所述各指定的用户空间包括：
所述各指定的docker容器启动后，对所述各指定的docker容器的环境变量中包含的密钥的编码文本进行解码得到密钥；
将所述解码得到的密钥存储到相应的指定的docker容器中。
可选地，所述安全通道的属性包括：安全通道的源端；
相应地，所述密钥的编码文本包括公钥的编码文本和私钥的编码文本。
可选地，所述安全通道的属性包括：安全通道的目的端；
相应地，所述密钥的编码文本包括公钥的编码文本。
可选地，所述用户空间包括虚拟机或物理机；
相应地，所述将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间包括：
将与各指定的虚拟机或物理机的安全通道的属性相对应的密钥传送到相应的虚拟机或物理机；
所述将所述所需的密钥的相应形式所对应的密钥存储到所述各指定的用户空间包括：
将与各指定的虚拟机或物理机的安全通道的属性相对应的密钥存储到相应的虚拟机或物理机。
可选地，所述安全通道包括SSH安全通道。
可选地，所述密钥对为一个密钥对。
本申请提供的一种部署带有安全通道配置需求的docker容器的方法，包括以下步骤：
获取部署带有安全通道配置需求的docker容器的请求；
对所述docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本；
将与所述docker容器的安全通道的属性相对应的密钥的编码文本放入该docker容器的环境变量中；
将带有所述环境变量的docker容器部署到预先指定的宿主机。
可选地，所述docker容器的安全通道的属性包括安全通道的源端，
相应地，所述密钥的编码文本包括公钥的编码文本和私钥的编码文本。
可选地，所述docker容器的安全通道的属性包括安全通道的目的端，
相应地，所述密钥的编码文本包括公钥的编码文本。
可选地，所述安全通道包括SSH安全通道。
本申请提供的一种启动带有安全通道配置的docker容器的方法，包括以下步骤：
启动所述docker容器；
解码所述docker容器的环境变量中所包含的密钥的编码文本，得到密钥；
将所述密钥存储到所述docker容器。
本申请提供的一种在集群中建立安全通道的装置，包括：
获取单元，用于获取在指定集群内各指定的用户空间之间建立安全通道的请求；
密钥生成单元，用于生成所述请求所对应的安全通道的密钥对，所述密钥对包括公 钥和私钥；
传送单元，用于将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间；
存储单元，用于将所述所需的密钥的相应形式所对应的密钥存储到所述各指定的用户空间；
建立单元，用于利用所述密钥在所述各个指定的用户空间之间建立安全通道。
可选地，所述用户空间包括docker容器，相应地，所述传送单元，包括：
编码子单元，用于对各指定的docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本；
放入子单元，用于将所述与各个docker容器的安全通道的属性相对应的密钥的编码文本放入相应docker容器的环境变量中；
部署子单元，用于将所述带有所述环境变量的各指定的docker容器部署到所述集群内预先指定的各宿主机；
所述存储单元包括：
解码子单元，用于所述各指定的docker容器启动后，对所述各指定的docker容器的环境变量中包含的密钥的编码文本进行解码得到密钥；
存储子单元，用于将所述解码得到的密钥存储到相应的指定的docker容器中。
可选地，所述密钥生成单元，具体用于生成所述请求所对应的安全通道的一个密钥对，所述密钥对包括公钥和私钥。
本申请提供的一种部署带有安全通道配置需求的docker容器的装置，包括：
获取单元，用于获取部署带有安全通道配置需求的docker容器的请求；
编码单元，用于对所述docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本；
配置单元，用于将与所述docker容器的安全通道的属性相对应的密钥的编码文本放入该docker容器的环境变量中；
部署单元，用于将带有所述环境变量的docker容器部署到预先指定的宿主机。
本申请提供的一种启动带有安全通道配置的docker容器的装置，包括：
启动单元，用于启动所述docker容器；
解码单元，用于解码所述docker容器的环境变量中所包含的密钥的编码文本，得到密钥；
存储单元，用于将所述密钥存储到所述docker容器。
与现有技术相比，本申请提供的一种在集群中建立安全通道的方法具有以下优点：
在集群中不同的用户空间之间和同样的用户空间之间建立使用密钥对的安全通道时，统一生生密钥对，能够起到降低安全通道建立的复杂度，提高建立安全通道的效率的作用；以与用户空间相应的形式传送密钥，能够起到简化集群内建立安全通道的工作量作用，达到提高建立安全通道的效率的效果。
与现有技术相比，本申请提供的一种部署带有安全通道配置需求的docker容器的方法具有以下优点：
部署docker容器时，利用环境变量传送安全通道的密钥，能够起到简化安全通道建立的流程的作用，达到提高建立安全通道的效率的效果。
与现有技术相比，本申请提供的一种启动带有安全通道配置的docker容器的方法具有以下优点：
启动后解码还原安全通道的密钥并存储，能够起到简化安全通道建立的流程的作用，达到提高建立安全通道的效率的效果。
附图说明
图1为本申请第一实施例一种在集群中建立安全通道的方法的流程示意图；
图2为本申请第一实施例一种在集群中建立安全通道的方法的为集群中docker容器建立安全通道的方法的示意图；
图3为本申请第二实施例一种部署带有安全通道配置需求的docker容器的方法的流程示意图；
图4为本申请第三实施例一种启动带有安全通道配置的docker容器的方法的流程示意图；
图5为本申请第四实施例在集群中建立安全通道的装置的结构框图；
图6为本申请第五实施例一种部署带有安全通道配置需求的docker容器的装置的结构框图；
图7为本申请第六实施例一种启动带有安全通道配置的docker容器的装置的结构框图。
具体实施方式
在下面的描述中阐述了很多具体细节以便于充分理解本申请。但是本申请能够以很多不同于在此描述的其它方式来实施，本领域技术人员可以在不违背本申请内涵的情况下做类似推广，因此本申请不受下面公开的具体实施的限制。
本申请第一实施例提供一种在集群中建立安全通道的方法，其流程示意图如图1所示，该实施例包括以下步骤：
步骤S101，获取为指定集群内各指定的用户空间建立安全通道的请求。
当需要在计算机集群内不同的用户空间之间建立安全的通信通道时，获取这一请求。所述用户空间既可以是物理计算机(简称物理机)，也可以是虚拟计算机(简称虚拟机)，还可以是容器，如docker容器(简称docker)。
本实施例以在集群中建立SSH安全通道为例进行说明。SSH(Secure Shell)为建立在应用层和传输层基础上的安全协议，使用非对称的RSA加密算法来实现计算机之间的安全通信。一条SSH通道包含源端、目的端、源端用户、目的端用户四个要素，源端用户是建立通道的发起方，源端是源端用户所用的计算机，目的端为源端用户想要远程操控的目标设备，通道建立之后，源端用户可以目的端用户的身份(权限由目的端的系统管理员来分配)来操作目的端，通道为单向，只能由源端操作目的端，反之则不成立。
步骤S102，生成所述请求所对应的安全通道的密钥对，所述密钥对包括公钥和私钥。
为了实现通信的安全性，通常需要采用不对称加密的技术对用于通信的通道进行加密，不对称加密需要一对由私有密钥(简称私钥)和公有密钥(简称公钥)组成的密钥对。本实施例中，以采用RSA算法的公钥和私钥为例进行相应的说明。
对于集群中多个用户空间之间建立安全通道的情况，除了每个通道采用不同的密钥对意外，还可以采用相同的密钥对，即仅采用一个密钥对，这样能够简化对安全通道的管理，方便部署，提高部署的效率，降低维护工作量。
当获取到建立安全通道的请求后，采用RSA算法，为所述待建立的安全通道生成一对密钥。所述密钥对包括一个公钥和一个私钥。
例如，对于Unix操作系统，可以利用以下命令生成长度为1024位的RSA算法私钥并将生成的私钥保存到“privatekeyfile”文件内：
openssl genrsa-3-out privatekeyfile 1024
生成私钥后，可以根据所生成的私钥，利用以下命令生成对应的公钥,并将所生成的公钥保存到publickeyfile文件：
ssh-keygen-f privatekeyfile–y>publickeyfile
步骤S103，将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间。
各个用户空间作为安全通道的属性不同，其所需要的密钥也不相同，作为安全通道的源端的用户空间，其所需要的密钥为完整的密钥对，即公钥和私钥都需要。作为安全通道的目的端的用户空间，仅需要密钥对中的公钥即可。
进将于安全通道的属性相关的密钥传送给相应的用户空间，能够确保网络的安全性。
对于用户空间为docker容器的情况，采用以下步骤将其所需要的密钥传送到各个指定的docker容器：
根据各个docker容器的安全通道的属性，利用文本编码工具，将与各个docker容器的安全通道的属性相对应的密钥进行编码，得到所述密钥的编码文本。
例如，对于操作系统为Unix的情况，可以采用下述命令对前面步骤中生成的RSA算法的私钥进行编码：
base64-i pkeyfile
其中，pkeyfile为保存有所述私钥的文件，上述命令的输出即为所述私钥的编码文本，例如对于pkeyfile的内容为“abcdefg”的情况，即私钥为“abcdefg”，执行上述命令可以得到所述私钥的编码文本“YWJjZGVmZw＝＝”。
对公钥进行编码的方式与对私钥进行编码的方式类似，在此不做赘述。
对于作为SSH安全通道源端的docker容器，对所生成的公钥和私钥都进行文本编码，生成公钥的编码文本和私钥的编码文本；对于仅作为目的端的docker容器，可以仅对公钥进行文本编码生成公钥的编码文本。
对于所述各个用户空间公用一对密钥来建立安全通道的情况，仅需对密钥对的公钥或私钥进行一次编码，对于后续其他docker容器，只需要直接利用此前已经编码的密钥的编码文本即可。
将所述与各个docker容器的安全通道的属性相对应的密钥放入相应docker容器的环境变量中。即公钥的编码文本需要被放入到所有待部署的需要建立SSH安全通道的docker容器的环境变量中，私钥的编码文本仅需要放入到待部署的作为源端的docker容器的环境变量中。
对于在Unix操作系统上生成docker容器的情况，可以采用下述方式将生成的RSA算法的私钥的编码文本传给docker容器的环境变量SSH_PRIVATE_KEY
利用docker compose工具，生成docker容器配置文件docker-compose.yml文件,在需 要建立SSH安全通道的docker容器所对应的环境变量environment中，将变量SSH_PRIVATE_KEY所对应的值设置为前述生成的RSA算法的私钥的编码文本：
environment:
SSH_PRIVATE_KEY:'YWJjZGVmZw＝＝'
此处仅给出了docker容器配置文件docker-compose.yml文件中与密钥相关的主要参数的设置情况，完整的docker容器配置文件docker-compose.yml文件请参考docker compose工具的相关文档进行确定。
将公钥的编码文本加入到docker容器的环境变量中的方式与将私钥的编码文本加入到docker容器的环境变量中类似，在此不做赘述。
将所述带有所述环境变量的各指定的docker容器部署到所述集群内预先指定的各宿主机。所述宿主机包括集群中需要部署docker容器的物理机甚至虚拟机，并且所述docker容器需要与其他用户空间建立安全通道。
对于Unix操作系统，宿主机上已经安装运行了docker容器的后台守护进程docker deamon的情况下，可以利用下述方式将配置了环境变量的docker容器部署到宿主机上：
export DOCKER_HOST＝tcp://10.1.1.1:4243
docker-compose up-d
其中expost命令设置宿主机信息，“10.1.1.1”为宿主机的IP地址，“4243”为宿主机上docker容器守护进程docker deamon的端口，docker-compose命令按照docker-compose.yml文件的描述远程部署docker容器。docker-compose.yml包含有所述docker容器的黄静变量，所述环境变量中哦哦那个包含有密钥的编码文本。
此处仅给出部署docker容器主要的相关参数，完整的命令可以根据docker容器部署的实际情况和docker容器相关的说明文档确定。此外也可以采用其他方式部署docker容器。
对于用户空间为物理机或虚拟机的情况，可以直接将密钥存入文件中，再将内容为密钥的文件发送到相应的各个用户空间，即将内容为公钥的文件发送到所有需要建立SSH安全通道的指定的物理机和虚拟机，将内容为私钥的文件发送到所有需要建立SSH安全通道，并作为SSH安全通道的源端的指定的物理机和虚拟机。
步骤S104，将所述密钥的相应形式所对应的密钥存储到所述各指定的用户空间。
用户空间不同相应的处理也不尽相同。
对于用户空间为docker容器的情况，各个宿主机上部署了所述docker容器后，启动 所述docker容器时，对所述各指定的docker容器的环境变量中包含的密钥的编码文本进行解码得到密钥。
例如，对于部署在Unix操作系统上的的docker容器，可以采用下述方式得对前面步骤中生成的相应的环境变量进行解码：
首先利用下述命令将包含有密钥的编码文本的环境变量SSH_PRIVATE_KEY输出到文件private_key_file：
SSH_PRIVATE_KEY>private_key_file
再利用下述命令对所述private_key_file所包含的私钥的编码文本进行解码：
base64-D private_key_file
执行上述命令的输出即为私钥，如private_key_file文件的内容为“YWJjZGVmZw＝＝”，执行上述命令即可解码得到私钥的值：“abcdefg”。
对公钥的编码文本进行解码得到公钥的方式与对私钥的编码文本进行解码得到私钥的方式类似，在此不做赘述。
将所述解码得到的密钥以适当的形式存储到相应的指定的docker容器中。如将解码得到的私钥存入作为源端的docker容器的用户目录下的.ssh\id_rsa文件中，将解码得到的公钥存入作为源端的docker容器的用户目录下的.ssh\id_rsa.pub文件中。对于作为目的端的docker容器，将解码得到的公钥存入作为目的端的docker容器的用户目录下的.ssh\id_rsa.pub文件中
对于用户空间为物理机或虚拟机的情况，密钥文件被传送到指定的物理机或虚拟机后，将所述内容为相应密钥的文件保存到相应的位置。
例如对于作为SSH安全通道源端的物理机或虚拟机，将内容为公钥的文件保存为使用所述安全通道的用户的.ssh\id_rsa.pub文件，将内容为私钥的文件保存为使用所述安全通道的用户的.ssh\id_rsa文件。对于作为SSH安全通道目的端的物理机或虚拟机，将内容为公钥的文件保存为使用所述SSH安全通道的用户的.ssh\zuthorized_keys文件。
将与用户空间的通道属性相对应的密钥保存到用户空间后，还可以对所保存的密钥进行权限管理，仅允许被授权的用户能够访问所述密钥，以加强安全性。
步骤S105，利用所述密钥在所述各个指定的用户空间之间建立安全通道。
建立SSH安全通道所需的密钥被存储到相应的用户空间后，可以根据相应的安全协议，建立安全通道进行通信。
下面再以为集群中的某一docker容器建立SSH安全通道为例进行简要说明，如图2 所示：
集群内需要建立的SSH安全通道所需的RSA密钥已经生成，当需要为集群中某一docker容器建立SSH安全通道时，首先根据该docker容器的SSH安全通道属性，对相应的密钥进行编码。如果该docker容器需要作为集群内SSH安全通道的源端，对公钥和私钥进行编码，得到公钥的编码文本和私钥的编码文本；如果该docker容器需要作为集群内SSH安全通道的目的端，对公钥进行编码，得到公钥的编码文本。
在利用docker compose工具将所得到的相应的密钥的编码文本加入到docker容器的环境变量中。
将带有上述环境变量的docker容器部署到集群内预先指定的宿主机。启动该docker容器后，对环境变量中的相应的密钥的编码文本进行解码得到相应的密钥。将相应的密钥存储到相应的docker容器的相应文件中。例如若所述docker容器为SSH安全通道的源端，则将公钥存储到该docker容器的相应用户的.ssh\id_rsa.pub文件中，将私钥存储到该docker容器的相应用户的.ssh\id_rsa文件；若所述docker容器为SSH安全通道的目的端，则将将公钥存储到该docker容器的相应用户的.ssh\id_rsa.pub文件中。
将相应的密钥存储到该docker容器的相应文件后，可以对所述密钥文件设置相应的权限，使得仅获得授权的相应用户能够访问所述密钥文件，增加安全性。
至此成功将建立SSH安全通道所需的密钥部署到了该docker容器，可以和该docker容器建立相应的SSH安全通道进行通信。
以上为本申请的一种在集群中建立安全通道的方法的实施例，该方法在集群中各个用户空间之间建立安全通道时，统一生成密钥，能够起到降低安全通道建立的复杂度，提高建立安全通道的效率的作用；以与用户空间相应的形式传送密钥，能够起到简化集群内建立安全通道的工作量作用，达到提高建立安全通道的效率的效果。
本申请第二实施例提供一种部署带有安全通道配置需求的docker容器的方法，其流程示意图如图3所示，包括以下步骤：
步骤S201，获取部署带有安全通道配置需求的docker容器的请求.
当需要在集群中为不同的用户空间之间建立安全通道时，所述用户空间包括docker容器，即docker容器可以作为安全通道的源端也可以作为目的端。
本步骤获取部署docker容器到集群内指定的宿主机的请求，所述docker容器需要与集群内其他用户空间建立安全通道。本实施例中以SSH安全通道为例进行说明。所述SSH安全通道所需的密钥为RSA密钥，已经生成。
步骤S202，对所述docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本。
本步骤中，对于作为SSH安全通道源端的docker容器，将公钥和私钥都进行编码得到公钥的编码文本和私钥的编码文本。对于作为SSH安全通道目的端的docker容器，将公钥进行编码得到公钥的编码文本。具体的操作可以参考本申请第一实施例中步骤S103中的描述，在此不做赘述。
步骤S203，将与所述docker容器的安全通道的属性相对应的密钥的编码文本放入该docker容器的环境变量中。
本步骤的具体操作可以参考本申请第一实施例中步骤S103中的描述，在此不做赘述。
步骤S204，将带有所述环境变量的docker容器部署到预先指定的宿主机。
本步骤的具体操作可以参考本申请第一实施例中步骤S103中的描述，在此不做赘述。
本申请第三实施例提供一种启动带有安全通道配置的docker容器的方法，其流程示意图如图4所示，包括以下步骤：
步骤S301，启动所述docker容器。
所述带有安全通道配置的Docker容器被部署到宿主机后，启动所述docker容器。所述安全通道配置包括所需的密钥，所述密钥以编码文本的形式存在于该docker容器的环境变量中。所述安全通道为SSH安全通道。所述密钥为RSA算法密钥。
步骤S302，解码所述docker容器的环境变量中所包含的密钥的编码文本，得到密钥。
启动所述带有安全通道配置的docker容器后，将所述docker容器的黄静变量中所携带的密钥的编码文本解码得到相应的密钥。
本步骤的具体操作可以参考本申请第一实施例步骤S104中相应的描述，在此不再赘述。
步骤S303，将所述密钥存储到所述docker容器。
将解码得到的密钥存入docker容器的相应文件中。具体操作卡伊参考本申请第一实施例步骤S104中相关的描述，在此不再赘述。
本申请第四实施例提供一种在集群中建立安全通道的装置，其结构框图如图5所述，包括：获取单元U401，密钥生成单元U402，传送单元U403，存储单元U404和建立单元U405。
所述获取单元U401，用于获取在指定集群内各指定的用户空间之间建立安全通道的请求。
所述用户空间包括docker容器。
所述密钥生成单元U402，用于生成所述请求所对应的安全通道的密钥对，所述密钥对包括公钥和私钥。
所述密钥生成单元，可以具体用于生成所述请求所对应的安全通道的一个密钥对，所述密钥对包括公钥和私钥。
所述传送单元U403，用于将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间。
对于所述用户空间为docker容器的情况，所述传送单元可以包括：编码子单元，放入子单元和部署子单元。
所述编码子单元，用于对各指定的docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本；
所述放入子单元，用于将所述与各个docker容器的安全通道的属性相对应的密钥的编码文本放入相应docker容器的环境变量中；
所述部署子单元，用于将所述带有所述环境变量的各指定的docker容器部署到所述集群内预先指定的各宿主机；
所述存储单元U404，用于将所述所需的密钥的相应形式所对应的密钥存储到所述各指定的用户空间。
对于对于所述用户空间为docker容器的情况，所述存储单元可以包括：解码子单元和存储子单元。
所述解码子单元，用于所述各指定的docker容器启动后，对所述各指定的docker容器的环境变量中包含的密钥的编码文本进行解码得到密钥；
所述存储子单元，用于将所述解码得到的密钥存储到相应的指定的docker容器中。
所述建立单元U405，用于利用所述密钥在所述各个指定的用户空间之间建立安全通道。
本申请第五实施例提供一种部署带有安全通道配置需求的docker容器的装置，其结构框图如图6所述，包括：获取单元U501，编码单元U502，配置单元U503和部署单元U504。
所述获取单元U501，用于获取部署带有安全通道配置需求的docker容器的请求。
所述编码单元U502，用于对所述docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本。
所述配置单元U503，用于将与所述docker容器的安全通道的属性相对应的密钥的编码文本放入该docker容器的环境变量中。
所述部署单元U504，用于将带有所述环境变量的docker容器部署到预先指定的宿主机。
本申请第六实施例提供一种启动带有安全通道配置的docker容器的装置，其结构框图如图7所述，包括：启动单元U601，解码单元U602和存储单元U603。
所述启动单元U601，用于启动所述docker容器；
所述解码单元U602，用于解码所述docker容器的环境变量中所包含的密钥的编码文本，得到密钥；
所述存储单元U603，用于将所述密钥存储到所述docker容器。
本申请虽然以较佳实施例公开如上，但其并不是用来限定本申请，任何本领域技术人员在不脱离本申请的精神和范围内，都可以做出可能的变动和修改，因此本申请的保护范围应当以本申请权利要求所界定的范围为准。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
1、计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括非暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
2、本领域技术人员应明白，本申请的实施例可提供为方法、系统或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。

Claims (17)

  1. 一种在集群中建立安全通道的方法，特征在于，包括以下步骤：
    获取为指定集群内各指定的用户空间之间建立安全通道的请求；
    生成所述请求所对应的安全通道的密钥对，所述密钥对包括公钥和私钥；
    将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间；
    将所述密钥的相应形式所对应的密钥存储到所述各指定的用户空间；
    利用所述密钥在所述各指定的用户空间之间建立安全通道。
  2. 根据权利要求1所述的在集群中建立安全通道的方法，其特征在于，所述用户空间包括docker容器；
    相应地，所述将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间包括：
    对各指定的docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本；
    将所述与各个docker容器的安全通道的属性相对应的密钥的编码文本放入相应docker容器的环境变量中；
    将带有所述环境变量的各指定的docker容器部署到所述集群内预先指定的各宿主机；
    所述将所需的密钥的相应形式所对应的密钥存储到所述各指定的用户空间包括：
    所述各指定的docker容器启动后，对所述各指定的docker容器的环境变量中包含的密钥的编码文本进行解码得到密钥；
    将所述解码得到的密钥存储到相应的指定的docker容器中。
  3. 根据权利要求2所述的在集群中建立安全通道的方法，其特征在于，所述安全通道的属性包括：安全通道的源端；
    相应地，所述密钥的编码文本包括公钥的编码文本和私钥的编码文本。
  4. 根据权利要求2所述的在集群中建立安全通道的方法，其特征在于，所述安全通道的属性包括：安全通道的目的端；
    相应地，所述密钥的编码文本包括公钥的编码文本。
  5. 根据权利要求1所述的在集群中建立安全通道的方法，其特征在于，所述用户空间包括虚拟机或物理机；
    相应地，所述将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间包括：
    将与各指定的虚拟机或物理机的安全通道的属性相对应的密钥传送到相应的虚拟机或物理机；
    所述将所述所需的密钥的相应形式所对应的密钥存储到所述各指定的用户空间包括：
    将与各指定的虚拟机或物理机的安全通道的属性相对应的密钥存储到相应的虚拟机或物理机。
  6. 根据权利要求1所述的在集群中建立安全通道的方法，其特征在于，所述安全通道包括SSH安全通道。
  7. 根据权利要求1所述的在集群中建立安全通道的方法，其特征在于，所述密钥对为一个密钥对。
  8. 一种部署带有安全通道配置需求的docker容器的方法，特征在于，包括以下步骤：
    获取部署带有安全通道配置需求的docker容器的请求；
    对所述docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本；
    将与所述docker容器的安全通道的属性相对应的密钥的编码文本放入该docker容器的环境变量中；
    将带有所述环境变量的docker容器部署到预先指定的宿主机。
  9. 根据权利要求8所述的部署带有安全通道配置需求的docker容器的方法，其特征在于，所述docker容器的安全通道的属性包括安全通道的源端，
    相应地，所述密钥的编码文本包括公钥的编码文本和私钥的编码文本。
  10. 根据权利要求8所述的部署带有安全通道配置需求的docker容器的方法，其特征在于，所述docker容器的安全通道的属性包括安全通道的目的端，
    相应地，所述密钥的编码文本包括公钥的编码文本。
  11. 根据权利要求8所述的部署带有安全通道配置需求的docker容器的方法，其特征在于，所述安全通道包括SSH安全通道。
  12. 一种启动带有安全通道配置的docker容器的方法，特征在于，包括以下步骤：
    启动所述docker容器；
    解码所述docker容器的环境变量中所包含的密钥的编码文本，得到密钥；
    将所述密钥存储到所述docker容器。
  13. 一种在集群中建立安全通道的装置，特征在于，包括：
    获取单元，用于获取在指定集群内各指定的用户空间之间建立安全通道的请求；
    密钥生成单元，用于生成所述请求所对应的安全通道的密钥对，所述密钥对包括公钥和私钥；
    传送单元，用于将各指定的用户空间所需的密钥以与相应用户空间相对应的形式传送到各指定的用户空间；
    存储单元，用于将所述所需的密钥的相应形式所对应的密钥存储到所述各指定的用户空间；
    建立单元，用于利用所述密钥在所述各指定的用户空间之间建立安全通道。
  14. 根据权利要求13所述的在集群中建立安全通道的装置，其特征在于，所述用户空间包括docker容器，相应地，所述传送单元，包括：
    编码子单元，用于对各指定的docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本；
    放入子单元，用于将所述与各个docker容器的安全通道的属性相对应的密钥的编码文本放入相应docker容器的环境变量中；
    部署子单元，用于将带有所述环境变量的各指定的docker容器部署到所述集群内预先指定的各宿主机；
    所述存储单元包括：
    解码子单元，用于所述各指定的docker容器启动后，对所述各指定的docker容器的环境变量中包含的密钥的编码文本进行解码得到密钥；
    存储子单元，用于将所述解码得到的密钥存储到相应的指定的docker容器中。
  15. 根据权利要求13所述的在集群中建立安全通道的装置，其特征在于，所述密钥生成单元，具体用于生成所述请求所对应的安全通道的一个密钥对，所述密钥对包括公钥和私钥。
  16. 一种部署带有安全通道配置需求的docker容器的装置，特征在于，包括：
    获取单元，用于获取部署带有安全通道配置需求的docker容器的请求；
    编码单元，用于对所述docker容器的安全通道的属性相对应的密钥进行编码，得到与各个docker容器的安全通道的属性相对应的密钥的编码文本；
    配置单元，用于将与所述docker容器的安全通道的属性相对应的密钥的编码文本放 入该docker容器的环境变量中；
    部署单元，用于将带有所述环境变量的docker容器部署到预先指定的宿主机。
  17. 一种启动带有安全通道配置的docker容器的装置，特征在于，包括：
    启动单元，用于启动所述docker容器；
    解码单元，用于解码所述docker容器的环境变量中所包含的密钥的编码文本，得到密钥；
    存储单元，用于将所述密钥存储到所述docker容器。
PCT/CN2017/110785 2016-11-24 2017-11-14 一种在集群中建立安全通道的方法和装置 Ceased WO2018095240A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611052641.7A CN108111469B (zh) 2016-11-24 2016-11-24 一种在集群中建立安全通道的方法和装置
CN201611052641.7 2016-11-24

Publications (1)

Publication Number Publication Date
WO2018095240A1 true WO2018095240A1 (zh) 2018-05-31

Family

ID=62195670

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/110785 Ceased WO2018095240A1 (zh) 2016-11-24 2017-11-14 一种在集群中建立安全通道的方法和装置

Country Status (2)

Country Link
CN (1) CN108111469B (zh)
WO (1) WO2018095240A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116668050A (zh) * 2022-02-18 2023-08-29 戴尔产品有限公司 具有用于监测超融合基础设施资源的健康状态的嵌入式脚本工具的容器化服务

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109150684B (zh) * 2018-07-20 2021-04-06 新华三技术有限公司 报文处理方法、装置、通信设备及计算机可读存储介质
CN117318970A (zh) * 2022-06-23 2023-12-29 中兴通讯股份有限公司 安全通道建立方法、系统及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN201663659U (zh) * 2009-11-27 2010-12-01 北京视博数字电视科技有限公司 条件接收系统前端和用户管理系统
CN102333068A (zh) * 2011-03-18 2012-01-25 北京神州数码思特奇信息技术股份有限公司 一种基于ssh、sftp隧道智能管控系统及方法
CN104506483A (zh) * 2014-10-21 2015-04-08 中兴通讯股份有限公司 一种信息加密解密、管理密钥的方法、终端及网络服务器
WO2016054272A1 (en) * 2014-09-30 2016-04-07 Nicira, Inc. Inline service switch
US20160150053A1 (en) * 2014-11-25 2016-05-26 Auth0, Inc. Multi-tenancy via code encapsulated in server requests
US20160328006A1 (en) * 2015-05-06 2016-11-10 Vmware, Inc. Distributed power management with partial suspend mode for distributed storage systems

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104618108B (zh) * 2014-12-30 2018-07-27 北京奇虎科技有限公司 安全通信系统
CN105760167A (zh) * 2016-02-23 2016-07-13 浪潮软件集团有限公司 一种基于Docker的持续集成方法
CN106020930B (zh) * 2016-05-13 2019-07-23 深圳市中润四方信息技术有限公司 一种基于应用容器的应用管理方法及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN201663659U (zh) * 2009-11-27 2010-12-01 北京视博数字电视科技有限公司 条件接收系统前端和用户管理系统
CN102333068A (zh) * 2011-03-18 2012-01-25 北京神州数码思特奇信息技术股份有限公司 一种基于ssh、sftp隧道智能管控系统及方法
WO2016054272A1 (en) * 2014-09-30 2016-04-07 Nicira, Inc. Inline service switch
CN104506483A (zh) * 2014-10-21 2015-04-08 中兴通讯股份有限公司 一种信息加密解密、管理密钥的方法、终端及网络服务器
US20160150053A1 (en) * 2014-11-25 2016-05-26 Auth0, Inc. Multi-tenancy via code encapsulated in server requests
US20160328006A1 (en) * 2015-05-06 2016-11-10 Vmware, Inc. Distributed power management with partial suspend mode for distributed storage systems

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
LIU, XI ET AL.: "Design and Implementation of Web Cluster Based on Docker Container", ELECTRONIC DESIGN ENGINEERING, vol. 24, no. 8, 30 April 2016 (2016-04-30) *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116668050A (zh) * 2022-02-18 2023-08-29 戴尔产品有限公司 具有用于监测超融合基础设施资源的健康状态的嵌入式脚本工具的容器化服务

Also Published As

Publication number Publication date
CN108111469B (zh) 2020-06-02
CN108111469A (zh) 2018-06-01

Similar Documents

Publication Publication Date Title
EP3123657B1 (en) Method and apparatus for cloud-assisted cryptography
US9166787B2 (en) Securing encrypted virtual hard disks
CN105760764B (zh) 一种嵌入式存储设备文件的加解密方法、装置及终端
JP7000491B2 (ja) バイパス不可能なゲートウェイを使用するｔｐｍベースの安全なマルチパーティ・コンピュータシステム
JP2016513945A5 (zh)
CN111427860B (zh) 分布式存储系统及其数据处理方法
JP2016514912A5 (zh)
KR20140099325A (ko) 글로벌 플랫폼 규격을 사용하는 발행자 보안 도메인에 대한 키 관리 시스템 및 방법
US8953786B2 (en) User input based data encryption
US20170373850A1 (en) Data encryption method, decryption method, apparatus, and system
CN103885830A (zh) 一种虚拟机跨数据中心动态迁移中的数据处理方法
CN111654367A (zh) 密码运算、创建工作密钥的方法、密码服务平台及设备
US10476664B2 (en) Methods and systems for data protection
CN112363801B (zh) 虚拟机迁移方法、处理方法、系统、装置、芯片及介质
US11509469B2 (en) Methods and systems for password recovery based on user location
CN110795747A (zh) 一种数据加密存储方法、装置、设备及可读存储介质
WO2018095240A1 (zh) 一种在集群中建立安全通道的方法和装置
CN103905557A (zh) 用于云环境的数据存储方法和装置、及下载方法和装置
CN115695003A (zh) 密钥交换方法、系统、电子设备及存储介质
CN105871926B (zh) 一种基于桌面虚拟化的usb设备安全共享方法及系统
CN110138750A (zh) 配置文件的加密方法、装置及系统、存储介质、终端
CN102984146A (zh) 用于云计算的数据管理方法
CN115391795A (zh) 数据处理方法、相关设备及介质
US9135449B2 (en) Apparatus and method for managing USIM data using mobile trusted module
CN104901959A (zh) 一种验证计算池可信的方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17874344

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17874344

Country of ref document: EP

Kind code of ref document: A1