File tamper-proofing method and device in container environment

Abstract

The invention relates to the technical field of network security, in particular to a file tamper-proofing method and device in a container environment. The method comprises the steps of: obtaining a file modification request initiated by a process, wherein the file modification request at least comprises name space information of the process and a file name or file path information corresponding to a to-be-modified file; calculating a container instance identifier corresponding to a container instance to which the process belongs according to the name space information, a preset container instance identifier calculation algorithm and a corresponding relationship between each piece of name space information and the container instance identifier; searching a file protection strategy corresponding to the container instance according to the container instance identifier; and according to the file protection strategy and the file path, determining whether to prevent the process from modifying the to-be-modified file. In this way, the accuracy of file tamper-proofing detection in the multi-container instance environment can be improved.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular, to a method and device for preventing file tampering in a container environment. Background technique [0002] At present, with the development of container technology, business containerization is widely used in various scenarios, for example, it can be applied to public cloud, private cloud and other services. In order to ensure the security of the container file, it is necessary to prevent the container file from being tampered with. Therefore, how to detect the tamper resistance of the file in the container environment of the Linux operating system has become an urgent problem to be solved. [0003] In the related art, when it is necessary to determine whether to allow a process to modify a file, a kernel event triggering mechanism can be used to realize it. For example, HOOK processing is performed on system call functions related to I / O access of the o...

AI Technical Summary

Problems solved by technology

[0004] However, when using this method in related technologies to detect file tampering, if multiple (two or more) container instances are running simultaneously in the same host environment, and any two container instances have the same protection directory or protected files but each has different access permissions. When any application in any container instance initiates an access request to the protected directory or protected file, the system cannot determine which container the process that initiated the file access request comes from, and cannot It is impossible to determine whether the process has an access request for the protected file, which will reduce the accuracy of file tamper detection

Images