A security protection system, method and medium based on microservice application

Abstract

The present application relates to the field of microservice application technology, and specifically to a security protection system, method and medium based on microservice application. The system includes a container set Pod, and the Pod includes a proxy Envoy container and a security container. The security container is used to receive a user's request for accessing a microservice application sent by the Envoy container, extract parameter information of multiple preset parameter types from the request, and obtain the detection result of the request according to whether there is parameter information matching the preset rules in the preset rule library in the parameter information of multiple preset parameter types, and send the detection result to the Envoy container. The Envoy container is also used to receive the detection result and execute the traffic policy corresponding to the detection result. The present application detects more malicious attacks and improves the security protection capability of microservice applications by setting a separate security container, which is independent of the Envoy container and does not rely on the development model and inherent limitations of Envoy.

Description

Technical Field

[0001] The present application relates to the field of microservice application technology, and in particular to a security protection system, method and medium based on microservice application. Background Art

[0002] In recent years, cloud native technology has developed rapidly and has been widely used in various industries. The application design of cloud native technology is oriented to the microservice architecture, which splits a single application into multiple microservices, and each microservice is deployed in the container orchestration platform in the form of a container. Under this microservice architecture, the industry generally manages the traffic between microservices through the Istio platform to ensure the security of microservice applications. The Istio platform is an open platform for service governance suitable for cloud native scenarios.

[0003] At present, the security protection of microservice applications is mainly achieved through the secondary development of extension plug-ins in Istio's Envoy container. Due to the compatibility issues between the secondary development extension plug-ins and the Envoy container, in order to take into account the performance of the Envoy container, the functions of the extension plug-ins written by developers are limited, and the types of malicious attacks that can be detected are still relatively small. Therefore, the Envoy container in the prior art has a low security protection capability for microservice applications. Summary of the invention

[0004] The embodiments of the present application provide a security protection system, method and medium based on microservice applications, which are used to improve the security protection capabilities of microservice applications.

[0005] In a first aspect, a security protection system based on a microservice application is provided, the system comprising a container set Pod, the Pod comprising a proxy Envoy container and a security container, wherein:

[0006] The security container is used to receive a user's request for accessing a microservice application sent by the Envoy container, extract parameter information of multiple preset parameter types from the request, obtain a detection result of the request according to whether there is parameter information matching a preset rule in a preset rule library among the parameter information of the multiple preset parameter types, and send the detection result to the Envoy container, wherein the preset rule library includes multiple preset rules, each preset rule includes parameter information of a malicious attack, and the detection result is used to indicate that the request is normal traffic or a malicious attack;

[0007] The Envoy container is used to receive the detection result and execute a traffic policy corresponding to the detection result.

[0008] In an embodiment of the present application, a separate security container is set up for the security protection system. The Envoy container directly sends the request initiated by the user to the security container. The request is completely detected by the security container without the participation of the Envoy container. The security protection capability of the system is independent of the Envoy container. There is no compatibility issue between the security container and the Envoy container, and there is no need to rely on the development model and inherent limitations of Envoy. Therefore, more malicious attacks can be detected, thereby improving the security protection capability of microservice applications and reducing the risk of microservice applications being attacked.

[0009] In a possible embodiment, the Pod further includes a service container, wherein:

[0010] The Envoy container is specifically used to receive the detection result, and if the detection result indicates that the request belongs to a normal traffic type, send the request to the business container;

[0011] The business container is used to receive the request and respond to the request.

[0012] In an embodiment of the present application, the Envoy container determines, based on the detection results, that the request initiated by the user belongs to normal traffic, and then forwards the request to the business container so that the business container responds to the request normally to meet the user's access needs.

[0013] In a possible embodiment, the system includes multiple Pods, each Pod includes one Envoy container, one security container, and one business container, and each Pod corresponds to a microservice application.

[0014] In an embodiment of the present application, each Pod corresponds to a microservice application, which is equivalent to each Pod's security container corresponding to a microservice application. Even if the security containers corresponding to some microservice applications fail, it will not affect the security protection of other microservice applications by other security containers, and has higher robustness.

[0015] In a possible embodiment, the Envoy container is specifically used to receive the detection result, and if the detection result indicates that the request is a malicious attack, intercept the request.

[0016] In an embodiment of the present application, the Envoy container determines, based on the detection results, that the request initiated by the user is a malicious attack, and then immediately intercepts the request to prevent the request from attacking the microservice application.

[0017] In a possible embodiment, the system further includes a configuration storage module;

[0018] The configuration storage module is used to store the multiple preset rules;

[0019] The security container is also used to monitor in real time whether the multiple preset rules stored in the configuration storage module are updated. If it is determined that there are updated preset rules among the multiple preset rules, the updated preset rules are obtained and the preset rule library is updated.

[0020] In an embodiment of the present application, the preset rule base can be updated in real time so as to be able to detect the latest types of malicious attacks.

[0021] In a possible embodiment, the system further includes a log collection module and a user interface module;

[0022] The security container is further used to generate a system log after obtaining the detection result, and send the system log to the log collection module;

[0023] The log collection module is used to receive and store the system log;

[0024] The user interface module is used to obtain and display the system log from the log collection module.

[0025] In an embodiment of the present application, after the test results are obtained, a system log is generated and the system log is visualized to facilitate operation and maintenance personnel to view the test results of each request.

[0026] In a second aspect, a security protection method based on a microservice application is provided, wherein the method is applied to a security container of a container set Pod of a security protection system, wherein the Pod also includes a proxy Envoy container, and the method includes:

[0027] Receive a user access request to a microservice application sent by the Envoy container, and extract parameter information of multiple preset parameter types from the request;

[0028] Obtaining a detection result of the request according to whether parameter information of the multiple preset parameter types includes parameter information that matches a preset rule in a preset rule base, wherein the preset rule base includes multiple preset rules, each preset rule includes parameter information of a malicious attack, and the detection result is used to indicate that the request is normal traffic or a malicious attack;

[0029] The detection result is sent to the Envoy container, so that the Envoy container receives the detection result and executes a traffic policy corresponding to the detection result.

[0030] In a possible embodiment, the Pod further includes a business container, and obtaining a detection result according to whether parameter information of the multiple preset parameter types includes parameter information that matches a preset rule in a preset rule base, including:

[0031] If parameter information of the plurality of preset parameter types does not include parameter information matching the preset rule in the preset rule base, obtaining a first detection result that the request is normal traffic;

[0032] Sending the detection result to the Envoy container includes:

[0033] The first detection result is sent to the Envoy container, so that the Envoy container receives the first detection result and sends the request to the business container.

[0034] In a possible embodiment, obtaining a detection result according to whether there is parameter information matching a preset rule in a preset rule base among the parameter information of the multiple preset parameter types includes:

[0035] If parameter information of the plurality of preset parameter types includes parameter information that matches a preset rule in a preset rule library, obtaining a second detection result that the request is a malicious attack;

[0036] Sending the detection result to the Envoy container includes:

[0037] The first detection result is sent to the Envoy container, so that the Envoy container receives the second detection result and intercepts the request.

[0038] In a possible embodiment, the method further includes:

[0039] If it is determined that there is an updated preset rule among the multiple preset rules, the updated preset rule is obtained and the preset rule base is updated.

[0040] In a possible embodiment, after obtaining the detection result, the method further includes:

[0041] Generate system logs.

[0042] According to a third aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions. When the computer instructions are executed on a computer, the computer executes the method as described in any one of the second aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A schematic diagram of the structure of a Pod of a security protection system based on microservice applications provided in an embodiment of the present application;

[0044] Figure 2 A schematic diagram of the structure of a data plane of a security protection system based on microservice applications provided in an embodiment of the present application;

[0045] Figure 3 A schematic diagram of a microservice application-based security protection system provided in an embodiment of the present application Figure 1 ;

[0046] Figure 4 A schematic diagram of a microservice application-based security protection system provided in an embodiment of the present application Figure 2 ;

[0047] Figure 5 A schematic diagram of a microservice application-based security protection system provided in an embodiment of the present application Figure 3 ;

[0048] Figure 6 A flowchart of a security protection method based on microservice applications provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0050] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0051] Before introducing the security protection system based on microservice applications provided in the embodiments of the present application, in order to facilitate understanding, some concepts mentioned in the embodiments of the present application are first briefly introduced.

[0052] 1. Microservices Architecture.

[0053] Microservices is an architectural solution for building applications. It splits an application into multiple core functions, each of which can be called a service. In other words, an application can be split into multiple microservice applications. Microservices are highly maintainable, loosely coupled, and independently deployable.

[0054] 2. Service Mesh

[0055] Service mesh is an infrastructure layer used to handle inter-service communication in microservice scenarios. It is usually implemented as a set of lightweight network proxies that are deployed with applications and are transparent to the applications. The industry currently generally uses the Istio platform to manage traffic between microservice applications.

[0056] 3. Container (Docker).

[0057] A container is a standardized unit of software that packages code and all its dependencies so that applications can run reliably and quickly from one computing environment to another.

[0058] 4. Container orchestration tools.

[0059] A container orchestration tool is a tool that groups application containers into logical units for the purpose of managing and scheduling containers. The most commonly used container orchestration tool in the industry is Kubernetes (K8s).

[0060] 5. Sidecar container

[0061] Sidecar container is a single-node, multi-container application design. Sidecar advocates using additional containers to expand or enhance the main container, and this additional container is called a Sidecar container. For example, the Envoy container and business container of the Istio platform.

[0062] After introducing the concepts involved in the embodiments of the present application, the technical background of the embodiments of the present application is introduced below.

[0063] At present, the security protection of microservice applications is mainly achieved through the built-in security plug-in of the Envoy container of the Istio platform and the secondary developed extension plug-in. The built-in security plug-in of the Envoy container is equipped with multiple filters, each of which can identify a type of malicious attack. The request initiated by the user passes through multiple filters in sequence, and the detection result of whether the request is a malicious attack can be obtained. According to the detection result, the corresponding traffic policy is executed to ensure the security of the microservice application. However, the filter that comes with the Envoy container can only identify some simple malicious attacks. As the network becomes increasingly complex, the types of malicious attacks are increasing. Developers can develop secondary, write new filters, and integrate them into the extension plug-in of the Envoy container to detect more types of traffic attacks. Since the new filter is written according to the standards and protocols of the Envoy container, there are compatibility issues between the extension plug-in and the Envoy container. Therefore, in order to take into account the performance of the Sidecar container, the functions of the filter that the extension plug-in can provide are also limited, resulting in low security protection capabilities of microservice applications.

[0064] In order to improve the security protection capability of microservice applications, an embodiment of the present application provides a security protection system based on microservice applications. In an embodiment of the present application, it is first necessary to build a Kubernetes cluster environment and an Istio platform, so that the modules included in the security protection system based on microservice applications in the embodiment of the present application are all run in the Istio platform under the Kubernetes cluster environment. In other words, the security protection system based on microservice applications in the embodiment of the present application is implemented based on the Istio platform under the Kubernetes cluster environment. The security protection system includes a data plane and a control plane, and the data plane and the control plane run in a Kubernetes cluster. The Kubernetes cluster includes multiple nodes, and the nodes are divided into master nodes and slave nodes. The slave node can receive the scheduling of the master node and run the corresponding microservice application. For example, the control plane can run on the master node, and the data plane can run on the slave node.

[0065] The security protection system provided in the embodiment of the present application includes a container set (Pod), which is in the data plane of the security protection system and specifically runs in a Kubernetes cluster. Pod is the most basic deployment and scheduling unit of the Kubernetes cluster, that is, the smallest unit for running microservice applications, and each Pod includes multiple containers.

[0066] Please refer to Figure 1, which is a schematic diagram of the structure of a Pod of a security protection system based on a microservice application provided in an embodiment of the present application, wherein the Pod includes an Envoy container 101 and a security container 102. The functions of the Envoy container 101 and the security container 102 are described in detail below.

[0067] The security container 102 is used to receive a user request for accessing a microservice application sent by the Envoy container 101, extract parameter information of multiple preset parameter types from the request, obtain a detection result of the request based on whether there is parameter information in the parameter information of the multiple preset parameter types that matches a preset rule in a preset rule library, and send the detection result to the Envoy container 101.

[0068] Specifically, the Envoy container 101 can receive a request initiated by a user to access a microservice application. For example, if a user wants to access a microservice application, he or she enters a corresponding URL or clicks a corresponding microservice application icon to initiate a request to access the microservice application. The Envoy container 101 directly sends the request to the security container 102.

[0069] The security container 102 integrates the core security engine and corresponding plug-ins, and is a relatively lightweight security container. Since there are many types of malicious attacks, and the parameter information of each malicious attack is different, the security container 102 can determine a plurality of preset parameter types after receiving the request. For example, the security container 102 can determine the parameter types corresponding to all parameter information carried in the request as a plurality of preset parameter types, or for example, the security container 102 can determine the parameter types corresponding to all or part of the preset rules in the preset rule library as a plurality of preset parameter types. A preset rule library is pre-stored in the security container 102, and the preset rule library includes a plurality of preset rules, each preset rule corresponds to a malicious attack, each preset rule can include only the parameter information of a malicious attack, and each preset rule can also include the parameter information and attack type of a malicious attack, such as SOL injection attack, malicious Webshell upload, etc.

[0070] Further, after the security container 102 determines multiple preset parameter types, it can extract parameter information of the multiple preset parameter types from the request. For example, if the request is specifically a hypertext transport protocol (http) protocol, the security container 102 can extract the request header, request body, request payload, etc. carried by the http protocol. If there is no parameter information matching the preset rules in the preset rule library in the parameter information of the multiple preset parameter types, a first detection result is obtained that the request is normal traffic. If there is parameter information matching the preset rules in the preset rule library in the parameter information of the multiple preset parameter types, a second detection result is obtained that the request is a malicious attack. After the security container 102 obtains the detection result of the request, it sends the detection result to the Envoy container 101. The detection result is used to indicate that the request is normal traffic or a malicious attack.

[0071] The following uses SQL injection attack as an example to introduce the process of security container 102 detecting requests.

[0072] For example, a Uniform Resource Locator (URL) of a request is: “http: / / 192.168.19.195:30012?id%3D-1%27%20union%20select%201%2C2%2C(select%20group_concat(schema_name)%20from%20information_schema.schemata)%20--%2B”.

[0073] The parameter information in this request is:

[0074] "id%3D-1%27%20union%20select%201%2C2%2C(select%20group_concat(schema_name)%20from%20information_schema.schemata)%20--%2B".

[0075] The decoded parameter information is as follows:

[0076] "id=-1'union select 1,2,(select group_concat(schema_name)frominformation_schema.schemata)--+".

[0077] The decoded parameter information matches the parameter information of a preset rule in the preset rule library, indicating that the request is a malicious attack. If the preset rule also includes the attack type, it can be further determined that the request belongs to an SQL injection attack in the malicious attack.

[0078] The Envoy container 101 is also used to receive the detection results sent by the security container 102 and execute the traffic policy corresponding to the detection results.

[0079] Due to different detection results, the traffic policies executed by Envoy container 101 are different, which are introduced below.

[0080] First, the Envoy container 101 receives the first detection result.

[0081] Please continue to refer to Figure 1 In addition to the Envoy container 101 and the security container 102, the Pod also includes a business container 103. The business container 103 includes various data of the microservice application and is used to respond to requests initiated by users.

[0082] If the Envoy container 101 receives the first detection result, that is, the detection result indicates that the request is normal traffic, the request is sent to the business container 103, and the business container 103 responds to the request normally. For example, if the user requests to access certain data of the microservice application, the business container 103 calls the corresponding data to the user.

[0083] Second, the Envoy container 101 receives the second detection result.

[0084] If the Envoy container 101 receives the second detection result, that is, the detection result indicates that the request is a malicious attack, the request is intercepted to prevent the request from being forwarded further, so as to ensure the security of the microservice application.

[0085] In the embodiment of the present application, a security container is deployed between the Envoy container and the business container in a non-intrusive manner, and only the security container detects the requests initiated by the user, making the security protection capability independent of the Envoy container, achieving the characteristic of non-intrusion to Istio's own code logic, without relying on the development model and inherent limitations of Envoy, and can detect more types of malicious attacks, thereby improving the security protection capabilities of microservice applications. In addition, the security container in the embodiment of the present application extracts parameter information of multiple parameter types at one time, and matches the parameter information of multiple parameter types with multiple preset rules of the preset rule library. Compared with the method of passing through multiple filters in sequence in the prior art, the detection efficiency is higher.

[0086] In a possible embodiment, the data plane of the security protection system may include one or more Pods. In other words, one or more Pods are running in the Kubernetes cluster, and each Pod includes an Envoy container, a security container, and a business container. When the security protection system includes multiple Pods, a Pod may correspond to one or more microservice applications, which are introduced below.

[0087] 1. A Pod corresponds to a group of microservice applications.

[0088] In an embodiment of the present application, microservice applications can be grouped. For example, multiple microservice applications with similar functions can be grouped together. One Pod corresponds to a group of microservice applications, which can reduce the number of security containers to be set up.

[0089] 2. One Pod corresponds to one microservice application.

[0090] In the embodiment of the present application, one Pod corresponds to one microservice application. In other words, the security container in a Pod corresponds to one microservice application. Even if the security container corresponding to a microservice application fails, it will not affect the security protection of other microservice applications by other security containers, thereby ensuring the security of other microservice applications.

[0091] Please refer to Figure 2 , which is a structural diagram of the data plane of a security protection system based on a microservice application provided in an embodiment of the present application. The data plane 100 includes multiple Pods, each Pod includes an Envoy container 101, a security container 102 and a business container 103, PodA represents the smallest unit for the operation of microservice application A, and PodB represents the smallest unit for the operation of microservice application B.

[0092] It should be noted that when the security protection system includes multiple Pods, the preset rule base of each Pod's security container can be the same, which facilitates the unified management of the preset rule bases of multiple security containers. The preset rule base of each security container can also be different, so that attackers cannot bypass all security containers using the same malicious attack, thereby reducing the risk of malicious attacks being transmitted between multiple microservice applications.

[0093] After introducing the functions of Pod, it is involved how to obtain the preset rules in the preset rule base of the security container 102. The preset rules in the preset rule base can be generated by the security container 102, sent to the security container 102 by other modules, or obtained by the security container 102 from other modules. The other modules are modules other than the security container 102 in the security protection system.

[0094] In a possible embodiment, the preset rules in the preset rule base are sent from the security center platform to the configuration storage module, and then sent from the configuration storage module to the security container 102. Figure 3 , which is a schematic diagram of the structure of a security protection system based on microservice applications provided in an embodiment of the present application Figure 1 The security protection system includes a security center platform 300, a data plane 100 and a control plane 200. The data plane 100 and the control plane 200 run in a Kubernetes cluster, the control plane 200 includes a configuration service module 201 and a configuration storage module 202, the security center platform 300 includes a user interface module 301, a web backend module 302 and a database module 303, and the arrows indicate the flow direction of the preset rules.

[0095] Combine the following Figure 3 The security protection system shown introduces the process of the security container 102 obtaining preset rules.

[0096] The user interface module 301 can also be called a website user interface (WEBUI) module, which can be used to display information in the security protection system for operation and maintenance personnel to view, such as displaying the number of security containers, multiple preset rules in the preset rule library of each security container, etc. The user interface module 301 can also be used to detect various types of operations performed by the operation and maintenance personnel, such as single-click operations, double-click operations, sliding operations, light press operations (such as touch pressure is less than the first preset pressure), heavy press operations (such as touch pressure is greater than the second preset pressure), etc., that is, the user interface module 301 establishes an operation interaction interface between the security protection system and the operation and maintenance personnel in the embodiment of the present application, as a medium for action interaction between the operation and maintenance personnel and the security protection system.

[0097] The user interface module 301 can receive multiple preset rules input by the operation and maintenance personnel. The operation and maintenance personnel are personnel who specialize in managing and maintaining the security protection system. The operation and maintenance personnel can directly obtain multiple preset rules from network resources, or they can write multiple preset rules according to actual needs. The user interface module 301 sends the multiple preset rules to the web backend module 302. The web backend module 302 can send the multiple preset rules to the database module 303 for storage, and can also send the multiple preset rules to the configuration service module 201. The configuration service module 201 sends the multiple preset rules to the configuration storage module 202 for real-time storage. The security container 102 obtains the multiple preset rules from the configuration storage module 202.

[0098] When issuing preset rules to microservice applications, the prior art directly issues them through the Application Programming Interface (API) gateway. In this way of issuing preset rules, the API gateway can directly access the microservice applications inside the Kubernetes cluster. Once an attacker has administrator privileges, he can access the microservice applications at will, which undoubtedly increases the application security risk. The preset rules in the embodiment of the present application are issued through the security center platform, and then issued to the security container through the configuration storage module of the control plane. This method of using the intermediate orchestration layer can effectively prevent Kubernetes cluster resources from being directly accessed by the outside, thereby reducing the risk of being attacked.

[0099] In a possible embodiment, since the preset rules of the preset rule library of each Pod may be different, the security center platform 300 may determine multiple corresponding preset rules for each Pod based on the configuration of the Pod in the Kubernetes cluster, and send the multiple preset rules to the corresponding security container 102 in units of Pod. The security container 102 saves the multiple preset rules in the preset rule library.

[0100] Please refer to Figure 4 , which is a schematic diagram of the structure of a security protection system based on microservice applications provided in an embodiment of the present application Figure 2 The security protection system includes a security center platform 300, and a data plane 100 and a control plane 200 of a Kubernetes cluster. The control plane 200 includes a configuration service module 201, and the security center platform 300 includes a web backend module 302 and a database module 303. The arrows indicate the flow of Pod operation events, and Pod operation events include adding Pods, deleting Pods, and changing Pods. Figure 4 The security protection system shown introduces the process of registering and updating Pods on the security center platform 300.

[0101] The configuration service module 201 can monitor in real time whether there is a Pod operation event in the Kubernetes cluster. If it is determined that a Pod operation event occurs in the Kubernetes cluster, the web backend module 302 of the security center platform 300 is notified in time. If the Pod operation event is to add a Pod, the web backend module 302 registers the Pod and saves it in the database module 303. If the Pod operation event is to delete or change the Pod, the web backend module 302 updates the corresponding Pod stored in the database module 303, and the update includes deletion or modification.

[0102] In a possible embodiment, please continue to refer to Figure 3, the configuration storage module 202 is used to store multiple preset rules. Considering that the preset rules may be updated, for example, the operation and maintenance personnel discovered some new types of malicious attacks and wrote preset rules to detect new types of malicious attacks, which were sent to the configuration service module 201 of the control plane 200 through the security center platform 300, and the configuration service module 201 notified the configuration storage module 202. In the embodiment of the present application, the configuration storage module 202 also provides a monitoring mechanism, and the security container 102 can monitor in real time whether the multiple preset rules stored in the configuration storage module 202 are updated. If it is determined that there are updated preset rules among the multiple preset rules, the updated preset rules are obtained and the preset rule base is updated.

[0103] In order to facilitate the operation and maintenance personnel to view the test results of each request, in a possible embodiment, please refer to Figure 5 , which is a schematic diagram of the structure of a security protection system based on microservice applications provided in an embodiment of the present application Figure 3 The security protection system includes a security center platform 300, a data plane 100 and a control plane 200. The data plane 100 and the control plane 200 run in a Kubernetes cluster, the control plane 200 includes a log collection module 203, and the security center platform 300 includes a user interface module 301, a web backend module 302 and a database module 303. The arrows indicate the flow of system logs. Figure 5 The security protection system shown introduces the process of displaying system logs.

[0104] After obtaining the detection result, the security container 102 generates a system log corresponding to the detection result, wherein the system log includes at least one of a log event, a log time, and a request method, the log event includes a normal traffic event and a malicious attack event, the log time indicates the local time when the system log is generated, and the request method includes a get request and a post request, the get request is used to request data from a specified server, and the post request is used to send data to a specified server to create or update resources, and the specified server is, for example, a server provided with the security protection system. If the log event is a malicious attack event, the system log may also include a matching rule and the type of malicious attack, and the matching rule indicates a preset rule in a plurality of preset rules of a preset rule base that matches the parameter information of the request.

[0105] Further, after the secure container 102 generates the system log, it sends the system log to the log collection module 203. The log collection module 203 can send the received system log to the user interface module 301 in real time for display, and the log collection module 203 can also receive and store the system log. The user interface module 301 can obtain and display the system log from the log collection module 203 in response to the operation of the operation and maintenance personnel, such as a click operation.

[0106] The embodiment of the present application deploys a security container between the Envoy container and the business container in a non-intrusive manner. The operation and maintenance personnel can write various rules for detecting malicious attacks and put them in the preset rule library of the security container. Its security capabilities can cover web server protection, HTTP access control, crawler protection, Webshell upload protection, illegal download restrictions, information leakage protection, hotlink protection, cross-site request forgery (CSRF), server-side request forgery (SSRF), etc., and can provide higher security protection for microservice applications. And because Istio also includes an ingress gateway and an egress gateway, it has certain security protection capabilities, so this application can provide all-round security protection for microservice applications.

[0107] Based on the same inventive concept, the embodiment of the present application provides a security protection method based on microservice applications, which is applied to the security container of the Pod of the security protection system described above, and the Pod also includes an Envoy container. Figure 6 , which is a flowchart of a security protection method based on microservice applications provided in an embodiment of the present application.

[0108] S601. Receive a user request for accessing a microservice application sent by an Envoy container, and extract parameter information of multiple preset parameter types from the request.

[0109] For details on how the secure container obtains requests and extracts parameter information, please refer to the previous discussion and will not be repeated here.

[0110] S602: Obtain the requested detection result according to whether there is parameter information matching a preset rule in a preset rule library among parameter information of multiple preset parameter types.

[0111] Among them, the preset rule library includes multiple preset rules, each preset rule includes parameter information of a malicious attack, and the detection result is used to indicate whether the request is normal traffic or a malicious attack. For the specific process of how the security container obtains the detection result, please refer to the content discussed in the previous article, which will not be repeated here.

[0112] S603: Send the detection result to the Envoy container.

[0113] The security container sends the detection results to the Envoy container, so that the Envoy container receives the detection results and executes the traffic policy corresponding to the detection results. For the specific process of how the Envoy container executes the traffic policy, please refer to the previous discussion, which will not be repeated here.

[0114] In a possible embodiment, the Pod further includes a business container, and a detection result is obtained according to whether parameter information of multiple preset parameter types includes parameter information that matches a preset rule in a preset rule base, including:

[0115] If parameter information of the plurality of preset parameter types does not contain parameter information matching the preset rule in the preset rule base, obtaining a first detection result that the request is normal traffic;

[0116] Send detection results to the Envoy container, including:

[0117] The first detection result is sent to the Envoy container, so that the Envoy container receives the first detection result and sends the request to the business container.

[0118] Among them, the specific process of how the security container obtains the first detection result and the process of how the business container processes the request can be referred to the content discussed above, which will not be repeated here.

[0119] In a possible embodiment, obtaining a detection result according to whether there is parameter information matching a preset rule in a preset rule base among parameter information of multiple preset parameter types includes:

[0120] If parameter information of the plurality of preset parameter types includes parameter information that matches a preset rule in a preset rule library, a second detection result indicating that the request is a malicious attack is obtained;

[0121] Send detection results to the Envoy container, including:

[0122] The second detection result is sent to the Envoy container, so that the Envoy container receives the second detection result and intercepts the request.

[0123] Among them, the specific process of how the safety container obtains the second detection result can be referred to the content discussed above, which will not be repeated here.

[0124] In a possible embodiment, the method further includes:

[0125] Monitor in real time whether multiple preset rules are updated. If it is determined that there is an updated preset rule among the multiple preset rules, obtain the updated preset rule and update the preset rule library.

[0126] Among them, the meaning of the preset rule base and preset rules can be found in the previous discussion, which will not be repeated here.

[0127] In a possible embodiment, after obtaining the detection result, the method further includes: generating a system log.

[0128] For the meaning of system logs and the specific process of how the secure container generates system logs, please refer to the previous discussion and will not be repeated here.

[0129] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes any of the microservice application-based security protection methods discussed above.

[0130] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0131] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0132] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0133] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0134] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A security protection system based on microservice applications, characterized in that: The system includes a container set Pod, wherein the Pod includes a proxy Envoy container and a security container, wherein: The security container is used to receive a user's request for accessing a microservice application sent by the Envoy container, extract parameter information of multiple preset parameter types from the request, obtain a detection result of the request according to whether there is parameter information matching a preset rule in a preset rule library among the parameter information of the multiple preset parameter types, and send the detection result to the Envoy container, wherein the preset rule library includes multiple preset rules, each preset rule includes parameter information of a malicious attack, and the detection result is used to indicate that the request is normal traffic or a malicious attack; The Envoy container is used to receive the detection result and execute a traffic policy corresponding to the detection result.

2. The system according to claim 1, characterized in that The Pod also includes a business container, wherein: The Envoy container is specifically used to receive the detection result, and if the detection result indicates that the request is normal traffic, send the request to the business container; The business container is used to receive the request and respond to the request.

3. The system according to claim 2, characterized in that The system includes multiple Pods, each Pod includes one Envoy container, one security container and one business container, and each Pod corresponds to a microservice application.

4. The system according to claim 1, characterized in that The Envoy container is specifically used to receive the detection result, and if the detection result indicates that the request is a malicious attack, intercept the request.

5. The system according to any one of claims 1 to 4, characterized in that: The system also includes a configuration storage module; The configuration storage module is used to store the multiple preset rules; The security container is also used to monitor in real time whether the multiple preset rules stored in the configuration storage module are updated. If it is determined that there are updated preset rules among the multiple preset rules, the updated preset rules are obtained and the preset rule library is updated.

6. The system according to any one of claims 1 to 4, characterized in that: The system also includes a log collection module and a user interface module; The security container is further used to generate a system log after obtaining the detection result, and send the system log to the log collection module; The log collection module is used to receive and store the system log; The user interface module is used to obtain and display the system log from the log collection module.

7. A security protection method based on microservice applications, characterized in that: The method is applied to a security container of a container set Pod of a security protection system, wherein the Pod also includes a proxy Envoy container, and the method includes: Receive a user access request to a microservice application sent by the Envoy container, and extract parameter information of multiple preset parameter types from the request; Obtaining a detection result of the request according to whether parameter information of the multiple preset parameter types includes parameter information that matches a preset rule in a preset rule base, wherein the preset rule base includes multiple preset rules, each preset rule includes parameter information of a malicious attack, and the detection result is used to indicate that the request is normal traffic or a malicious attack; The detection result is sent to the Envoy container, so that the Envoy container receives the detection result and executes a traffic policy corresponding to the detection result.

8. The method according to claim 7, characterized in that The Pod also includes a business container, and obtains a detection result according to whether there is parameter information matching a preset rule in a preset rule base in the parameter information of the multiple preset parameter types, including: If parameter information of the plurality of preset parameter types does not include parameter information matching the preset rule in the preset rule base, obtaining a first detection result that the request is normal traffic; Sending the detection result to the Envoy container includes: The first detection result is sent to the Envoy container, so that the Envoy container receives the first detection result and sends the request to the business container.

9. The method according to claim 7, characterized in that Obtaining a detection result according to whether there is parameter information matching a preset rule in a preset rule base among the parameter information of the plurality of preset parameter types, including: If parameter information of the plurality of preset parameter types includes parameter information that matches a preset rule in a preset rule library, obtaining a second detection result that the request is a malicious attack; Sending the detection result to the Envoy container includes: The second detection result is sent to the Envoy container, so that the Envoy container receives the second detection result and intercepts the request.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is enabled to execute the method according to any one of claims 7 to 9.

Images