Loading method and device for runtime application protection, equipment and medium

Abstract

The embodiment of the invention relates to a loading method and device for application protection during running, equipment and a medium. The method comprises the steps that an application protection file matched with a first container mirror image is obtained; wherein the application protection file records a function code for realizing application protection during operation; determining a file loading code corresponding to the application protection file; adding the file loading code into a first-layer construction document of the first container mirror image to obtain a second-layer construction document; and constructing a second container mirror image according to the second-layer construction document, and instantiating the second container mirror image to obtain a target container. According to the embodiment of the invention, automatic loading of the runtime application protection is realized, complex manual operation is avoided, the application mirror image does not need to be modified in a manner of constructing the file by the modification layer, invasion to service codes is reduced, decoupling between the runtime application protection and the application mirror image is configured, and the application protection efficiency is improved. And the subsequent maintenance cost is reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of container security technology, and in particular to a method, device, equipment and medium for loading runtime application protection. Background Art

[0002] With the development of cloud computing and container technology, container images are being used more and more widely, and the security requirements for container images are becoming higher and higher. In related technologies, users are required to intervene to inject the Runtime Application Self-Protection (RASP) agent into the application's operating environment. However, this method requires manual copying and modification of application images, which increases the complexity of operations. In addition, the runtime application protection is highly coupled with the application, and the subsequent maintenance cost is high. Summary of the invention

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a runtime application protection loading method, device, equipment and medium.

[0004] The present disclosure provides a runtime application protection loading method, including:

[0005] Obtaining an application protection file adapted for the first container image; wherein the application protection file records a function code for implementing runtime application protection;

[0006] Determine a file loading code corresponding to the application protection file;

[0007] Adding the file loading code to the first layer build document of the first container image to obtain a second layer build document;

[0008] A second container image is constructed according to the second layer construction document, and the second container image is instantiated to obtain a target container; wherein the second container image is loaded with the runtime application protection on the basis of the first container image.

[0009] The embodiment of the present disclosure also provides a runtime application protection loading device, including:

[0010] An acquisition module, used to acquire an application protection file adapted by the first container image; wherein the application protection file records a function code for implementing runtime application protection;

[0011] A determination module, used to determine a file loading code corresponding to the application protection file;

[0012] An adding module, used to add the file loading code to the first layer build document of the first container image to obtain a second layer build document;

[0013] A construction module is used to build a second container image according to the second layer construction document, and instantiate the second container image to obtain a target container; wherein the second container image is loaded with the runtime application protection based on the first container image.

[0014] An embodiment of the present disclosure also provides an electronic device, which includes: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement a runtime application protection loading method as provided in an embodiment of the present disclosure.

[0015] The embodiment of the present disclosure further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the runtime application protection loading method provided by the embodiment of the present disclosure.

[0016] The technical solution provided by the embodiment of the present disclosure has the following advantages over the prior art: the loading solution of runtime application protection provided in the embodiment of the present disclosure, the method includes: obtaining an application protection file adapted to the first container image; wherein the application protection file records the function code for implementing runtime application protection; determining the file loading code corresponding to the application protection file; adding the file loading code to the first layer construction document of the first container image to obtain the second layer construction document; constructing the second container image according to the second layer construction document, and instantiating the second container image to obtain the target container; wherein the second container image is loaded with runtime application protection on the basis of the first container image. By adopting the above technical solution, the application protection file adapted to the first container image is determined, the loading code corresponding to the application protection file is introduced into the layer construction document, and then the application protection file is integrated into the container image in the process of constructing the container image according to the layer construction document, and then the automatic loading of runtime application protection is realized in the target container instantiated by the container image, which avoids complex manual operations, and does not need to modify the application image itself by modifying the layer construction file, which reduces the intrusion into the business code, realizes the decoupling between the configuration of the runtime application protection and the application image, and reduces the cost of subsequent maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 A flowchart of a method for loading runtime application protection provided by an embodiment of the present disclosure;

[0020] Figure 2 A schematic diagram of a runtime application protection loading method provided by an embodiment of the present disclosure;

[0021] Figure 3 A schematic diagram of the structure of a runtime application protection loading device provided by an embodiment of the present disclosure;

[0022] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0024] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0025] The widespread use of container technology makes application deployment and management more efficient. However, with the popularity of containers, applications in containers face more and more security threats. In related technologies, methods for integrating RASP detection functions in container runtimes include:

[0026] 1. Direct integration. Specifically, during the application image production phase, personnel in each pipeline maintain and integrate images with RASP Agent capabilities. This method has a low degree of automation, places too much knowledge and reliance on pipeline personnel, and has high maintenance costs. It is only applicable to protection scenarios with a small number of specific application images.

[0027] 2. Dynamic loading. Specifically, during the container running phase, the RASP Agent is copied into the container so that the container has the RASP detection capability. In this method, when the container is restarted, the RASP Agent needs to be copied again, which is cumbersome.

[0028] 3. Host-level monitoring. Specifically, deploy RASP Agent on the container host to monitor and protect applications in the container through kernel-level or system call-level interception mechanisms. This method has a coarse granularity and is difficult to accurately protect applications in each container. It also has limited monitoring of container processes and network behaviors and may not be able to accurately capture and intercept attacks at a specific application layer.

[0029] It can be seen that the related technology usually relies on injecting RASP Agent into the application's operating environment. This method usually requires copying and modifying the application image, and the runtime application protection is highly coupled with the application, resulting in high subsequent maintenance costs.

[0030] In order to solve the above problems, the embodiments of the present disclosure provide a method for loading RASP, through which the function code for implementing the RASP agent can be embedded into the container image without manually copying the function code for implementing the RASP agent, so that the container has the RASP function natively, improving the security of the container application and reducing the complexity of maintaining and deploying the container. The method is introduced below in conjunction with a specific embodiment.

[0031] Figure 1 The present invention provides a flowchart of a runtime application protection loading method provided by an embodiment of the present invention. The runtime application protection loading method can be applied to a runtime application protection loading device. The runtime application protection loading device can be implemented by software and / or hardware, and the runtime application protection loading device can generally be integrated in an electronic device. Figure 1 As shown, the loading method of the runtime application protection includes:

[0032] Step 101: Obtain an application protection file adapted for the first container image; wherein the application protection file records a function code for implementing runtime application protection.

[0033] The first container image may be a container image that does not integrate the function code for implementing RASP, and the first container image may be understood as an original container image. The application protection file may be a file encapsulating the function code for implementing the RASP agent, for example, the application protection file may be rasp-agent.jar. The compilation language used by the application protection file is consistent with the compilation language used by the first container image.

[0034] RASP, also known as runtime application self-protection, can be directly injected into the protected application. RASP can provide real-time protection at the function level in the service. It can monitor, detect and protect security threats in real time in the runtime environment of the application without updating the policy or upgrading the code of the protected application. RASP can increase the immunity of the application itself to attacks and vulnerabilities. Unlike traditional protection systems located on the periphery, RASP runs directly inside the application and has the following functions: First, real-time monitoring. Specifically, RASP monitors the behavior of the application during the operation of the application and captures potential security threats such as abnormal requests and malicious inputs. RASP has the characteristics of high detection and low false positives, and has good detection effects for encrypted requests and obfuscation bypass attacks. Second, self-protection. Specifically, once abnormal behavior is detected, RASP can immediately take protective measures such as blocking malicious requests and performing repair operations to ensure the continuous security of the application. Third, intelligent decision-making. Specifically, RASP can make intelligent responses based on predefined security policies or dynamic threat intelligence, reduce human intervention, and improve the timeliness of security protection. RASP is suitable for dealing with application-level attacks, such as Structured Query Language (SQL) injection, Cross-Site Scripting (XSS), data leakage, etc. RASP can provide in-depth and real-time security protection for applications.

[0035] In the embodiment of the present disclosure, in the continuous integration (CI) stage, a startup operation for the image production pipeline is performed manually or automatically, and the image production pipeline can be a workflow for producing container images. In response to the startup operation, the RASP loading device can determine whether the first container image has the RASP function. If so, the first container image is directly pushed to the preset container image library. Otherwise, the application protection file adapted to the first container image is obtained.

[0036] In some embodiments of the present disclosure, obtaining an application protection file adapted for a first container image includes: determining a target programming language for the first container image; and determining a candidate protection file corresponding to runtime application protection and written in the target programming language as the application protection file.

[0037] Among them, the target programming language may be a programming language used to write the first container image. The candidate protection file may be a file written in different languages ​​that records the implementation of the RASP proxy function, and this embodiment does not limit the candidate protection file. For example, the candidate protection file may include a RASP proxy file written in Python, a RASP proxy file written in Java, a RASP proxy file written in Hypertext Preprocessor (PHP), and the like.

[0038] In this embodiment, the loading device of RASP can determine the target programming language of the first container image. There are many methods for determining the target programming language, which are not limited in this embodiment. For example, the loading device of RASP can parse the document or project description of the first container image to obtain the target programming language, or the loading device of RASP can determine the target programming language according to the startup command or runtime environment setting of the first container image. Furthermore, among multiple candidate protection files written in multiple programming languages, the candidate protection file written in the target programming language is determined as the application protection file corresponding to the first container image. Thereby, the writing language of the first container image and the application protection file is consistent, and the application protection file can run normally and protect the container image normally.

[0039] Step 102: determine the file loading code corresponding to the application protection file.

[0040] The file loading code can be used to load the RASP agent in the container image. The RASP agent is a component that implements the RASP function, and the RASP agent can be understood as the executor or implementation carrier of RASP.

[0041] In the embodiment of the present disclosure, if it is determined that there is an application protection file adapted by the first container image, the existing file loading code of the application protection file is obtained, or the loading device of RASP can generate a file loading code corresponding to the application protection file.

[0042] In some embodiments of the present disclosure, the file loading code includes a file copying code, a variable setting code, and a container startup code.

[0043] The file copy code may be used to copy the application protection file to a target path, which may be a directory where the application protection file is stored when the application protection file is integrated in the second container image. The file copy code may include a copy (COPY) instruction, the name of the application protection file, and the target path.

[0044] The variable setting code can be used to configure the startup parameters of the application so that the application protection file is loaded when the application is started, that is, the loading of the RASP agent is realized. The startup parameter can be an environment variable identified when the application is started. The variable setting code may include a variable setting (ENV) instruction, a run configuration parameter, and a run configuration parameter value. The run configuration parameter value may include a proxy setting parameter and a target path. The run configuration parameter can be used to configure the parameters for the operation of the virtual machine. For example, the run configuration parameter may be JAVA_OPTS. The run configuration parameter value may be a specific value corresponding to the run configuration parameter. The proxy setting parameter can be used to add functionality by loading the corresponding agent without modifying the original program. For example, the proxy setting parameter may be -javaagent.

[0045] The container startup code can be used to start the interpreter when the container is started, and then execute the specified command through the interpreter. By executing the command, when the running configuration parameter value configured by the variable setting code is set, if the application in the container is started, the RASP agent is loaded. The container startup code may include a command execution (CMD) instruction, an interpreter startup character, a command execution character, a running configuration parameter, and a target path. Among them, the interpreter startup character is used to start the interpreter, and the command execution character is used to indicate the command after the command execution character is executed.

[0046] In the above scheme, the file copy code, variable setting code, and container startup code are the codes required to realize RASP automatic loading. Based on the above codes, conditions are created for realizing RASP automatic loading by modifying the layer construction file.

[0047] In some embodiments of the present disclosure, determining a file loading code corresponding to an application protection file includes:

[0048] According to the target path and copy instructions of the application protection file, the file copy code is constructed, and according to the target path and variable setting instructions of the application protection file, the variable setting code is constructed, and according to the target path and command execution instructions of the application protection file, the container startup code is constructed.

[0049] In this embodiment, the loading device of RASP can obtain the target path to which the application protection file needs to be copied, and concatenate the name of the application protection file and the target path after the copy instruction to obtain the construction copy code. In addition, the loading device of RASP can concatenate the running configuration parameters, the proxy setting parameters, and the target path after the variable setting (ENV) instruction to obtain the variable setting code. In addition, the loading device of RASP can concatenate the interpreter startup character, the command execution character, the running configuration parameters, and the target path after the command execution instruction to obtain the container startup code.

[0050] In the above scheme, the proxy setting parameter option is configured in the running configuration parameters, so that the RASP agent can be automatically loaded when the application is started. In addition, according to different programming languages ​​and running environments, the corresponding RASP loading method can be set. For example, the -javaagent parameter can be used in Java applications, and the startup script or plug-in configuration corresponding to the programming language can be set in other programming languages, so that the application protection file does not conflict with the application itself, reducing the potential impact of the application protection file on the startup time, performance and dependency management of the application.

[0051] Step 103: Add the file loading code to the first-layer build document of the first container image to obtain a second-layer build document.

[0052] Among them, the layer build document (Dockerfile) is a text document, which can contain a series of instructions for automating the process of building a container image. The layer build document can define one or more of the basic environment, application, library, configuration file, and dependency of the container image. The layer build document is the core of building a Docker container image. Through the layer build document, users can manage and deploy applications in the container image more easily. The first layer build document can be used to build a first container image, and the first layer build document can be understood as a pre-configured original document. The second layer build document can be a layer build document obtained by integrating the RASP automatic loading function based on the first layer build document. The application protection file can be copied to the container image through the second layer build document, and the relevant parameters of the application protection file can be configured in the second layer build document, so that RASP is loaded when the container starts.

[0053] In the disclosed embodiment, for each file loading code, the loading device of RASP can determine the instruction type of the file loading code, determine the code adding position corresponding to the instruction type in the first layer construction document, and add the file loading code to the code adding position. After performing the above processing for each file loading code, a second layer construction document is obtained.

[0054] Thus, by constructing the second-layer build document, dynamic management of RASP configuration is achieved, and the relevant configuration of RASP can be automatically adjusted and updated through the layer build file in different container deployment environments (for example, development, testing, production, etc.).

[0055] In some embodiments of the present disclosure, a file loading code is added to a first-layer build document of a first container image to obtain a second-layer build document, including:

[0056] In the copy layer of the first-layer build document, a file copy code is added, and in the environment setting layer of the first-layer build document, a variable setting code is added, and the original startup code in the execution layer of the first-layer build document is replaced with the container startup code to obtain a second-layer build document.

[0057] The copy layer may be a layer corresponding to the copy instruction in the first layer build document. The environment setting layer may be a layer corresponding to the variable setting instruction in the first layer build document. The original startup code may be the original code for starting the container in the first layer build document.

[0058] In this embodiment, the loading device of RASP can determine the copy layer corresponding to the copy instruction, and add the file copy code in the copy layer to obtain the updated copy layer. In addition, the loading device of RASP can determine the environment setting layer corresponding to the variable setting instruction, and add the variable setting code in the environment setting layer to obtain the updated environment setting layer. In addition, the loading device of RASP can parse the existing code with command execution instructions in the first layer construction document, determine the original startup code, and replace the original startup code with the container startup code. Then, after completing the addition of the above-mentioned file copy code, variable setting code, and container startup code, the second layer construction document is obtained.

[0059] In the above scheme, the subsequent automatic loading of RASP is realized by adding the corresponding code to the corresponding position of the first-layer build file. By changing the modified build file, the environment variable configuration required for the application protection file is met, and the decoupling of the environment variable configuration management and the application program is realized, ensuring the flexibility and manageability of the configuration. In addition, the modification of the layer build file is consistent, ensuring the consistency and correctness of the configuration in different environments (for example, development, testing, production, etc.), and avoiding the failure of protection caused by differences in the configuration of RASP in different environments. And by automatically adjusting the environment variables based on the layer build document, the relevant configuration of RASP is realized in the original first container image without the need to manually rebuild the image.

[0060] Step 104: construct a second container image according to the second-layer construction document, and instantiate the second container image to obtain a target container; wherein the second container image is integrated with an application protection file based on the first container image.

[0061] The target container may be a container instantiated according to the second container.

[0062] In the disclosed embodiment, after determining the second layer build document, the loading device of RASP can read the instructions in the second layer build document. Specifically, the loading device of RASP can determine the base image according to the second container image. Then, the subsequent instructions in the second layer build document are executed in sequence according to the instruction sequence. Each time an instruction is executed, a new layer is created on the already established layer, and the base image is the first established layer. These layers are combined to form the final second container image.

[0063] After determining the second container image, in the continuous deployment pipeline, the second container image integrated with the application protection file is deployed to the target environment (e.g., Kubernetes, Openshift cluster, Docker container), and the second container image is instantiated to obtain the target container. When the target container is started, the application protection file is automatically run to automatically load and initialize the RASP agent. The RASP agent continuously monitors the application and provides security protection during the operation of the target container.

[0064] In some embodiments of the present disclosure, building a second container image according to a second-layer construction document includes: if the second container image is successfully started according to the second-layer construction document, pushing the second container image to a preset container image library. The preset container image library can be a pre-set virtual warehouse for storing container images.

[0065] In this embodiment, after determining the second-layer construction document, the loading device of RASP can determine whether the second container image can be normally built according to the second-layer construction document. If so, the second container image is pushed to the preset container image library through the pipeline.

[0066] In the above solution, the application protection file is integrated into the second container image corresponding to the second-layer build document through the file loading code, so that the target container instantiated based on the second container image can automatically load RASP when the application is running. In addition, RASP takes effect when the application is started, and can monitor and protect the runtime security of the application in real time, prevent SQL injection, XSS and other attacks, and achieve instant protection.

[0067] In some embodiments of the present disclosure, the runtime application protection loading method also includes: if starting the second container image according to the second layer construction document fails, starting the first container image according to the first layer construction document, and pushing the first container image to a preset container image library.

[0068] In this embodiment, after determining the second-layer construction document, the loading device of RASP can determine whether the second container image can be normally constructed according to the second-layer construction document. If not, the first container image is generated according to the first-layer construction document, and the first container image is pushed to the preset container image library through the pipeline. In addition, the abnormal information generated during the construction of the second container image by the second-layer construction document is recorded through the pipeline, and the abnormal information is sent to the R&D personnel to remind the R&D users to solve the problem.

[0069] In the above scheme, when the second container image fails to be built according to the second-layer build document, the pipeline automatically records the abnormal information for R&D personnel to analyze and improve and iterate, and notifies the R&D personnel. At the same time, a first-field container image without integrated application protection files is generated, and the first container image is pushed to the preset container image library, avoiding blocking the continuous deployment (CD) pipeline.

[0070] The method for loading runtime application protection provided by the embodiment of the present disclosure includes: obtaining an application protection file adapted to the first container image; wherein the application protection file records a function code for implementing runtime application protection; determining a file loading code corresponding to the application protection file; adding the file loading code to the first layer construction document of the first container image to obtain a second layer construction document; constructing a second container image according to the second layer construction document, and instantiating the second container image to obtain a target container; wherein the second container image is loaded with runtime application protection on the basis of the first container image. By adopting the above technical scheme, the application protection file adapted to the first container image is determined, the loading code corresponding to the application protection file is introduced into the layer construction document, and then the application protection file is integrated into the container image in the process of constructing the container image according to the layer construction document, and then the automatic loading of runtime application protection is realized in the target container instantiated by the container image, thereby avoiding complex manual operations, and the application image itself does not need to be modified by modifying the layer construction file, thereby reducing the intrusion into the business code, realizing the decoupling between the configuration of the runtime application protection and the application image, and reducing the cost of subsequent maintenance.

[0071] In addition, the automated integration of the continuous integration / continuous deployment pipeline is achieved. Specifically, in the development and operation integration (DevOps) process, the integration process of integrating the application protection file encapsulating the RASP agent function code into the second container image is automated, and the second container image integrated with the application protection file is automatically built through the continuous integration / continuous deployment pipeline. The effectiveness of the RASP function can be verified through automated security testing (for example, vulnerability scanning, stress testing, etc.), and the second container image is deployed to the test or production environment. The efficiency of collaboration between different personnel is greatly improved. Specifically, in the case where the security testing part of RASP needs to be integrated into the continuous integration and continuous delivery processes, the application protection file is automatically injected when building the second container image, so that the application protection file is correctly integrated in the second container image each time it is built, and the RASP function will not fail due to version differences.

[0072] In addition, the application protection file is automatically loaded when the target container is started, ensuring that the RASP proxy function implemented by the encapsulated code in the application protection file is automatically implemented when the target container is started without the need for additional manual intervention. The automatic loading of the application protection file can be achieved by configuring a startup script, environment variables, or mounting in the second container image. And for multiple configuration files (for example, protection strategies, monitoring rules, etc.) that the RASP agent relies on, the configuration files can be flexibly changed according to specific application scenarios.

[0073] Next, a specific example is used to further illustrate the method for loading runtime application protection in the embodiment of the present disclosure. Figure 2 A schematic diagram of a runtime application protection loading method provided by an embodiment of the present disclosure is shown as follows: Figure 2 As shown, in the continuous integration pipeline, the startup operation for the image production pipeline is performed manually or automatically, and the RASP loading device responds to the startup operation to start the pipeline for producing the second container image. Through the pipeline, it is determined whether the first container image needs to have the RASP function. If the first container image has the RASP function, it means that the first container image does not need additional RASP functions, then the first container image is produced normally and pushed to the preset container image library; if the first container image does not have the RASP function, it means that the first container image needs additional RASP functions, and then the file loading code is determined. Specifically, the RASP loading device can confirm the programming language and operating environment of the first container image, and determine the file loading code corresponding to the application protection file that matches the programming language and operating environment.

[0074] Furthermore, the implementation code of the RASP agent is integrated into the second container image. Specifically, first, the second-layer build document is determined, and the second container image is built according to the second-layer build document. Specifically, it includes: adding the file copy code to the pre-configured first-layer build document, so that when the second container image is built, the code file that implements the RASP agent is copied to the second container image. And the variable setting code and container startup code related to the RASP agent are configured in the first-layer build document, so that RASP can be loaded normally when the container starts. In the second-layer build document, rasp-agent.jar is a RASP component, and the -javaagent option is configured in the JAVA_OPTS environment variable so that the RASP Agent is automatically loaded when the application starts. After determining the second-layer build document, build the second container image according to the second-layer build document.

[0075] Furthermore, after the second container image is built, test whether the second container image can be started normally. If not, the error log is automatically recorded and the exception information is generated through the pipeline, and the exception information is sent to the R&D personnel for analysis and improvement iteration. In addition, the first container image is produced normally and pushed to the preset container image library. If the second container image can be started normally, the normal log is recorded, and the second container image is pushed to the preset container image library through the pipeline to avoid blocking the continuous deployment process.

[0076] In the continuous deployment pipeline, the second container image containing the application protection file encapsulated with the RASP agent function code is deployed to the target environment (such as Kubernetes, Openshift cluster, Docker container). When the target container is started, the RASP agent is automatically loaded and initialized, realizing the automatic loading of RASP. The RASP agent continuously monitors the application and provides security protection during the operation of the target container.

[0077] In the above scheme, a layer for integrating application protection files is added to the second-layer build document, and a new second container image is reconstructed and generated according to the second-layer build document and pushed to the preset container image library. The newly generated second container image has the RASP function natively. It avoids the tedious process of manually modifying the image production process and copying the application protection file into the container. Thus, the tedious process of manually copying the application protection file into the container is omitted without interfering with the image production process. Automatically add a copy of the integrated application protection file to the container image, so that the second container image has the RASP capability natively.

[0078] The RASP loading method provided in the embodiments of the present disclosure has one or more of the following effects:

[0079] First, the automation and non-invasive integration of RASP loading is achieved. Specifically, by adding the file loading code corresponding to the RASP agent in the second-layer build document, developers and operation and maintenance personnel can automatically load RASP components during the construction of the second container image without modifying the application itself, reducing the intrusion into the business code. In addition, the deployment process of RASP is simplified. Specifically, the security mechanism implemented by RASP is bundled with the target container, and the operation and maintenance personnel and developers deploy the target container without having to perform additional security protection configuration on the application after the target container is deployed, which simplifies the deployment steps of the target container.

[0080] Second, it has instant security protection. Specifically, the RASP agent takes effect when the target container is started, and can monitor and protect the runtime security of the application in the target container in real time, prevent common SQL injections, XSS attacks and other attacks, and provide instant protection. It also improves the security of the application. Specifically, RASP is automatically loaded when the target container is started, which can dynamically protect the application at runtime, providing additional security protection, thereby enhancing the overall security of the application. And because RASP runs inside the application, it can detect and prevent vulnerabilities from being exploited in real time, so it can greatly reduce the risk of security vulnerabilities being attacked in the production environment.

[0081] Third, it has cross-environment consistency. Specifically, by uniformly packaging the second container image, the same RASP running configuration can be guaranteed in different environments (for example, development, testing, and production), avoiding security configuration deviations caused by different environments.

[0082] Fourth, it is configurable and flexible. Specifically, through environment variables and configuration files, the configuration of RASP can be customized according to different application scenarios to meet various business needs and increase flexibility. Improve system stability and reliability. In addition, RASP's self-protection mechanism enables the application to handle itself when attacked, reducing the possibility of system crashes or business interruptions, and improving system stability and reliability.

[0083] Fifth, reduce the burden of operation and maintenance. Specifically, by automatically loading the RASP agent, the operation and maintenance personnel are prevented from manually loading or configuring RASP after each target container is started, which simplifies the management process of the target container and reduces the risk of misoperation of security configuration.

[0084] Sixth, observability is enhanced. Specifically, RASP has monitoring and logging functions. By integrating RASP in the target container, it can record the application's operating status, attack behavior, and potential security vulnerabilities in detail, facilitating subsequent security analysis and troubleshooting. Through continuous monitoring and protection, RASP can block potential attacks in real time without affecting normal business, reducing business risks caused by undetected vulnerabilities.

[0085] Seventh, improve the efficiency of personnel cooperation. Specifically, by integrating RASP directly into the target container, developers can introduce RASP during the development phase, which improves the efficiency of development and operation and maintenance collaboration. It reduces the extra burden on developers and operation and maintenance personnel, and at the same time provides an efficient and secure protection method, which makes security protection more closely integrated with the development and deployment process of the application, improving security and efficiency.

[0086] Figure 3 The present disclosure provides a schematic diagram of a runtime application protection loading device, which can be implemented by software and / or hardware, or integrated in an electronic device. Figure 3 As shown, the runtime application protection loading device includes:

[0087] The acquisition module 301 is used to acquire an application protection file adapted by the first container image; wherein the application protection file records a function code for implementing runtime application protection;

[0088] A determination module 302 is used to determine a file loading code corresponding to the application protection file;

[0089] An adding module 303 is used to add the file loading code to the first layer construction document of the first container image to obtain a second layer construction document;

[0090] The construction module 304 is used to build a second container image according to the second layer construction document, and instantiate the second container image to obtain a target container; wherein the second container image is integrated with the application protection file based on the first container image.

[0091] Optionally, the acquisition module 301 is used to:

[0092] Determining a target programming language for the first container image;

[0093] A candidate protection file written in the target programming language and corresponding to the runtime application protection is determined as the application protection file.

[0094] Optionally, the file loading code includes a file copying code, a variable setting code, and a container starting code.

[0095] Optionally, the determining module 302 is configured to:

[0096] According to the target path and copy instructions of the application protection file, a file copy code is constructed, and according to the target path and variable setting instructions of the application protection file, a variable setting code is constructed, and according to the target path and command execution instructions of the application protection file, a container startup code is constructed.

[0097] Optionally, the adding module 303 is used to:

[0098] In the copy layer of the first-layer build document, the file copy code is added, and in the environment setting layer of the first-layer build document, the variable setting code is added, and the original startup code in the execution layer of the first-layer build document is replaced with the container startup code to obtain the second-layer build document.

[0099] Optionally, building the second container image according to the second layer building document includes:

[0100] If the second container image is successfully started according to the second layer construction document, the second container image is pushed to a preset container image library.

[0101] Optionally, the runtime application protection loading device further includes:

[0102] A push module is used to start the first container image according to the first layer construction document if starting the second container image according to the second layer construction document fails, and push the first container image to a preset container image library.

[0103] It should be noted that Figure 3 The runtime application protection loading device 300 shown can execute the various steps in the above-mentioned runtime application protection loading method embodiment, and realize the various processes and effects in the above-mentioned runtime application protection loading method embodiment, which will not be described in detail here.

[0104] Figure 4 The structure diagram of an electronic device provided by the embodiment of the present disclosure is shown in FIG. Figure 4 As shown, the electronic device 400 includes one or more processors 401 and a memory 402 .

[0105] The processor 401 may be a central processing unit (CPU) or other forms of processing units having runtime application protection loading capability and / or instruction execution capability, and may control other components in the electronic device 400 to perform desired functions.

[0106] The memory 402 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 401 may run the program instructions to implement the runtime application protection loading method and / or other desired functions of the embodiment of the present disclosure described above. Various contents such as input signals, signal components, noise components, etc. may also be stored in the computer-readable storage medium.

[0107] In one example, the electronic device 400 may further include: an input device 403 and an output device 404, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0108] In addition, the input device 403 may also include, for example, a keyboard, a mouse, and the like.

[0109] The output device 404 can output various information to the outside, including the determined distance information, direction information, etc. The output device 404 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0110] Of course, to simplify, Figure 4 Only some of the components related to the present disclosure in the electronic device 400 are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device 400 may also include any other appropriate components.

[0111] In addition to the above methods and devices, the embodiments of the present disclosure may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the runtime application protection loading method provided by the embodiments of the present disclosure.

[0112] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0113] In addition, the embodiment of the present disclosure may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the runtime application protection loading method provided by the embodiment of the present disclosure.

[0114] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0115] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0116] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for loading runtime application protection, characterized in that: include: Obtaining an application protection file adapted for the first container image; wherein the application protection file records a function code for implementing runtime application protection; Determine a file loading code corresponding to the application protection file; Adding the file loading code to the first layer build document of the first container image to obtain a second layer build document; A second container image is constructed according to the second layer construction document, and the second container image is instantiated to obtain a target container; wherein the second container image is integrated with the application protection file based on the first container image.

2. The method according to claim 1, characterized in that The obtaining of the application protection file adapted for the first container image includes: Determining a target programming language for the first container image; A candidate protection file written in the target programming language and corresponding to the runtime application protection is determined as the application protection file.

3. The method according to claim 1, characterized in that The file loading code includes a file copying code, a variable setting code, and a container starting code.

4. The method according to claim 3, characterized in that The determining the file loading code corresponding to the application protection file includes: According to the target path and copy instructions of the application protection file, a file copy code is constructed, and according to the target path and variable setting instructions of the application protection file, a variable setting code is constructed, and according to the target path and command execution instructions of the application protection file, a container startup code is constructed.

5. The method according to claim 3, characterized in that: The step of adding the file loading code to the first layer construction document of the first container image to obtain the second layer construction document includes: In the copy layer of the first-layer build document, the file copy code is added, and in the environment setting layer of the first-layer build document, the variable setting code is added, and the original startup code in the execution layer of the first-layer build document is replaced with the container startup code to obtain the second-layer build document.

6. The method according to claim 1, characterized in that The step of building the second container image according to the second layer building document includes: If the second container image is successfully started according to the second layer construction document, the second container image is pushed to a preset container image library.

7. The method according to claim 1, characterized in that The method further comprises: If starting the second container image according to the second layer construction document fails, starting the first container image according to the first layer construction document, and pushing the first container image to a preset container image library.

8. A runtime application protection loading device, characterized in that: include: An acquisition module, used to acquire an application protection file adapted by the first container image; wherein the application protection file records a function code for implementing runtime application protection; A determination module, used to determine a file loading code corresponding to the application protection file; An adding module, used to add the file loading code to the first layer build document of the first container image to obtain a second layer build document; A construction module is used to build a second container image according to the second layer construction document, and instantiate the second container image to obtain a target container; wherein the second container image is integrated with the application protection file based on the first container image.

9. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the runtime application protection loading method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the runtime application protection loading method described in any one of claims 1 to 7.

Images