CN118590330B - A communication method and service node for containers - Google Patents

Abstract

The present application discloses a communication method and service node for a container. The method obtains configuration rules through the service node in the container cluster to create a virtual network card pair between the virtual bridge of the service node and the local container and a virtual network between the service node and other service nodes according to the configuration rules. When the local container communicates with other target containers based on the virtual network card pair and the virtual network, the communication data of the local container is encrypted and decrypted on the network protocol stack of the local container through the communication key of the secure network domain. The communication method provided by the present application creates an isolated network environment for cross-node containers to communicate; in addition, the communication data of the container is encrypted and decrypted on the network protocol stack of the container. By encrypting and decrypting the data from the source, the security risks of proxy encryption can be avoided, which not only achieves the purpose of saving resources, but also can achieve the technical effect of the present application to adapt to multiple application scenarios.

Description

A communication method and service node for containers

Technical Field

The present disclosure generally relates to the field of communication technology and in particular to a communication method and service node of a container.

Background Art

In the current cloud computing and containerization technology environment, containers are widely used in application development and deployment due to their lightweight and efficient features. However, with the increasing complexity of applications, applications are often divided into business entry containers and business application containers when they are deployed in containers. The number of containers and container clusters has increased dramatically. At the same time, the use of multiple network cards in containers has further deepened the complexity of container networks, and network communication security issues between containers have gradually emerged.

Summary of the invention

In view of the above defects or deficiencies in the prior art, it is desirable to provide a communication method and a service node for a container.

In a first aspect, a container communication method is provided, which is applied to a container cluster network, wherein the container cluster network includes at least one container cluster, the container cluster includes at least one service node, and at least one container and a virtual bridge are deployed on the service node. The method includes:

The service node acquires a configuration rule; the configuration rule is used to indicate building a secure network domain for at least two target containers, and the at least two target containers are deployed on different service nodes;

Creating a virtual network card pair between the virtual network bridge of the service node and the local container based on the configuration rule, and establishing a connection between the virtual network bridge and the local container through the virtual network card pair;

Creating a virtual network between the service node and other service nodes based on the configuration rule; the other service nodes are service nodes corresponding to other target containers among the at least two target containers except the local container, and the local container is a container among the at least two target containers deployed on the service node;

When the local container performs network communication with other target containers based on the virtual network card pair and the virtual network, communication data of the local container is encrypted and decrypted on the network protocol stack of the local container by using the communication key of the secure network domain, and the other target container is a container deployed on the other service node among the at least two target containers.

The container communication method provided by the present application takes into account the fact that the number of containers and the number of container clusters are increasing dramatically, and the use of multiple network cards in containers further deepens the complexity of the container network, and the network communication security issues between containers are gradually emerging. The present application provides a container communication method, which obtains configuration rules through the service nodes in the container cluster to create a virtual network card pair between the virtual bridge of the service node and the local container and a virtual network between the service node and other service nodes according to the configuration rules, and then establishes a connection between the virtual bridge and the local container through the virtual network card pair. When the local container communicates with other target containers based on the virtual network card pair and the virtual network, the communication data of the local container is encrypted and decrypted on the network protocol stack of the local container through the communication key of the security network domain. The communication method provided by the present application creates an isolated network environment when containers communicate across nodes by setting up virtual network card pairs and virtual networks, and the external network cannot intercept or monitor the network traffic therein; in addition, when the container in the present application communicates in an isolated network environment, the communication data of the container is also encrypted and decrypted on the network protocol stack of the container. By encrypting and decrypting the data from the source, the security risks of proxy encryption can be avoided, and the security of container cross-node communication is further guaranteed. The above improvements are all unrelated to the application itself, which not only achieves the purpose of saving resources, but also can achieve the technical effect of the present application to adapt to multiple application scenarios.

A first aspect provides a service node, the service node comprising:

The security network domain controller obtains a configuration rule; the configuration rule is used to instruct to build a security network domain for at least two target containers, and the at least two target containers are deployed on different service nodes;

A container executor, configured to create a virtual network card pair between the virtual network bridge of the service node and the local container based on the configuration rule, and establish a connection between the virtual network bridge and the local container through the virtual network card pair;

The container executor is further used to create a virtual network between the service node and other service nodes based on the configuration rule; the other service nodes are service nodes corresponding to other target containers in the at least two target containers except the local container, and the local container is a container in the at least two target containers deployed on the service node;

A secure network domain executor is used to encrypt and decrypt communication data of the local container on the network protocol stack of the local container by using the communication key of the secure network domain when the local container communicates with other target containers based on the virtual network card pair and the virtual network, and the other target container is a container deployed on the other service node among the at least two target containers.

BRIEF DESCRIPTION OF THE DRAWINGS

Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

FIG1 is an application scenario diagram of a container communication method provided by the present application;

FIG2 is a flow chart of the steps of a communication method for a container provided by the present application;

FIG3 is a flowchart of a communication method for a container provided by the present application;

FIG4 is a flowchart of a communication method for a container provided by the present application;

FIG5 is a flowchart of a communication method for a container provided by the present application;

FIG6 is a flowchart of a communication method for a container provided by the present application;

FIG. 7 is a schematic diagram of the structure of a computer system of a service node provided in the present application.

DETAILED DESCRIPTION

The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant inventions, rather than to limit the inventions. It should also be noted that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

Please refer to Figure 1, which is an application scenario diagram of a container communication method provided by the present application, wherein the application scenario diagram includes a container cluster network, the container cluster network includes at least one container cluster, the container cluster includes two service nodes (a service node and other service nodes), and a local container and a virtual bridge are deployed on the service node; other target containers, virtual bridges and communication network cards are deployed on other service nodes.

It should be noted that the service node communicates with other service nodes through a communication network card and a physical switch.

A first virtual network card pair is set between the local container and the virtual bridge of the service node, and a second virtual network card pair is set between the virtual bridges of other target containers and other service nodes. The local container sends communication data to the container protocol stack for encryption and then sends it to the first subnet card of the first virtual network card pair. The first subnet card sends the communication data to the second subnet card of the first virtual network card pair. The second subnet card sends the communication data to the virtual bridge of the service node. The virtual bridge of the service node sends the communication data to the virtual bridge of other service nodes through the set virtual network. The virtual bridge of other service nodes continues to transmit the communication data to the container protocol stack of other target containers through the second virtual network card. After decryption on the container protocol stack, cross-node communication between the local container and other target containers is realized.

The communication of the container provided by the present application is exemplarily described below in conjunction with FIG. 2 . FIG. 2 is a flowchart of the steps of communication of a container provided by the present application. The method is described by taking the method applied to the service node in FIG. 1 as an example. The method includes the following steps:

Step S20, the service node obtains a configuration rule; the configuration rule is used to indicate that a secure network domain is constructed for at least two target containers, and the at least two target containers are deployed on different service nodes;

The container cluster network also includes a container management system and a configuration center, and the container management system and the configuration center correspond to multiple container clusters. The container management system provides an operation interface for users, and users can create configuration rules through the operation interface of the container management system through interface operation.

After obtaining the configuration rules, the container management system can send them to the configuration center of the container cluster network. Each container cluster in the container management cluster network can access the configuration center in real time to obtain the configuration rules. Specifically, each service node in each container cluster can access the configuration center in real time to obtain the configuration rules. Furthermore, a security network domain controller is deployed on each service node of the container cluster, and the security network domain controller deployed on each service node reads the configuration rules from the configuration center in real time.

The configuration rule is used to instruct to build a secure network domain for at least two target containers. That is, the configuration rule is used to build a secure communication environment for at least two target containers when at least two target containers deployed on different service nodes communicate, so as to avoid or improve the leakage, monitoring, and attack of the communication data of the at least two target containers.

Based on the role of the configuration rule, it can be understood that the configuration rule may include a unique identifier of the container cluster, a unique identifier of the service node, and a unique identifier of the container.

After obtaining the configuration rules from the configuration center, the security network domain controller deployed on each service node parses the configuration rules to obtain the unique identifier of the corresponding container cluster, the unique identifier of the service node, and the unique identifier of the container, so that the security network domain controller deployed on the service node can determine whether the configuration rules are related to the corresponding service node and the container deployed on the service node.

Exemplarily, the first service node and the second service node deployed on the container cluster A; the security network domain controller deployed on the first service node and the second service node respectively read the configuration rules from the configuration center, and by parsing the configuration rules, the security network domain controller of the first service node determines that the unique identifier of the container cluster is the same as the unique identifier of the container cluster A, and the unique identifier of the service node includes the unique identifier of the first service node, then the security network domain controller of the first service node can be performed according to the instructions of the configuration rule. Similarly, the security network domain controller of the second service node determines that the unique identifier of the container cluster is the same as the unique identifier of the container cluster A, and the unique identifier of the service node includes the unique identifier of the second service node, then the security network domain controller of the second service node can be performed according to the instructions of the configuration rule. In other words, when the first service node obtains the configuration rule, it can obtain the information needed to build a security network domain for the target container deployed on itself and the target container deployed on the second service node; the second service node can also obtain the information needed to build a security network domain for the target container deployed on itself and the target container deployed on the first service node based on the parsing of the configuration rules.

It is understandable that if the security network domain controller parses the configuration rule and determines that the unique identifier of the container cluster is different from the unique identifier of container cluster A, then the security network domain controller can delete the configuration rule or perform no operation.

Optionally, the secure network domain controller can monitor the configuration rules stored in the configuration center in real time in a list-watch working mode. The configuration rules can be obtained in a timely manner by monitoring, so as to further build a secure network domain for the target container required by the user in a timely manner according to the configuration rules, thereby improving the user experience.

In another optional embodiment, a secure network domain executor is also deployed on the service node. When the secure network domain controller reads the configuration rules from the configuration center, it can convert the configuration rules into commands through protocol to obtain container network configuration information, and send the container network configuration information to the secure network domain executor to execute the corresponding configuration operations through the secure network executor.

In another optional embodiment, when the security network domain controller determines that there is an update to the configuration rule (for example, a new container needs to be added or a container needs to be deleted) or the configuration rule is deleted, it will re-issue a new configuration rule to the security network domain executor, or instruct the security network domain executor to delete the original configuration rule. Then, the service node can perform operations such as deleting the virtual network card pair between the virtual bridge and the container of the current service node, deleting the virtual network, or adding a new virtual network card pair to the virtual bridge according to the updated configuration rule.

Since building a secure network domain for a cross-node target container requires the participation of different service nodes, but the operations that each service node needs to perform are the same, the following will use the configuration rule used to indicate the construction of a secure network domain for a local container on a service node and other target containers on other target containers as an example, and only the operations performed by the service node will be used as an example.

Step S30, creating a virtual network between the service node and other service nodes based on the configuration rules; the other service nodes are service nodes corresponding to other target containers in at least two target containers except the local container, and the local container is a container in at least two target containers deployed on the service node;

Among them, since the communication between the local container and other target containers needs to be network isolated from the communication with other containers, the communication between the local container and other target containers needs to be carried out through a network different from the communication with other containers (such as the communication network card deployed on the service node) to exchange data. In layman's terms, the communication between the local container and other target containers needs to be realized through a channel different from the existing communication channel, so we need to build a virtual network between the service node and other service nodes.

In an optional embodiment, as shown in FIG. 3 , FIG. 3 is an optional method embodiment of building a virtual network provided by an exemplary embodiment of the present application, and the method embodiment includes the following steps:

Step S301, parsing the configuration rules to obtain the network key;

Among them, as mentioned above, the configuration rules include the unique identifier of the container cluster, the unique identifier of the service node, and the unique identifier of the target container. In addition, the configuration rules also include a network key, which is used to build a virtual network between the service node and other service nodes on the one hand, and to encrypt the virtual network on the other hand, that is, other containers cannot communicate through the virtual network.

Therefore, after obtaining the configuration rules, the service node and other service nodes can obtain the corresponding network key after parsing the configuration rules. Based on the configuration rules, a secure network domain is built for the target container deployed on the service node and other service nodes. It can be understood that the network key obtained by the service node and other service nodes after parsing is the same.

Step S302, the service node broadcasts a data packet through the communication network card of the service node, where the data packet includes a network key;

Among them, the communication network card of the service node is the network card originally configured by the service node. Unlike the virtual bridge, it can provide hardware support for the service node to communicate with other service nodes. The communication network cards deployed on different service nodes realize the communication between service nodes by performing data communication on the physical switch. After the service node parses the configuration rules to obtain the network key, it can send the data packet including the network key to other multiple service nodes through the physical switch in the form of broadcast through the communication network card. It can be understood that other service nodes can also receive the data packet. After receiving the data packet, since only other service nodes obtain the network key from the configuration rules, other service nodes do not obtain the network key. Therefore, when other service nodes receive the data packet, they parse the data packet to obtain the network key sent by the service node, and determine that the network key is the same as the network key obtained from the configuration rules, so that the information that needs to establish a virtual network with the service node can be obtained. It can be understood that since other service nodes do not obtain the configuration rules and parse the network key from the configuration rules, even if the network key is obtained from the data packet, the information on what operations they need to perform cannot be obtained.

Step S303, receiving a connection request initiated by other service nodes to the service node based on broadcast, where the connection request carries a connection key;

After broadcasting the network key, the service node will receive a connection request from other service nodes, which is used to send a request to establish virtual network communication to the service node. The service node needs to verify the connection request based on the connection key carried in the connection request to ensure the accuracy of the virtual network establishment.

The method by which the service node verifies the connection request is to compare the connection key sent by other service nodes with the network key. If the comparison is successful, it is determined that the network key has successfully verified the connection key, and the further verification of the connection request is successful; otherwise, the verification fails. It can be understood that only when the comparison is successful can the service node and other service nodes establish a virtual network.

Step S304: If the service node successfully verifies the connection key according to the network key, a virtual network is established based on the connection between the service node and other service nodes.

When the service node successfully verifies the connection key based on the network key, it means that the service node and other service nodes have successfully joined the same network, which we call a virtual network. In addition, with the support of the network key, the virtual network can be made private, which can improve the security of communication between the local container and other target containers on the virtual network.

By constructing a virtual network, the present application can provide a network communication environment that is isolated from other external networks for cross-node communication between containers, thereby avoiding communication between containers through, for example, communication network cards set up on service nodes, so that communication between containers will not be exposed to the external network environment, which can reduce the attack surface of containers during cross-node communication and improve the security of cross-node communication between containers.

Step S40, creating a virtual network card pair between the virtual network bridge of the service node and the local container based on the configuration rule, and establishing a connection between the virtual network bridge and the local container through the virtual network card pair;

Among them, a virtual bridge is also deployed on the service node. The virtual bridge involves the processing and forwarding of data frames, as well as its application in a virtualized environment. In virtualization technology, a virtual bridge is used to expand a local area network or to realize network communication between a container and a host machine, that is, a virtual bridge can connect a container to a host network to realize communication between containers and between containers and external networks. It should be noted here that to realize communication between a container and a host machine, it is also necessary to create a virtual network card pair between the virtual bridge and the container. The communication between the virtual bridge and the container can be realized through a virtual network card pair. As the name implies, a virtual network card pair is a pair of network cards. One of the network cards in a pair is deployed on the container, and the other network card is deployed on the virtual bridge. The virtual network card pair can communicate directly with each other.

In an optional embodiment, as shown in FIG. 4 , FIG. 4 is an optional method embodiment of creating a virtual network card pair provided by an exemplary embodiment of the present application, and the method embodiment includes the following steps:

Step S401, parsing the configuration rules to obtain a unique identifier of the local container;

There may be multiple containers deployed on the service node, and the configuration rule may be to instruct only one of the multiple containers of the service node to build a secure network domain with containers on other service nodes. Therefore, the service node needs to determine the target container from the multiple deployed containers, which we call the local container here.

Based on the above description, it can be known that the configuration rule includes the unique identifier of the container for constructing the secure network domain. Therefore, the service node can obtain the unique identifier of the local container after parsing the configuration rule.

Step S402, determining the local container from the service node according to the unique identifier of the local container;

After the service node obtains the unique identifier of the container deployed on the service node by parsing the configuration rule, the local container can be determined from multiple containers deployed on the service node.

Step S403: Create a virtual network card pair between the virtual bridge and the local container.

Among them, the virtual network card pair is a pair of ports. All data packets flowing in from one port will flow out from the other port, and vice versa. However, the virtual network card pair can only realize communication between two network interfaces. However, the communication between the local container and other target containers sets up communication between multiple interfaces, so we need to create a virtual network card pair between the virtual bridge and the local container. The virtual bridge can realize communication between several network interfaces. That is to say, if one network interface in the virtual bridge receives data, it will be copied to other interfaces of the virtual bridge, so that the data can be forwarded from other interfaces.

Therefore, the virtual bridge deployed on the service node and the created virtual network card pair cooperate with each other to realize the communication between the local container and other target containers.

For example, the following command may be used to create a virtual network card pair between the virtual bridge and the local container:

ip link add<p1-name>type veth peer name<p2-name>

After the service node creates a virtual network card pair between the virtual bridge deployed on the service node and the local container according to the above method, if the corresponding settings are not made, the communication between the virtual bridge and the local container cannot be realized. Therefore, the following settings are required to establish a connection between the virtual bridge and the local container through the virtual network card pair, that is, to realize the communication between the two:

In order to distinguish the virtual network card pair, the two network cards of the virtual network card pair are called the first network card and the second network card. The specific operations to achieve the communication connection between the virtual bridge and the local container are:

Setting the first network card as a sub-device of the virtual network bridge;

Set the namespace of the second network card to the namespace of the local container.

Setting the first network card as a sub-device of the virtual network bridge means establishing a mapping relationship between one of the interfaces in the virtual network bridge and the first network card, so that one of the interfaces on the virtual network bridge and the first network card can communicate.

Generally speaking, a namespace is a set of uniquely identified names, so that there is no ambiguity when objects come from different places but have the same name. Namespaces can mark access paths, so setting the namespace of the second network card to the namespace of the local container allows the two to access each other.

In addition, based on the properties of the virtual network card pair itself, it can be known that the first network card and the second network card can communicate directly. After the above settings, a connection between the local container and the virtual bridge can be established, and the local container can communicate with the virtual bridge.

In view of the above settings, the communication between the local container and the virtual bridge is described below.

Since the communication is bidirectional, one of the communication methods between the two is described below:

The communication data that the local container needs to send needs to be encapsulated and processed on the local container's network protocol stack. It should be noted that the network protocol stack is the sum of all layers of protocols in a computer network. The working principle is that each layer on the network protocol stack is responsible for encapsulating and processing the data of the previous layer and passing it to the next layer. The receiving end decapsulates and processes it in the opposite order and finally passes the data to the application layer. Therefore, the local container encapsulates and processes the data that needs to be communicated through the network protocol stack before sending it out.

After the local container encapsulates and processes the communication data through the network protocol stack, the data is transmitted to the second network card. Since the virtual network card pair is a paired port, all data packets flowing into one port will flow out from the other port, that is, the data flowing into the second network card must flow out from the first network card, so the communication data is transmitted to the first network card. Since there is a mapping relationship between the first network card and one of the interfaces of the virtual bridge, one of the interfaces of the virtual network can read the communication data from the first network card.

Another way of communication is:

The other network ports of the virtual bridge receive the communication data. Since a network interface in the virtual bridge will copy the data to other interfaces of the virtual bridge after receiving it, the interface in the virtual bridge that establishes a mapping relationship with the first network card will obtain the communication data. The first network card can obtain the communication data from the interface and flow it into the network protocol stack of the container from the second network card. After being unpacked and processed layer by layer in the network protocol stack, the communication data is finally obtained.

The above only introduces the communication between the local container and the virtual bridge deployed on the service node based on the current settings. Since other service nodes will perform the same setting operations as the service node, other service nodes will also establish virtual network card pairs between other target containers and virtual bridges deployed on other service nodes. With the help of the virtual network established between the service node and other service nodes, the communication between the local container and other target containers can be realized. The following is an explanation of the communication between the local container and other target containers based on the settings of the service node and other service nodes:

The first one is that the communication data is transmitted from the local container to other target containers.

The local container sends the communication data to the virtual network card pair between the virtual network bridge, so as to be sent to the interface of the virtual network card through the virtual network card pair;

The secure network domain executor obtains communication data from the interface of the virtual network card;

The secure network domain executor transmits communication data to the secure network domain executors deployed on other service nodes through the virtual network, so that other target containers obtain communication data from the secure network domain executors deployed on other service nodes and the virtual network cards between the virtual network cards and other target containers.

Specifically, the local container encapsulates and processes the communication data through the network protocol stack, and sends the communication data to the second network card, and the communication data flows out from the first network card;

One of the interfaces of the virtual bridge reads the communication data flowing out of the first network card, and the virtual bridge copies the communication data to other interfaces of the virtual bridge. The security network domain executor deployed on the service node reads the communication data from other interfaces of the virtual bridge, and sends it to the security network domain executors of other service nodes through the virtual network;

The security network domain executor of other service nodes sends the communication data to one of the interfaces of the virtual bridge deployed on other service nodes. The virtual bridge deployed on other service nodes copies the communication data to other interfaces. After the first network card corresponding to the virtual bridge deployed on other service nodes obtains the communication data from one of the interfaces, it flows out to the network protocol stack of other target containers through the second network card corresponding to other target containers deployed on other service nodes. After layers of unpacking and processing, other target containers obtain the communication data.

The second type is that the communication data is transmitted from other target containers to the local container.

The local container obtains the communication data on the interface of the virtual network card through the virtual network card pair between the virtual bridge. The communication data on the interface of the virtual network card is data obtained from the security network domain executor deployed on the service node. The data obtained by the security network domain executor is data received by other target containers based on the virtual network through the security network domain executors deployed on other service nodes and the virtual network card sent by the virtual network card between the virtual network card and other target containers.

That is to say, the other target containers first encapsulate and process the communication data through the network protocol stack, and then send the communication data to the second network card corresponding to the other target containers and flow out from the first network card corresponding to the virtual bridge deployed on other service nodes;

One of the interfaces of the virtual bridge deployed on other service nodes that has a mapping relationship with the first network card reads the communication data flowing out of the first network card, and the virtual bridge copies the communication data to other interfaces of the virtual bridge. The security network domain executor deployed on other service nodes reads the communication data from other interfaces of the virtual bridge, and sends the communication data to the security network domain executor of the service node through the virtual network;

The security network domain executor of the service node sends the communication data to one of the interfaces of the virtual bridge deployed on the service node. The virtual bridge deployed on the service node copies the communication data to other interfaces. After the first network card corresponding to the virtual bridge deployed on the service node obtains the communication data from one of the interfaces, it flows out to the network protocol stack of the local container through the second network card corresponding to the local container deployed on the service node. After layers of unpacking and processing, the local container obtains the communication data.

Step S50, when the local container communicates with other target containers based on the virtual network card pair and the virtual network, the communication data of the local container is encrypted and decrypted on the network protocol stack of the local container through the communication key of the secure network domain, and the other target containers are containers deployed on other service nodes among at least two target containers.

Among them, in order to further strengthen the security of the communication environment between the local container and other target containers, the present application isolates a secure network domain between the local container and other target containers to achieve the minimum range of network access, reducing the risk of core key business containers being monitored and attacked, etc., and the communication data of the local container will be encrypted and decrypted through the communication key of the secure network domain. In addition, the present application encrypts and decrypts the communication data during the process of encapsulating and processing the communication data by the network protocol stack of the container, which can realize the encryption and decryption of the data from the source, thereby avoiding the security risks of proxy encryption and further ensuring the security of cross-node communication of the container.

Before explaining the encryption and decryption processing, it is necessary to explain the origin of the encryption key and the decryption key.

The configuration rules include encryption keys and decryption keys. After the service node parses the configuration rules, the secure network executor deployed on the service node will store the encryption keys and decryption keys in the mapping table of network namespace ID and encryption/decryption protocol/key based on map implementation (referred to as target mapping relationship information here). The target mapping relationship information includes the namespace address of the local container, the network card address of the local container, and the encryption key and decryption key corresponding to the network card address of the local container.

When a service node runs a container, the secure network executor deployed on the service node updates the map table through a system call to add the container's namespace to the target mapping relationship information; when a container is destroyed, the executor removes the container's namespace from the target mapping relationship information. In this way, the container can be mapped to the corresponding encryption key and decryption key.

Therefore, when the local container needs to be encrypted or decrypted, the encryption key and decryption key corresponding to the local container can be read from the target mapping relationship information.

It can be understood that if the transmission direction of the communication data is from the local container to other target containers, the local container needs to encrypt the communication data according to the encryption key in the communication key; conversely, if the transmission direction of the communication data is from other target containers to the local container, the communication data is decrypted according to the encryption key in the communication key.

In an optional embodiment, as shown in FIG. 5 , FIG. 5 is an optional method embodiment of encrypting communication data according to an encryption key in a communication key provided by an exemplary embodiment of the present application, and the method embodiment includes the following steps:

Step S501, obtaining an encryption key from target mapping relationship information according to the namespace address of the local container and the network card address of the local container, where the target mapping relationship information includes the namespace address of the container, the network card address of the container, and the encryption key and decryption key corresponding to the namespace address and network card address of the container;

Step S502: encrypting the data segment of the communication data by using an encryption key during encapsulation of the data segment of the communication data on the network protocol stack of the local container.

In an optional embodiment, as shown in FIG. 6 , FIG. 6 is an optional method embodiment of decrypting communication data according to a decryption key in a communication key provided by an exemplary embodiment of the present application, and the method embodiment includes the following steps:

Step S601, obtaining a decryption key from target mapping relationship information according to the namespace address of the local container and the network card address of the local container;

Step S602: decrypting the data segment of the communication data using a decryption key during the process of decrypting the data segment of the communication data on the network protocol stack of the local container.

Among them, since the communication data of the local container needs to be encapsulated and processed by the network protocol stack of the local container, the process of encrypting and decrypting the communication data can be performed on the network protocol stack of the local container. This application can encrypt and decrypt the data from the source by encrypting and decrypting the communication data during the process of encapsulating and processing the communication data by the network protocol stack of the container, thereby avoiding the security risks of proxy encryption and further ensuring the security of cross-node communication of the container.

The container communication method provided by the present application takes into account the fact that the number of containers and the number of container clusters are increasing dramatically, and the use of multiple network cards in containers further deepens the complexity of the container network, and the network communication security issues between containers are gradually emerging. The present application provides a container communication method, which obtains configuration rules through the service nodes in the container cluster to create a virtual network card pair between the virtual bridge of the service node and the local container and a virtual network between the service node and other service nodes according to the configuration rules, and then establishes a connection between the virtual bridge and the local container through the virtual network card pair. When the local container communicates with other target containers based on the virtual network card pair and the virtual network, the communication data of the local container is encrypted and decrypted on the network protocol stack of the local container through the communication key of the security network domain. The communication method provided by the present application creates an isolated network environment when containers communicate across nodes by setting up virtual network card pairs and virtual networks, and the external network cannot intercept or monitor the network traffic therein; in addition, when the container in the present application communicates in an isolated network environment, the communication data of the container is also encrypted and decrypted on the network protocol stack of the container. By encrypting and decrypting the data from the source, the security risks of proxy encryption can be avoided, and the security of container cross-node communication is further guaranteed. The above improvements are all unrelated to the application itself, which not only achieves the purpose of saving resources, but also can achieve the technical effect of the present application to adapt to multiple application scenarios.

It should be noted that although the operations of the method of the present invention are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. On the contrary, the steps depicted in the flow chart can change the execution order.

Further, in conjunction with FIG1 , the present application also provides a service node, the service node comprising:

The secure network domain controller obtains a configuration rule; the configuration rule is used to indicate building a secure network domain for at least two target containers, and the at least two target containers are deployed on different service nodes;

The container executor is used to create a virtual network card pair between the virtual network bridge of the service node and the local container based on the configuration rules, and establish a connection between the virtual network bridge and the local container through the virtual network card pair;

The container executor is further used to create a virtual network between the service node and other service nodes based on the configuration rules; the other service nodes are service nodes corresponding to other target containers other than the local container in at least two target containers, and the local container is a container deployed on the service node in at least two target containers;

The secure network domain executor is used to encrypt and decrypt the communication data of the local container on the network protocol stack of the local container through the communication key of the secure network domain when the local container communicates with other target containers based on the virtual network card pair and the virtual network. The other target containers are containers deployed on other service nodes among at least two target containers.

In an optional embodiment, the container executor is specifically used to parse the configuration rule and obtain the network key;

The service node broadcasts the data packet through the communication network card of the service node, and the data includes the network key;

Receive connection requests initiated by other service nodes to the service node based on broadcast, where the connection requests carry a connection key;

If the service node successfully verifies the connection key based on the network key, a virtual network is established based on the connection between the service node and other service nodes.

In an optional embodiment, the container executor is further configured to parse the configuration rule and obtain a unique identifier of the local container;

Determine the local container from the service node according to the unique identifier of the local container;

Create a virtual network adapter pair between the virtual network bridge and the local container.

In an optional embodiment, the container executor is further configured to set the first network card as a sub-device of the virtual network bridge;

Set the namespace of the second network card to the namespace of the local container.

In an optional embodiment, the container executor is further configured to establish a mapping relationship between one of the interfaces in the virtual network bridge and the first network card.

In an optional embodiment, the secure network domain executor is specifically used to obtain communication data from the interface of the virtual network card, and transmit the communication data to the secure network domain executor deployed on other service nodes through the virtual network, so that other target containers obtain communication data from the secure network domain executor deployed on other service nodes and the virtual network card between the virtual network card and other target containers.

In an optional embodiment, the container executor is further configured to encrypt the communication data on the network protocol stack of the local container according to the encryption key in the communication key if the transmission direction of the communication data is from the local container to other target containers;

If the transmission direction of the communication data is from other target containers to the local container, the communication data is decrypted on the network protocol stack of the local container according to the decryption key in the communication key.

In an optional embodiment, the container executor is further configured to obtain an encryption key from target mapping relationship information according to a namespace address of the local container and a network card address of the local container, wherein the target mapping relationship information includes an encryption key and a decryption key corresponding to the namespace address of the local container, the network card address of the local container, and the network card address of the local container;

In the process of encapsulating the data segment part of the communication data on the network protocol stack of the local container, the data segment part of the communication data is encrypted by using the encryption key.

In an optional embodiment, the container executor is further configured to obtain a decryption key from the target mapping relationship information;

In the process of decrypting the data segment portion of the communication data on the network protocol stack of the local container, the data segment portion of the communication data is decrypted using the decryption key.

In an optional embodiment, the secure network domain executor is further used to delete the virtual network card pair between the virtual bridge of the service node and the local container according to the updated configuration rules if the service node determines that the configuration rules are updated, or to establish a new virtual network card pair for the virtual bridge.

In an optional embodiment, the secure network domain controller is further configured to process the configuration rules by converting the protocol into commands.

Reference is made to FIG7 , which shows a schematic diagram of the structure of a computer system 700 suitable for implementing a service node in an embodiment of the present application.

As shown in FIG7 , the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input/output (I/O) interface 705 is also connected to the bus 704.

The following components are connected to the I/O interface 707: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I/O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

In particular, according to an embodiment of the present disclosure, the processes described above with reference to Figures 2-6 can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes program code for executing the method of Figures 2-6. In such an embodiment, the computer program can be downloaded and installed from a network through the communication portion 709, and/or installed from a removable medium 711.

The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and/or flow chart, and the combination of the square boxes in the block diagram and/or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

The units or modules involved in the embodiments described in the present application may be implemented by software or hardware. The units or modules described may also be arranged in a processor, for example, may be described as: a processor includes an XX unit, a YY unit, and a ZZ unit. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves, for example, the XX unit may also be described as a "unit for XX".

As another aspect, the present application further provides a computer-readable storage medium, which may be a computer-readable storage medium included in the device described in the above embodiment; or a computer-readable storage medium that exists independently and is not assembled into the device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the formula input method described in the present application.

The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other.

Claims (12)

1. A container communication method, characterized in that it is applied to a container cluster network, the container cluster network includes at least one container cluster, the container cluster includes at least one service node, and at least one container and a virtual bridge are deployed on the service node. The method includes: The service node acquires a configuration rule; the configuration rule is used to indicate building a secure network domain for at least two target containers, and the at least two target containers are deployed on different service nodes; Creating a virtual network between the service node and other service nodes based on the configuration rule; the other service nodes are service nodes corresponding to other target containers other than the local container among the at least two target containers, and the local container is a container deployed on the service node among the at least two target containers; Creating a virtual network card pair between the virtual network bridge of the service node and the local container based on the configuration rule, and establishing a connection between the virtual network bridge and the local container through the virtual network card pair; When the local container performs network communication with the other target container based on the virtual network card pair and the virtual network, communication data of the local container is encrypted and decrypted on the network protocol stack of the local container by using the communication key of the secure network domain, and the other target container is a container deployed on the other service node among the at least two target containers; The step of establishing a virtual network between the service node and other service nodes based on the configuration rule and the communication network card of the service node includes: Parsing the configuration rules to obtain a network key; The service node broadcasts a data packet through a communication network card of the service node, wherein the data includes the network key; receiving a connection request initiated by another service node to the service node based on the broadcast, wherein the connection request carries a connection key; If the service node successfully verifies the connection key according to the network key, the virtual network is established based on the connection between the service node and the other service nodes. 2. The communication method according to claim 1, characterized in that the step of creating a virtual network card pair between the virtual bridge of the service node and the local container based on the configuration rule comprises: Parsing the configuration rule to obtain a unique identifier of the local container; Determine the local container from the service node according to the unique identifier of the local container; A virtual network card pair is created between the virtual network bridge and the local container. 3. The communication method according to claim 2, wherein the virtual network card pair comprises a first network card and a second network card, the first network card and the second network card are in communication connection, and the establishing a connection between the virtual bridge and the local container through the virtual network card pair comprises: Setting the first network card as a sub-device of the virtual network bridge; The namespace of the second network card is set as the namespace of the local container. 4. The communication method according to claim 3, wherein the step of setting the first network card as a sub-device of the virtual network bridge comprises: A mapping relationship is established between one of the interfaces in the virtual network bridge and the first network card. 5. The communication method according to claim 1, characterized in that a secure network domain executor is also deployed on the service node, and the local container performs network communication with the other target container based on the virtual network card and the virtual network, comprising: The local container sends the communication data to the virtual network card pair between the local container and the virtual network bridge, so as to send the communication data to the interface of the virtual network card through the virtual network card pair; The secure network domain executor obtains the communication data from the interface of the virtual network card; The secure network domain executor transmits the communication data to the secure network domain executor deployed on the other service node through the virtual network, so that the other target container obtains the communication data from the secure network domain executor deployed on the other service node and the virtual network card between the virtual network card and the other target container; or, The local container obtains the communication data on the interface of the virtual network card through the virtual network card pair between the local container and the virtual bridge. The communication data on the interface of the virtual network card is data obtained from the security network domain executor deployed on the service node. The data obtained by the security network domain executor is data sent by the other target container through the security network domain executor deployed on the other service node and the virtual network card pair between the virtual bridge and the other target container according to the virtual network. 6. The communication method according to claim 5, characterized in that the encryption and decryption of the communication data of the local container by using the communication key of the secure network domain comprises: If the transmission direction of the communication data is from the local container to the other target container, encrypting the communication data on the network protocol stack of the local container according to the encryption key in the communication key; If the transmission direction of the communication data is from the other target container to the local container, the communication data is decrypted on the network protocol stack of the local container according to the decryption key in the communication key. 7. The communication method according to claim 6, wherein the step of encrypting the communication data according to the encryption key in the communication key comprises: Obtaining the encryption key from target mapping relationship information according to the namespace address of the local container and the network card address of the local container, wherein the target mapping relationship information includes the namespace address of the container, the network card address of the container, and the encryption key and decryption key corresponding to the namespace address and the network card address of the container; In the process of encapsulating the data segment portion of the communication data on the network protocol stack of the local container, the data segment portion of the communication data is encrypted using the encryption key. 8. The communication method according to claim 7, wherein the decrypting the communication data according to the encryption key in the communication key comprises: Acquire the decryption key from the target mapping relationship information according to the namespace address of the local container and the network card address of the local container; In the process of decrypting the data segment portion of the communication data on the network protocol stack of the local container, the data segment portion of the communication data is decrypted using the decryption key. 9. The communication method according to claim 1, characterized in that the configuration rules are created through interface operation. 10. The communication method according to claim 1, characterized in that the method further comprises: If the service node determines that the configuration rule is updated, the virtual network card pair between the virtual network bridge of the service node and the local container is deleted according to the updated configuration rule, or a new virtual network card pair is established for the virtual network bridge. 11. The communication method according to claim 1, characterized in that the method further comprises: The configuration rules are converted into commands by protocol conversion. 12. A service node, characterized in that the service node comprises: The security network domain controller obtains a configuration rule; the configuration rule is used to instruct to build a security network domain for at least two target containers, and the at least two target containers are deployed on different service nodes; A container executor, configured to create a virtual network card pair between the virtual network bridge of the service node and the local container based on the configuration rule, and establish a connection between the virtual network bridge and the local container through the virtual network card pair; The container executor is further used to create a virtual network between the service node and other service nodes based on the configuration rule; the other service nodes are service nodes corresponding to other target containers other than the local container in the at least two target containers, and the local container is a container deployed on the service node in the at least two target containers; a secure network domain executor, configured to encrypt and decrypt communication data of the local container on a network protocol stack of the local container using a communication key of the secure network domain when the local container performs network communication with the other target container based on the virtual network card pair and the virtual network, wherein the other target container is a container deployed on the other service node among the at least two target containers; The container executor is further used to parse the configuration rule and obtain the network key; The service node broadcasts a data packet through a communication network card of the service node, wherein the data includes the network key; receiving a connection request initiated by another service node to the service node based on the broadcast, wherein the connection request carries a connection key; If the service node successfully verifies the connection key according to the network key, the virtual network is established based on the connection between the service node and the other service nodes.