Method for dynamically creating simulation environment based on container technology

Abstract

The invention relates to the technical field of information security, in particular to a method for dynamically creating a simulation environment based on a container technology. According to the invention, remote connection, configuration and dynamic management of the Docker can be realized, the tedious operation of managing and creating the Docker container by manually inputting a command line is reduced, and a drilling simulation environment can be quickly established according to actual needs to improve the efficiency of drilling participants, so that the efficiency in drilling actual combat is improved. And therefore, more time can be saved to be put into subsequent working links.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for dynamically creating a simulation environment based on container technology. Background Art

[0002] With the rapid development of information technology and the increasing number of cybersecurity threats, attack and defense drills have become an important means to test and improve cybersecurity protection capabilities. In actual attack and defense drills, quickly building a simulated environment that is highly similar to the real environment is crucial to discovering potential security vulnerabilities, evaluating the effectiveness of defense strategies, and improving emergency response capabilities.

[0003] At present, in actual attack and defense drills, it is necessary to build the corresponding simulation environment in combination with the topology information provided by the drill unit. First, it is necessary to analyze the information contained in the topology map, and then create multiple containers distributed in different network segments in the LAN environment based on the analyzed information. This process often takes a long time and effort, but the time for a drill is often limited. If you want to achieve better actual combat results in a limited time, you need to find ways to compress the time of this process. However, currently, the simulation environment can only be built manually, which is inefficient and prone to errors, thus affecting the effect of the drill. Summary of the invention

[0004] The purpose of the present invention is to overcome the problems of the prior art and to propose a method for dynamically creating a simulation environment based on container technology. To achieve the above technical purpose, the technical solution of the present invention is as follows:

[0005] A method for dynamically creating a simulation environment based on container technology includes the following steps:

[0006] S1. Input of topology information

[0007] First, enter the network segment in the topology diagram; then enter the IP addresses, port numbers, names and other data corresponding to the multiple hosts in the topology diagram, and enter the IP address of the gateway corresponding to each host; generate the basic information required for the simulation environment in this exercise to facilitate subsequent queries;

[0008] S2. Basic configuration of Docker environment

[0009] Use Docker as the engine of the application container, perform a series of configurations of the Docker environment in the Linux environment, and enable Docker remote connection to lay the foundation for subsequent operations;

[0010] S3. Remote self-connection Docker

[0011] When connecting, enter the Docker IP address, port number, and Docker API version number, and the program will automatically test whether Docker can connect. If not, return to step S2 to reconfigure the Docker environment. If it can connect, proceed to the next step.

[0012] S4. Create a mirror

[0013] Create a read-only Docker template as an image, which contains all the content required to run the program;

[0014] S5. Create a network

[0015] Build different network segments that are isolated from each other, and then simulate different LAN environments in reality;

[0016] S6. Create a container

[0017] Package an application and its dependencies into a portable container, isolating the application from the underlying system.

[0018] As an improvement, the S2 step specifically includes the following steps:

[0019] S2-1. Prepare the server and download the Linux version of Docker;

[0020] S2-2. Create a corresponding Docker directory in the Linux environment, and then copy the downloaded resources to this directory;

[0021] S2-3. Unzip the compressed package and copy the unzipped Docker file to the / usr / bin / directory;

[0022] S2-4. Create the docker.service file to register docker as a service;

[0023] S2-5. Open the remote connection and expose the specified port as the Docker remote connection port;

[0024] S2-6. Add execution permissions to the docker.service file;

[0025] S2-7. Reload the configuration file. Every time you modify the docker.service file, you need to reload the configuration file.

[0026] S2-8. Start Docker and set it to start at boot;

[0027] S2-9. Check the Docker service status. If the status value is active, it means that Docker has been installed successfully.

[0028] As an improvement, the S4 step specifically includes the following steps:

[0029] S4-1. Image Pull

[0030] Since Centos7 is required to create a JDK image, pull Centos7 first; first call the image pull API interface, and complete the image pull by entering the image name and image version number;

[0031] S4-2. Image import

[0032] Import the JDK installation package into the corresponding DockerFile file; first, configure the JDK installation package path and JAVA environment path in the DockerFile file, and specify that it will be executed in the Centos7 environment; then, call the image import interface, upload the JDK installation package and the corresponding DockerFile file, and record the storage path of the DockerFile file to complete the image import;

[0033] S4-3. Create a mirror

[0034] Enter the image label and logo. The image label is the image name and image version number, and the image logo is the definition of the image details logo. The image logo can be customized.

[0035] Convert the tag data of the image into a key-value array, where the key is the image name and the value is the image version number; convert the flag data into a key-value array, where the key is a fixed value and the value is a custom flag name, as well as the path to the DockerFile file recorded in step S4-2, and then use the above data as input parameters for the image creation API interface to complete the image creation operation;

[0036] S4-4. Mirror View

[0037] You can view the created image list data through the image viewing API interface.

[0038] As an improvement, the S5 step is completed by calling the creation network API interface, which specifically includes the following steps:

[0039] First, query the gateway IP address and the specified subnet segment entered in step S1, then enter the name of the created network and the selected network driver mode; finally, call the create network API interface and pass in the above parameters to complete the creation of the network.

[0040] As an improvement, the network driver mode is a bridge mode, host, Container or none.

[0041] As an improvement, the step S6 specifically includes the following steps:

[0042] S6-1. Enter the port number of the container

[0043] The port number of the container is used to establish a port mapping with the host port number entered in step S1. If the container port number is not entered, it is assumed to be consistent with the host port number entered in step S1.

[0044] S6-2. Enter the mount path

[0045] The mount path includes the host path and the container path, which are used to map the path from the host to the virtual machine.

[0046] S6-3. Enter the container name

[0047] S6-4. Select the image name created in step S4 and create a corresponding container for the image;

[0048] S6-5. Select the network name created in step S5 and configure the corresponding network environment for the container;

[0049] S6-6. Input container environment;

[0050] This step is optional. For example, you need to add a password when creating a container environment with MySQL.

[0051] S6-7. Configure whether to allow interactive input

[0052] Configure whether to allow interactive input. The parameter is of Boolean type. The default value is True, which means that the standard input stream can be attached from the container. At this time, the user can interact with the container; for example, Shell scripts can be run in the container; otherwise, interactive input is not allowed.

[0053] S6-8. Allocate pseudo terminal

[0054] Allocate a pseudo terminal. The parameter is of Boolean type and defaults to True. The function is to allocate a pseudo service to the container, that is, a process that is always running. The container will not exit at this time. If it is set to False, for example, after Centos is started,

[0055] If there is no process running in the container, the container will automatically exit;

[0056] S6-9. Use the above parameters as input parameters to call the container creation API interface to complete the container creation operation.

[0057] The present invention has the advantages that:

[0058] 1. The present invention can realize the remote connection, configuration and dynamic management of Docker, reduce the tedious operation of manually inputting command lines to manage and create Docker containers, and can quickly build a simulation environment for drills according to actual needs to improve the efficiency of drill participants, thereby improving the efficiency of actual drills, so as to save more time for subsequent work links.

[0059] 2. The present invention can realize the visual panel management of the simulation environment. After successfully connecting to Docker remotely, all containers on the server and the running status of the container can be viewed. The container can be started, stopped and deleted, and the details of the container and the log of the container can be viewed. The exercise participants can see the overall situation of the exercise simulation environment more intuitively, providing data support for the next decision.

[0060] 3. When creating a container, the present invention can flexibly add container environment information, so that the user can configure the environment required by the container according to the needs of the scene.

[0061] 4. The present invention can realize the rapid association of IP addresses and port numbers, network segments, and gateway IP addresses when creating operations such as networks and containers, that is, only the topology map data needs to be input once, and the subsequent operation of creating a network in the simulation scenario associated with this topology map in this exercise can realize the automatic association of the corresponding specified subnet network segment and gateway IP address data, and the port mapping required in the container creation operation can also realize the port number information entered by the user before checking, avoiding the problem of parameter errors that may occur when manually typing the command line, and improving the accuracy of the entire simulation process. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 This is a flow chart of the present invention when it is running.

[0063] Figure 2 A flowchart of the steps to create a container. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described in combination with the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. The components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0065] Example

[0066] This embodiment discloses a method for dynamically creating a simulation environment based on container technology. This method can dynamically operate Docker according to the topology map related data entered by the user, and dynamically build a simulation environment through a series of operations such as importing image files, creating networks, and creating containers, which reduces the tedious operations of configuring and managing Docker on the server and greatly improves the efficiency of building a simulation environment. Ultimately, it is possible to quickly create multiple LAN network environments that are isolated from each other, as well as containers containing different risk scenarios, so that the team can seize the initiative as soon as possible in actual drills.

[0067] The present invention specifically comprises the following steps:

[0068] S1. Input of topology information

[0069] First, enter the network segment in the topology diagram; then enter the IP addresses, port numbers, names and other data corresponding to the multiple hosts in the topology diagram, and enter the IP address of the gateway corresponding to each host. Generate the basic information required for the simulation environment in this exercise to facilitate subsequent queries.

[0070] S2. Basic configuration of Docker environment

[0071] Using Docker as the engine of the application container, perform a series of configurations of the Docker environment in the Linux environment, and enable Docker remote connection to lay the foundation for subsequent operations. The specific steps include the following:

[0072] S2-1. Prepare the server and download the Linux version of Docker;

[0073] S2-2. Create a corresponding Docker directory in the Linux environment, and then copy the downloaded resources to this directory;

[0074] S2-3. Unzip the compressed package and copy the unzipped Docker file to the / usr / bin / directory;

[0075] S2-4. Create the docker.service file to register docker as a service;

[0076] S2-5. Open the remote connection and expose the specified port as the Docker remote connection port;

[0077] S2-6. Add execution permissions to the docker.service file;

[0078] S2-7. Reload the configuration file. Every time you modify the docker.service file, you need to reload the configuration file.

[0079] S2-8. Start Docker and set it to start at boot;

[0080] S2-9. Check the Docker service status. If the status value is active, it means that Docker has been installed successfully.

[0081] S3. Remote self-connection Docker

[0082] When connecting, enter the Docker IP address, port number, and Docker API version number, and the program will automatically test whether Docker can connect. If it cannot connect, return to step S2 to reconfigure the Docker environment. If it can connect, proceed to the next step.

[0083] S4. Create a mirror

[0084] Create a read-only Docker template as an image, which contains all the content required to run the program.

[0085] This example takes the JDK image as an example to introduce the specific steps of creating an image:

[0086] S4-1. Image Pull

[0087] Since Centos7 is required to create a JDK image, pull Centos7 first. First call the image pull API interface, and complete the image pull by entering the image name and image version number.

[0088] S4-2. Image import

[0089] Import the JDK installation package into the corresponding DockerFile file. First, you need to configure the JDK installation package path and JAVA environment path in the DockerFile file, and specify that it will be executed in the Centos7 environment; then, call the image import interface, upload the JDK installation package and the corresponding DockerFile file, and record the storage path of the DockerFile file to complete the image import.

[0090] S4-3. Create a mirror

[0091] Enter the image label and logo. The image label is the image name and image version number, and the image logo is the definition of the image details logo. The image logo can be customized.

[0092] The tag data of the image is converted into a key-value array, where the key is the image name and the value is the image version number. The flag data is also converted into a key-value array, where the key is a fixed value and the value is a custom flag name, as well as the path to the DockerFile file recorded in step S4-2. The above data is then used as the input parameter of the image creation API interface to complete the image creation operation.

[0093] S4-4. Mirror View

[0094] You can view the created image list data through the image viewing API interface.

[0095] S5. Create a network

[0096] Build different network segments that are isolated from each other, and then simulate different LAN environments in reality.

[0097] This step is completed by calling the Create Network API interface. First, query the gateway IP address and the specified subnet segment entered in step S1, then enter the name of the created network and the selected network driver mode. Finally, call the Create Network API interface and pass in the above parameters to complete the creation of the network.

[0098] The network driver mode is bridge mode by default. Bridge mode can be used to simulate hosts with different IP addresses in a LAN environment. In bridge mode, multiple containers will not share the host's network, and can achieve interconnection between multiple containers in a LAN environment. It is the preferred network driver mode. In addition, the network driver mode can also be selected from host, container, and none.

[0099] When creating a network, you can specify the IP range of the container. The IP range of the container is a subset of the specified subnet segment. The IP range of the container can only be between the specified subnet segments. If the container IP range is not set, the IP range of the created network defaults to the specified subnet segment.

[0100] S6. Create a container

[0101] Package the application and its dependencies into a portable container to isolate the application from the underlying system. This step can be completed by calling the container creation API interface, which mainly includes the following steps:

[0102] S6-1. Enter the port number of the container

[0103] The port number of the container is used to establish a port mapping with the host port number entered in step S1. If the container port number is not entered, it is assumed to be consistent with the host port number entered in step S1.

[0104] S6-2. Enter the mount path

[0105] The mount path includes the host path and the container path, which are used to map the path from the host to the virtual machine.

[0106] S6-3. Enter the container name

[0107] S6-4. Select the image name created in step S4 and create a corresponding container for the image;

[0108] S6-5. Select the network name created in step S5 and configure the corresponding network environment for the container;

[0109] S6-6. Input container environment;

[0110] This step is optional. For example, you need to add a password when creating a container environment with MySQL.

[0111] S6-7. Configure whether to allow interactive input

[0112] Configure whether to allow interactive input. The parameter is a Boolean type. The default is True, which means that the standard input stream can be attached from the container. At this time, the user can interact with the container. For example, you can run a shell script in the container. Otherwise, interactive input is not allowed.

[0113] S6-8. Allocate pseudo terminal

[0114] Allocate a pseudo terminal. The parameter is a Boolean type. The default value is True. The function is to allocate a pseudo service to the container, that is, a process that is always running. The container will not exit at this time. If it is set to False, for example, after Centos is started, if there is no process running in the container, the container will automatically exit.

[0115] S6-9. Use the above parameters as input parameters to call the container creation API interface to complete the container creation operation.

[0116] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for dynamically creating a simulation environment based on container technology, characterized in that: The steps include: S1. Input of topology information First, enter the network segment in the topology diagram; then enter the IP addresses, port numbers, names and other data corresponding to the multiple hosts in the topology diagram, and enter the IP address of the gateway corresponding to each host; generate the basic information required for the simulation environment in this exercise to facilitate subsequent queries; S2. Basic configuration of Docker environment Use Docker as the engine of the application container, perform a series of configurations of the Docker environment in the Linux environment, and enable Docker remote connection to lay the foundation for subsequent operations; S3. Remote self-connection Docker When connecting, enter the Docker IP address, port number, and Docker API version number, and the program will automatically test whether Docker can connect. If not, return to step S2 to reconfigure the Docker environment. If it can connect, proceed to the next step. S4. Create a mirror Create a read-only Docker template as an image, which contains all the content required to run the program; S5. Create a network Build different network segments that are isolated from each other, and then simulate different LAN environments in reality; S6. Create a container Package an application and its dependencies into a portable container, isolating the application from the underlying system.

2. According to the method for dynamically creating a simulation environment based on container technology in claim 1, it is characterized in that: The S2 step specifically includes the following steps: S2-1. Prepare the server and download the Linux version of Docker; S2-2. Create a corresponding Docker directory in the Linux environment, and then copy the downloaded resources to this directory; S2-3. Unzip the compressed package and copy the unzipped Docker file to the / usr / bin / directory; S2-4. Create the docker.service file to register docker as a service; S2-5. Open the remote connection and expose the specified port as the Docker remote connection port; S2-6. Add execution permissions to the docker.service file; S2-7. Reload the configuration file. Every time you modify the docker.service file, you need to reload the configuration file. S2-8. Start Docker and set it to start at boot; S2-9. Check the Docker service status. If the status value is active, it means that Docker has been installed successfully.

3. According to the method for dynamically creating a simulation environment based on container technology in claim 1, it is characterized in that: The S4 step specifically includes the following steps: S4-1. Image Pull Since Centos7 is required to create a JDK image, pull Centos7 first; first call the image pull API interface, and complete the image pull by entering the image name and image version number; S4-2. Image import Import the JDK installation package into the corresponding DockerFile file; first, configure the JDK installation package path and JAVA environment path in the DockerFile file, and specify that it will be executed in the Centos7 environment; then, call the image import interface, upload the JDK installation package and the corresponding DockerFile file, and record the storage path of the DockerFile file to complete the image import; S4-3. Create a mirror Enter the image's label and flags; The image tag is the name of the image and the version number of the image, and the image logo is the definition of the image details logo. The image logo can be customized. Convert the tag data of the image into a key-value array, where the key is the image name and the value is the image version number; convert the flag data into a key-value array, where the key is a fixed value and the value is a custom flag name, as well as the path to the DockerFile file recorded in step S4-2, and then use the above data as input parameters for the image creation API interface to complete the image creation operation; S4-4. Mirror View You can view the created image list data through the image viewing API interface.

4. According to the method for dynamically creating a simulation environment based on container technology according to claim 1, it is characterized in that: The S5 step is completed by calling the creation network API interface, which specifically includes the following steps: First, query the gateway IP address and the specified subnet segment entered in step S1, then enter the name of the created network and the selected network driver mode; finally, call the create network API interface and pass in the above parameters to complete the creation of the network.

5. The method for dynamically creating a simulation environment based on container technology according to claim 4 is characterized in that: The network driver mode is bridge mode, host, Container or none.

6. The method for dynamically creating a simulation environment based on container technology according to claim 1, characterized in that: The S6 step specifically includes the following steps: S6-1. Enter the port number of the container The port number of the container is used to establish a port mapping with the host port number entered in step S1. If the container port number is not entered, it is assumed to be consistent with the host port number entered in step S1. S6-2. Enter the mount path The mount path includes the host path and the container path, which are used to map the path from the host to the virtual machine. S6-3. Enter the container name S6-4. Select the image name created in step S4 and create a corresponding container for the image; S6-5. Select the network name created in step S5 and configure the corresponding network environment for the container; S6-6. Input container environment; This step is optional. For example, you need to add a password when creating a container environment with MySQL. S6-7. Configure whether to allow interactive input Configure whether to allow interactive input. The parameter is of Boolean type. The default value is True, which means that the standard input stream can be attached from the container. At this time, the user can interact with the container; for example, Shell scripts can be run in the container; otherwise, interactive input is not allowed. S6-8. Allocate pseudo terminal Allocate a pseudo terminal. The parameter is of Boolean type and defaults to True. It can allocate a pseudo service to the container, that is, a process that is always running. The container will not exit at this time. If it is set to False, for example, after Centos is started, if there is no process running in the container, the container will automatically exit. S6-9. Use the above parameters as input parameters to call the container creation API interface to complete the container creation operation.

Images