CN115664797A - Information transmission method, device, equipment and storage medium - Google Patents

Abstract

The disclosure provides an information transmission method, device, equipment and storage medium, and relates to the field of network technology and security. The method is applied to the container management module, and the method includes: receiving the encryption and decryption policy and the data interception rule sent by the user equipment; the data interception rule includes the identification of the container, and generating an eBPF attachment module according to the encryption and decryption policy and the data interception rule, so that the eBPF attachment module Determine the container to be intercepted according to the identifier of the container, and encrypt and decrypt the transmission information of the intercepted container according to the encryption and decryption strategy. The present disclosure overcomes, at least to a certain extent, the problem that the transmitted information is difficult to be encrypted during the current information transmission process of the container or virtual machine, resulting in low security of the transmitted information.

Description

Information transmission method, device, equipment and storage medium

technical field

The present disclosure relates to the field of network technology and security, and in particular to an information transmission method, device, equipment and storage medium.

Background technique

With the development of the times, the quality of the network continues to improve. With the improvement of network quality, cloud technology has gradually become an important part of people's daily life.

In the process of cloud technology application, since the kernel cannot perceive the container or virtual machine, it will make it difficult for the kernel to process the container or virtual machine to which it belongs. Moreover, since the kernel usually corresponds to multiple containers or virtual machines, different containers and virtual machines will transmit a large amount of information, which makes it difficult for the kernel to manage a large amount of information, and it is also difficult for the container and the virtual machine itself to transmit This makes it difficult to encrypt the information transmitted by the current container or virtual machine, and the security is low.

Contents of the invention

The present disclosure provides an information transmission method, device, device, and storage medium, at least to a certain extent, overcoming the difficulty in encrypting the transmitted information in the process of transmitting information in the current container or virtual machine, resulting in the information security of the transmission lower question.

Other features and advantages of the present disclosure will become apparent from the following detailed description, or in part, be learned by practice of the present disclosure.

According to an aspect of the present disclosure, there is provided an information transmission method, which is applied to a container management module, and the method includes:

Receive the encryption and decryption policies and data interception rules sent by the user equipment; the data interception rules include the identification of the container;

The eBPF attachment module is generated according to the encryption and decryption policy and data interception rules, so that the eBPF attachment module determines the container to be intercepted according to the identity of the container, and encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption policy.

In an embodiment of the present disclosure, before receiving the encryption and decryption policies and data interception rules sent by the user equipment, the method further includes:

Receive a container creation request sent by the user device;

Create a container according to the create container request;

Create an encryption policy controller;

Get the container ID of the created container;

The container identification is sent to the encryption policy controller, so that the encryption policy controller sends the container identification to the user equipment.

In an embodiment of the present disclosure, receiving the encryption and decryption policies and data interception rules sent by the user equipment includes:

Receive the encryption and decryption policies and data interception rules sent by the encryption policy controller. The encryption and decryption policies and data interception rules are generated by the encryption policy controller according to the container identifier and the security association, security policy and corresponding relationship sent by the user device; the corresponding relationship includes security The correspondence between associations and container IDs, and the correspondence between security policies and container IDs.

According to another aspect of the present disclosure, an information transmission method is provided, which is applied to a user equipment, and the method includes:

Send the encryption and decryption policy and data interception rules to the container management module; the data interception rules include the identification of the container, so that the container management module generates an eBPF attachment module according to the encryption and decryption policy and data interception rules, and the eBPF attachment module determines to be intercepted according to the identification of the container container, and encrypt and decrypt the transmission information of the intercepted container according to the encryption and decryption strategy.

In one embodiment of the present disclosure, the method also includes:

Send a container creation request to the container management module, so that the container management module creates a container and creates an encryption policy controller;

Receive the container identifier forwarded by the user equipment according to the encryption policy controller.

In one embodiment of the present disclosure, the encryption and decryption policy and data interception rules are sent to the container management module, including:

Generate security associations and security policies based on container identifiers;

Send the security association, security policy and corresponding relationship to the encryption policy controller, so that the encryption policy controller generates encryption and decryption policies and data interception rules according to the container identifier and the security association, security policy and corresponding relationship sent by the user equipment.

According to another aspect of the present disclosure, an information transmission device is provided, which is applied to a container management module, and the device includes:

The first receiving module is used to receive the encryption and decryption policy and data interception rules sent by the user equipment; the data interception rules include the identification of the container;

The generation module is used to generate the eBPF attachment module according to the encryption and decryption policy and data interception rules, so that the eBPF attachment module determines the container to be intercepted according to the container identification, and encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption policy.

In one embodiment of the present disclosure, the device further includes:

The second receiving module is used to receive the container creation request sent by the user equipment before receiving the encryption and decryption policy and the data interception rules sent by the user equipment;

A first creation module, configured to create a container according to a container creation request;

The second creation module is used to create an encryption policy controller;

The acquisition module is used to obtain the container ID of the created container;

The second sending module is configured to send the container ID to the encryption policy controller, so that the encryption policy controller sends the container ID to the user equipment.

In one embodiment of the present disclosure, the first receiving module includes:

The receiving unit is configured to receive the encryption and decryption policies and data interception rules sent by the encryption policy controller. The encryption and decryption policies and data interception rules are generated by the encryption policy controller according to the container identifier and the security association, security policy and corresponding relationship sent by the user equipment ; The corresponding relationship includes the corresponding relationship between the security association and the container ID, and the corresponding relationship between the security policy and the container ID.

According to yet another aspect of the present disclosure, an information transmission device is provided, which is applied to a user equipment, and the device includes:

The first sending module is used to send the encryption and decryption policy and the data interception rule to the container management module; the data interception rule includes the identification of the container, so that the container management module generates an eBPF attachment module according to the encryption and decryption policy and the data interception rule, and the eBPF attachment module Determine the container to be intercepted according to the identifier of the container, and encrypt and decrypt the transmission information of the intercepted container according to the encryption and decryption strategy.

In one embodiment of the present disclosure, the device further includes:

The third sending module is configured to send a container creation request to the container management module, so that the container management module creates a container and creates an encryption policy controller;

The third receiving module is configured to receive the container identifier forwarded by the user equipment according to the encryption policy controller.

In one embodiment of the present disclosure, the first sending module includes:

a generating unit, configured to generate a security association and a security policy according to the container identifier;

The sending unit is configured to send the security association, the security policy, and the corresponding relationship to the encryption policy controller, so that the encryption policy controller generates an encryption and decryption policy and data interception according to the container identifier and the security association, security policy, and corresponding relationship sent by the user equipment rule.

According to another aspect of the present disclosure, there is provided an electronic device, including: a processor; and a memory for storing executable instructions of the processor; wherein, the processor is configured to execute the above information transmission method by executing the executable instructions .

According to yet another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the above information transmission method is implemented.

The information transmission method provided by the embodiments of the present disclosure receives the encryption policy and data interception rules sent by the user equipment, and then generates an eBPF attachment module according to the encryption policy and data interception rules, and the eBPF attachment module determines the to-be-intercepted The container encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption strategy. According to the generated eBPF attachment module, the information transmitted by the container is encrypted and decrypted, which avoids the problem that the container management module cannot perceive the container, and it is difficult for the container to encrypt and decrypt the transmitted information by itself. Security of Information Transmitted.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure.

Description of drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the disclosure and together with the description serve to explain the principles of the disclosure. Apparently, the drawings in the following description are only some embodiments of the present disclosure, and those skilled in the art can obtain other drawings according to these drawings without creative efforts.

FIG. 1 shows a schematic diagram of the structure of an information transmission system in an embodiment of the present disclosure;

FIG. 2 shows a flowchart of an information transmission method in an embodiment of the present disclosure;

FIG. 3 shows a flowchart of another information transmission method in an embodiment of the present disclosure;

FIG. 4 shows a flowchart of another information transmission method in an embodiment of the present disclosure;

FIG. 5 shows a flowchart of another information transmission method in an embodiment of the present disclosure;

FIG. 6 shows a schematic diagram of an information transmission device in an embodiment of the present disclosure;

FIG. 7 shows a schematic diagram of another information transmission device in an embodiment of the present disclosure; and

Fig. 8 shows a structural block diagram of an electronic device in an embodiment of the present disclosure.

Detailed ways

Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments may, however, be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concept of example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

Furthermore, the drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus repeated descriptions thereof will be omitted. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, or in one or more hardware modules or integrated circuits, or in different network and/or processor means and/or microcontroller means.

It should be understood that the various steps described in the method implementations of the present disclosure may be executed in different orders, and/or executed in parallel. Additionally, method embodiments may include additional steps and/or omit performing illustrated steps. The scope of the present disclosure is not limited in this regard.

It should be noted that concepts such as "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the sequence of functions performed by these devices, modules or units or interdependence.

It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative and not restrictive, and those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more" multiple".

In order to solve the above problems, embodiments of the present disclosure provide an information transmission method, device, device, and storage medium.

For ease of understanding, the embodiments of the present disclosure first introduce an information transmission system.

Fig. 1 shows an architecture diagram of an information transmission system in an embodiment of the present disclosure.

As shown in Figure 1, the information transmission system 10 may include:

container management module 102 and user equipment 104;

The user equipment 104 is used to send the encryption and decryption policy and data interception rules to the container management module 102;

The container management module 102 is configured to generate an eBPF attachment module according to the encryption and decryption policy and data interception rules, so that the eBPF attachment module determines the container to be intercepted according to the identifier of the container, and encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption policy .

In an embodiment, the user equipment may be a terminal equipment.

Terminal devices may be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, wearable devices, augmented reality devices, virtual reality devices, and the like.

Optionally, clients of application programs installed in different terminal devices are the same, or clients of the same type of application programs based on different operating systems. Based on different terminal platforms, the specific form of the client of the application program may also be different, for example, the client of the application program may be a mobile phone client, a PC client, and the like.

In one embodiment, the application management module can be configured on a server.

The server may be a server that provides various services, such as a background management server that provides support for devices operated by users using terminal equipment. The background management server can analyze and process the received data such as requests, and feed back the processing results to the terminal device.

Optionally, the server can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, and can also provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, Cloud servers for basic cloud computing services such as cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network, content distribution network), and big data and artificial intelligence platforms. The terminal may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal and the server may be connected directly or indirectly through wired or wireless communication, which is not limited in this application.

In an embodiment, the medium used by the network to provide a communication link between the terminal device and the server may be a wired network or a wireless network.

Optionally, the aforementioned wireless network or wired network uses standard communication technologies and/or protocols. The network is usually the Internet, but can be any network, including but not limited to Local Area Network (LAN), Metropolitan Area Network (MAN), Wide Area Network (WAN), mobile, wired or wireless network, private network, or any combination of virtual private networks). In some embodiments, data exchanged over a network is represented using technologies and/or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), and the like. In addition, conventional methods such as Secure Socket Layer (Secure Socket Layer, SSL), Transport Layer Security (Transport Layer Security, TLS), Virtual Private Network (Virtual Private Network, VPN), Internet Protocol Security (Internet Protocol Security, IPsec) can also be used. Encryption technology to encrypt all or some links. In some other embodiments, customized and/or dedicated data communication technologies may also be used to replace or supplement the above data communication technologies.

Those skilled in the art may know that the numbers of terminal devices, networks and servers in FIG. 1 are only illustrative, and there may be any number of terminal devices, networks and servers according to actual needs. The embodiment of the present disclosure does not limit this.

The exemplary implementation manner will be described in detail below in conjunction with the accompanying drawings and embodiments.

First, an information transmission method is provided in an embodiment of the present disclosure, which is applied to a container management module, and the method can be executed by any electronic device capable of computing and processing.

Fig. 2 shows a flow chart of an information transmission method in an embodiment of the present disclosure. As shown in Fig. 1, the information transmission method provided in an embodiment of the present disclosure includes the following steps:

Step S202, receiving the encryption and decryption policy and the data interception rules sent by the user equipment; the data interception rules include the identifier of the container.

In one embodiment, the container management module may include a kernel for managing containers.

In one embodiment, a container may include a Pod or a Service.

The identifier of the container may include an identifier of an interface or port of the container, and the identifier of the container may also include an IP address of the container.

In an embodiment, receiving the encryption and decryption policies and data interception rules sent by the user equipment may include:

Receive the encryption and decryption policies and data interception rules sent by the encryption policy controller. The encryption and decryption policies and data interception rules are generated by the encryption policy controller according to the container identifier and the security association, security policy and corresponding relationship sent by the user device; the corresponding relationship includes security The correspondence between associations and container IDs, and the correspondence between security policies and container IDs.

In an embodiment, the user equipment may determine the corresponding relationship between the security association and the container ID, and the corresponding relationship between the security policy and the container ID according to the security association, the security policy, and the acquired container ID.

After the above correspondence is determined, the user equipment may send the above correspondence, the security policy, and the security association to the encryption policy controller. The encryption policy controller generates encryption policies and data interception rules according to the correspondence, security policies, and security associations.

After the encryption policy controller generates the encryption policy and the data interception rule, the generated encryption policy and the data interception rule may be sent to the container management module.

In one embodiment, the encryption policy controller may first send the encryption policy and data interception rules to the bytecode generator, and the bytecode generator generates the above-mentioned encryption policy and data interception rules into an assembly that can be recognized by the container management module language, and then send the above assembly language to the container management module.

It should be noted that the encryption policy controller can be configured on the container management module,

Step S204, generate an eBPF attachment module according to the encryption and decryption policy and data interception rules, so that the eBPF attachment module determines the container to be intercepted according to the container identifier, and encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption policy.

In one embodiment, the eBPF attachment module can call the container management module to intercept the container.

In one embodiment, the eBPF attach module can perform data transmission with the user equipment in real time.

In one embodiment, the user equipment can send the updated encryption and decryption policy and data interception rules to the eBPF attachment module, and the eBPF attachment module intercepts the data packets transmitted by the container according to the updated encryption and decryption policies and data interception rules and Perform encryption and decryption operations.

FIG. 3 shows a flow chart of another information transmission method in the embodiment of the disclosure. As shown in 3, the information transmission method provided in the embodiment of the disclosure includes the following steps:

S302. Receive a container creation request sent by the user equipment.

In one embodiment, the user equipment may directly send a container creation request to the container management module.

S304. Create a container according to the container creation request.

S306. Create an encryption policy controller.

In one embodiment, the present disclosure does not limit the sequence of creating the container and creating the encryption policy controller.

S308. Obtain the container identifier of the created container.

In one embodiment, the identifier of the container may include the name of the container or the identifier of the port of the container.

S310. Send the container identifier to the encryption policy controller, so that the encryption policy controller sends the container identifier to the user equipment.

In an embodiment, the encryption policy controller may not send the above-mentioned container ID to the user equipment, but directly generates encryption and decryption according to the security association, security policy, and user ID after receiving the security association and security policy sent by the user equipment. Policies and data blocking rules.

In one embodiment, after receiving the security association and the security policy sent by the user equipment, the encryption policy controller can send the security association, the security policy, and the identifier of the container to the bytecode generator, and the bytecode generator encodes the and then sent to the container management module.

In the embodiment of the present disclosure, the container management module receives the container creation request sent by the user equipment, creates a container according to the container creation request, and then creates an encryption policy controller, and the encryption policy controller forwards the container identifier to the user equipment, so that the user equipment Generate encryption and decryption policies and data interception rules based on container identifiers. Generating encryption and decryption policies and data interception rules based on container identifiers can make container interception more accurate during the process of intercepting containers.

Based on the same inventive concept, another information transmission method is provided in the embodiments of the present disclosure, which is applied to a user equipment, and the method can be executed by any electronic device with computing and processing capabilities.

FIG. 4 shows a flowchart of another information transmission method in the embodiment of the present disclosure. As shown in 4, the information transmission method provided in the embodiment of the present disclosure includes the following steps:

S402, sending the encryption and decryption policy and the data interception rule to the container management module; the data interception rule includes the identification of the container, so that the container management module generates an eBPF attachment module according to the encryption and decryption policy and the data interception rule, which is determined by the eBPF attachment module according to the identification of the container The container to be intercepted, and the transmission information of the intercepted container is encrypted and decrypted according to the encryption and decryption strategy.

In one embodiment, the encryption and decryption policy and data interception rules are sent to the container management module, including:

Generate security associations and security policies based on container identifiers;

Send the security association, security policy and corresponding relationship to the encryption policy controller, so that the encryption policy controller generates encryption and decryption policies and data interception rules according to the container identifier and the security association, security policy and corresponding relationship sent by the user equipment.

In one embodiment, the above-mentioned steps have been described in detail in the above-mentioned embodiments, and details are not repeated here.

The information transmission method provided by the embodiments of the present disclosure receives the encryption policy and data interception rules sent by the user equipment, and then generates an eBPF attachment module according to the encryption policy and data interception rules, and the eBPF attachment module determines the to-be-intercepted The container encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption strategy. According to the generated eBPF attachment module, the information transmitted by the container is encrypted and decrypted, which avoids the problem that the container management module cannot perceive the container, and it is difficult for the container to encrypt and decrypt the transmitted information by itself. Security of Information Transmitted.

Based on the same inventive concept, another information transmission method is provided in the embodiments of the present disclosure, which is applied to a user equipment, and the method can be executed by any electronic device with computing and processing capabilities.

Fig. 5 shows a flowchart of another information transmission method in the embodiment of the present disclosure. As shown in Fig. 5, the information transmission method provided in the embodiment of the present disclosure includes the following steps:

S502. Send a container creation request to the container management module, so that the container management module creates a container and creates an encryption policy controller;

S504. Receive the container identifier forwarded by the user equipment according to the encryption policy controller.

In one embodiment, the above-mentioned steps have been described in detail in the above-mentioned embodiments, and details are not repeated here.

In the embodiment of the present disclosure, the container management module receives the container creation request sent by the user equipment, creates a container according to the container creation request, and then creates an encryption policy controller, and the encryption policy controller forwards the container identifier to the user equipment, so that the user equipment Generate encryption and decryption policies and data interception rules based on container identifiers. Generating encryption and decryption policies and data interception rules based on container identifiers can make container interception more accurate during the process of intercepting containers.

Based on the same inventive concept, embodiments of the present disclosure also provide an information transmission device, such as the following embodiments. Since the problem-solving principle of this device embodiment is similar to that of the above-mentioned method embodiment, the implementation of this device embodiment can refer to the implementation of the above-mentioned method embodiment, and repeated descriptions will not be repeated.

FIG. 6 shows a schematic diagram of an information transmission device in an embodiment of the present disclosure. As shown in FIG. 6, the information transmission device 600 includes:

The first receiving module 602 is configured to receive the encryption and decryption policy and data interception rules sent by the user equipment; the data interception rules include the identification of the container;

The generating module 604 is configured to generate an eBPF attachment module according to the encryption and decryption policy and data interception rules, so that the eBPF attachment module determines the container to be intercepted according to the container identifier, and encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption policy.

The information transmission device provided by the embodiments of the present disclosure receives the encryption policy and data interception rules sent by the user equipment, and then generates an eBPF attachment module according to the encryption policy and data interception rules, and the eBPF attachment module determines the to-be-intercepted The container encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption strategy. According to the generated eBPF attachment module, the information transmitted by the container is encrypted and decrypted, which avoids the problem that the container management module cannot perceive the container, and it is difficult for the container to encrypt and decrypt the transmitted information by itself. Security of Information Transmitted.

In one embodiment of the present disclosure, the device further includes:

The second receiving module is used to receive the container creation request sent by the user equipment before receiving the encryption and decryption policy and the data interception rules sent by the user equipment;

A first creation module, configured to create a container according to a container creation request;

The second creation module is used to create an encryption policy controller;

The acquisition module is used to obtain the container ID of the created container;

The second sending module is configured to send the container ID to the encryption policy controller, so that the encryption policy controller sends the container ID to the user equipment.

In one embodiment of the present disclosure, the first receiving module includes:

The receiving unit is configured to receive the encryption and decryption policies and data interception rules sent by the encryption policy controller. The encryption and decryption policies and data interception rules are generated by the encryption policy controller according to the container identifier and the security association, security policy and corresponding relationship sent by the user equipment ; The corresponding relationship includes the corresponding relationship between the security association and the container ID, and the corresponding relationship between the security policy and the container ID.

In the embodiment of the present disclosure, the container management module receives the container creation request sent by the user equipment, creates a container according to the container creation request, and then creates an encryption policy controller, and the encryption policy controller forwards the container identifier to the user equipment, so that the user equipment Generate encryption and decryption policies and data interception rules based on container identifiers. Generating encryption and decryption policies and data interception rules based on container identifiers can make container interception more accurate during the process of intercepting containers.

FIG. 7 shows a schematic diagram of another information transmission device in an embodiment of the present disclosure. As shown in FIG. 7, the information transmission device 700 includes:

The first sending module 702 is used to send the encryption and decryption policy and data interception rules to the container management module; the data interception rules include the identification of the container, so that the container management module generates an eBPF attachment module according to the encryption and decryption policy and the data interception rules, and is attached by eBPF The module determines the container to be intercepted according to the identification of the container, and encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption strategy.

The information transmission device provided by the embodiments of the present disclosure receives the encryption policy and data interception rules sent by the user equipment, and then generates an eBPF attachment module according to the encryption policy and data interception rules, and the eBPF attachment module determines the to-be-intercepted The container encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption strategy. According to the generated eBPF attachment module, the information transmitted by the container is encrypted and decrypted, which avoids the problem that the container management module cannot perceive the container, and it is difficult for the container to encrypt and decrypt the transmitted information by itself. Security of Information Transmitted.

In one embodiment of the present disclosure, the device further includes:

The third sending module is configured to send a container creation request to the container management module, so that the container management module creates a container and creates an encryption policy controller;

The third receiving module is configured to receive the container identifier forwarded by the user equipment according to the encryption policy controller.

In one embodiment of the present disclosure, the first sending module includes:

a generating unit, configured to generate a security association and a security policy according to the container identifier;

The sending unit is configured to send the security association, the security policy, and the corresponding relationship to the encryption policy controller, so that the encryption policy controller generates an encryption and decryption policy and data interception according to the container identifier and the security association, security policy, and corresponding relationship sent by the user equipment rule.

In the embodiment of the present disclosure, the container management module receives the container creation request sent by the user equipment, creates a container according to the container creation request, and then creates an encryption policy controller, and the encryption policy controller forwards the container identifier to the user equipment, so that the user equipment Generate encryption and decryption policies and data interception rules based on container identifiers. Generating encryption and decryption policies and data interception rules based on container identifiers can make container interception more accurate during the process of intercepting containers.

Those skilled in the art can understand that various aspects of the present disclosure can be implemented as a system, method or program product. Therefore, various aspects of the present disclosure can be embodied in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which can be collectively referred to herein as "circuit", "module" or "system".

An electronic device 800 according to this embodiment of the present disclosure is described below with reference to FIG. 8 . The electronic device 800 shown in FIG. 8 is only an example, and should not limit the functions and application scope of the embodiments of the present disclosure.

As shown in FIG. 8, electronic device 800 takes the form of a general-purpose computing device. Components of the electronic device 800 may include but not limited to: at least one processing unit 810 , at least one storage unit 820 , and a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810 ).

Wherein, the storage unit stores program codes, and the program codes can be executed by the processing unit 810, so that the processing unit 810 executes the steps according to various exemplary embodiments of the present disclosure described in the "Exemplary Method" section of this specification. For example, the processing unit 810 may perform the following steps in the foregoing method embodiments:

Receive the encryption and decryption policies and data interception rules sent by the user equipment; the data interception rules include the identification of the container;

The eBPF attachment module is generated according to the encryption and decryption policy and data interception rules, so that the eBPF attachment module determines the container to be intercepted according to the identity of the container, and encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption policy.

The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 8201 and/or a cache storage unit 8202 , and may further include a read-only storage unit (ROM) 8203 .

Storage unit 820 may also include programs/utilities 8204 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, Implementations of networked environments may be included in each or some combination of these examples.

Bus 830 may represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local area using any of a variety of bus structures. bus.

The electronic device 800 can also communicate with one or more external devices 840 (such as keyboards, pointing devices, Bluetooth devices, etc.), and can also communicate with one or more devices that enable the user to interact with the electronic device 800, and/or communicate with Any device (eg, router, modem, etc.) that enables the electronic device 800 to communicate with one or more other computing devices. Such communication may occur through input/output (I/O) interface 850 . Moreover, the electronic device 800 can also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN) and/or a public network such as the Internet) through the network adapter 860 . As shown, network adapter 860 communicates with other modules of electronic device 800 via bus 830 . It should be appreciated that although not shown, other hardware and/or software modules may be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage system, etc.

Through the description of the above implementations, those skilled in the art can easily understand that the example implementations described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of software products, and the software products can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to make a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) execute the method according to the embodiments of the present disclosure.

In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, and the computer-readable storage medium may be a readable signal medium or a readable storage medium. A program product capable of realizing the above-mentioned methods of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure can also be implemented in the form of a program product, which includes program code. When the program product runs on the terminal device, the program code is used to make the terminal device execute the above-mentioned Steps according to various exemplary embodiments of the present disclosure described in the "Exemplary Methods" section.

More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), Erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

In the present disclosure, a computer-readable storage medium may include a data signal carrying readable program code in baseband or as part of a carrier wave traveling as a data signal. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device.

Alternatively, program code contained on a computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, cable, optical cable, RF, etc., or any suitable combination of the above.

During specific implementation, the program code for performing the operations of the present disclosure can be written in any combination of one or more programming languages, and the programming language includes an object-oriented programming language—such as Java, C++, etc., and also includes conventional A procedural programming language—such as "C" or a similar programming language. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server to execute. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider). business to connect via the Internet).

It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. Actually, according to the embodiment of the present disclosure, the features and functions of two or more modules or units described above may be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided to be embodied by a plurality of modules or units.

In addition, although steps of the methods of the present disclosure are depicted in the drawings in a particular order, there is no requirement or implication that the steps must be performed in that particular order, or that all illustrated steps must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step for execution, and/or one step may be decomposed into multiple steps for execution, etc.

Through the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of software products, and the software products can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to make a computing device (which may be a personal computer, a server, a mobile terminal, or a network device, etc.) execute the method according to the embodiments of the present disclosure.

Other embodiments of the present disclosure will be readily apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. The present disclosure is intended to cover any modification, use or adaptation of the present disclosure. These modifications, uses or adaptations follow the general principles of the present disclosure and include common knowledge or conventional technical means in the technical field not disclosed in the present disclosure. . The specification and examples are to be considered exemplary only, with the true scope and spirit of the disclosure indicated by the appended claims.

Claims (10)

1. An information transmission method is applied to a container management module, and the method comprises the following steps:

receiving an encryption and decryption strategy and a data interception rule sent by user equipment; the data interception rule comprises an identification of a container;

and generating an eBPF attachment module according to the encryption and decryption strategy and the data interception rule so that the eBPF attachment module determines a container to be intercepted according to the identifier of the container and encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption strategy.

2. The information transmission method according to claim 1, wherein before receiving the encryption and decryption policy and the data interception rule sent by the user equipment, the method further comprises:

receiving a container creating request sent by user equipment;

creating a container according to the container creating request;

creating an encryption policy controller;

acquiring a container identifier of the created container;

and sending the container identifier to the encryption policy controller so that the encryption policy controller sends the container identifier to the user equipment.

3. The information transmission method according to claim 1, wherein the receiving the encryption/decryption policy and the data interception rule sent by the user equipment includes:

receiving an encryption and decryption policy and the data interception rule sent by an encryption policy controller, wherein the encryption and decryption policy and the data interception rule are generated by the encryption policy controller according to the container identifier and the security association, the security policy and the corresponding relation sent by the user equipment; the corresponding relation comprises the corresponding relation between the security association and the container identifier and the corresponding relation between the security policy and the container identifier.

4. An information transmission method is applied to user equipment, and the method comprises the following steps:

sending an encryption and decryption strategy and a data interception rule to a container management module; the data interception rule comprises an identifier of a container, so that the container management module generates an eBPF attachment module according to the encryption and decryption strategy and the data interception rule, the eBPF attachment module determines the container to be intercepted according to the identifier of the container, and the transmission information of the intercepted container is encrypted and decrypted according to the encryption and decryption strategy.

5. The information transmission method according to claim 4, wherein the method further comprises:

sending a create container request to the container management module to cause the container management module to create a container and create an encryption policy controller;

and receiving the container identifier forwarded by the user equipment according to the encryption policy controller.

6. The information transmission method according to claim 5, wherein the sending the encryption and decryption policy and the data interception rule to the container management module includes:

generating security association and security policy according to the container identifier;

and sending the security association, the security policy and the corresponding relation to the encryption policy controller, so that the encryption policy controller generates the encryption and decryption policy and the data interception rule according to the container identifier and the security association, the security policy and the corresponding relation sent by the user equipment.

7. An information transmission device, applied to a container management module, the device comprising:

the first receiving module is used for receiving an encryption and decryption strategy and a data interception rule sent by user equipment; the data interception rule comprises an identification of a container;

and the generating module is used for generating an eBPF attachment module according to the encryption and decryption strategy and the data interception rule so that the eBPF attachment module determines the container to be intercepted according to the identifier of the container and encrypts and decrypts the transmission information of the intercepted container according to the encryption and decryption strategy.

8. An information transmission apparatus, applied to a user equipment, the apparatus comprising:

the first sending module is used for sending the encryption and decryption strategy and the data interception rule to the container management module; the data interception rule comprises an identifier of a container, so that the container management module generates an eBPF attachment module according to the encryption and decryption strategy and the data interception rule, the eBPF attachment module determines the container to be intercepted according to the identifier of the container, and the transmission information of the intercepted container is encrypted and decrypted according to the encryption and decryption strategy.

9. An electronic device, comprising:

a processor; and

a memory for storing executable instructions of the processor;

wherein the processor is configured to perform the information transmission method of any one of claims 1 to 6 via execution of the executable instructions.

10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the information transmission method according to any one of claims 1 to 6.

Images