Container cloud safety protection method and system constructed on basis of Kubernetes

Abstract

The invention discloses a container cloud safety protection method and system constructed on basis of Kubernetes. The method comprises the steps of: adding a safety protection system into a Kubernetescontainer cloud, and when clients access microservices on the container cloud, by the protection system, firstly carrying out first traffic cleaning of a transmission layer on a request; then forwarding to an application layer protection system to carry out second traffic cleaning, and forwarding traffic after cleaning to the corresponding microservices; and simultaneously collecting all access logs, then identifying abnormal access behaviors and attack sources by intelligent analysis on the logs, generating a protection strategy, issuing the protection strategy to a protection subsystem, intercepting attacks and completing third traffic cleaning. The container cloud safety protection method and system implement: 1, a deep protection system of an IP layer, the transmission layer and an application layer; 2, intelligent generation and issuing of the protection strategy and linkage of the protection strategy with the protection system; and 3, containerization of safety components and the advantages of rapid deployment, easiness for expansion, easiness for operation and maintenance and the like. The container cloud safety protection method and system are applicable to safety protection of the microservices on the Kubernetes container cloud.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a security protection method and system for a container cloud built on the basis of Kubernetes. Background technique [0002] Based on the container cloud built on Kubernetes, the system itself provides three authentication methods: CA authentication, Token authentication and Base authentication to protect the system itself from attacks and ensure the security of system components, but for the microservices deployed in the container cloud The protection does not work. If the attack only launches a traffic attack or other penetration attack against one or more of these microservices, the existing security technology of the Kubernetes cluster cannot detect and intercept the attack. It is easy for the attacker to Just bypass the existing security policies to carry out various attacks on the system, paralyze the cluster services, and fail to provide normal micros...

AI Technical Summary

Problems solved by technology

[0002] Based on the container cloud built on Kubernetes, the system itself provides three authentication methods: CA authentication, Token authentication and Base authentication to protect the system itself from attacks and ensure the security of system components, but for the microservices deployed in the container cloud The protection does not work. If the attack only launches a traffic attack or other penetration attack against one or more of these microservices, the existing security technology of the Kubernetes cluster cannot detect and intercept the attack. It is easy for the attacker to Just bypass the existing security policies to carry out various attacks on the system, paralyze the cluster services, and fail to provide normal microservices. This is also where the container cloud built by Kubernetes is insufficient.

Images