Container security authentication method, system, device and computer-readable storage medium

Abstract

The present disclosure provides a container security authentication method, system, device and computer-readable storage medium, which relates to the field of information technology. The container security authentication method includes: the container proxy service monitors the call instruction of the container in the edge computing gateway, obtains the container metadata, call action and call token, and sends a verification notification to the image authentication service, the verification notification carries the container metadata, call action and call token; the image authentication service verifies the container metadata and the call token; intercepts the call instruction in the case of verification failure, and sends an authorization notification to the operation authorization service in the case of verification success; the operation authorization service sends a container call authentication request to the cloud platform, and the call authentication request carries the call action; executes the call instruction in the case of receiving the call authorization response from the cloud platform, and intercepts the call instruction in the case of not receiving the call authorization response from the cloud platform. The present disclosure improves the security of the edge computing gateway.

Description

Technical Field

[0001] The present disclosure relates to the field of information technology, and in particular to a container security authentication method, system, device, and computer-readable storage medium. Background Art

[0002] As edge devices gradually become more universal, traditional cloud services are gradually being deployed to edge computing gateways. Due to the complexity of the services, containerized deployment is often used when deploying services. However, the resources and computing power of edge computing gateways are limited, so the resource allocation and security management issues of containers on edge computing gateways are gradually becoming prominent. Summary of the invention

[0003] One technical problem solved by the present disclosure is how to improve the security of edge computing gateways.

[0004] According to one aspect of an embodiment of the present disclosure, a container security authentication method is provided, including: a container proxy service monitors a call instruction to a container in an edge computing gateway, obtains container metadata, a call action, and a call token, and sends a verification notification to an image authentication service, the verification notification carries the container metadata, the call action, and the call token; the image authentication service verifies the container metadata and the call token; if the verification fails, the call instruction is intercepted, and if the verification succeeds, an authorization notification is sent to an operation authorization service; the operation authorization service sends a container call authentication request to a cloud platform, and the call authentication request carries a call action; if a call authorization response is received from the cloud platform, the call instruction is executed, and if a call authorization response is not received from the cloud platform, the call instruction is intercepted.

[0005] In some embodiments, executing a call instruction includes: an operation authorization service forwarding a call authorization response to an image authentication service; the image authentication service forwarding a call authorization response to a container proxy service; the container proxy service sending a call instruction execution notification to a container runtime daemon, the call instruction execution notification carrying container metadata and a call action to notify the container runtime daemon to execute a call action on the container corresponding to the container metadata; a resource monitoring service receiving an execution result sent by the container runtime daemon, triggering monitoring of the container resource occupancy ratio, and sending the container resource occupancy ratio to the container proxy service; the container proxy service stops the call action when the container resource occupancy ratio is greater than a preset threshold.

[0006] In some embodiments, the stopping calling action includes: stopping starting the container image file that was started last time.

[0007] In some embodiments, the container metadata includes a container identifier, a process identifier, and container resource occupied data; the calling action includes downloading a container image file, starting a container image file, deleting a container image file, modifying a container image file, and stopping and starting a container image file.

[0008] In some embodiments, the image authentication service verifies the container metadata and the call token, including: the image authentication service verifies the container metadata using pre-stored metadata information; the image authentication service verifies the call token using pre-stored token information.

[0009] In some embodiments, the container security authentication method also includes: the container proxy service monitors the call instructions to the container in the edge computing gateway to obtain user permissions; the container proxy service sends a verification notification to the image authentication service when the user permissions are super permissions, and intercepts the call instructions when the user permissions are ordinary permissions.

[0010] According to another aspect of an embodiment of the present disclosure, a container security authentication system is provided, including: a container proxy service, configured to: listen to call instructions for containers in an edge computing gateway, obtain container metadata, call actions and call tokens, and send a verification notification to an image authentication service, the verification notification carrying the container metadata, call actions and call tokens; the image authentication service, configured to: verify the container metadata and the call token; intercept the call instruction if the verification fails, and send an authorization notification to an operation authorization service if the verification succeeds; the operation authorization service, configured to: send a container call authentication request to a cloud platform, the call authentication request carries a call action; execute the call instruction if a call authorization response is received from the cloud platform, and intercept the call instruction if a call authorization response is not received from the cloud platform.

[0011] In some embodiments, the container security authentication system also includes a resource monitoring service. The operation authorization service is configured to forward the call authorization response to the image authentication service; the image authentication service is configured to forward the call authorization response to the container proxy service; the container proxy service is configured to send a call instruction execution notification to the container runtime daemon, and the call instruction execution notification carries the container metadata and the call action to notify the container runtime daemon to execute the call action on the container corresponding to the container metadata; the resource monitoring service is configured to receive the execution result sent by the container runtime daemon, trigger the monitoring of the container resource occupancy ratio, and send the container resource occupancy ratio to the container proxy service; the container proxy service is configured to stop the call action when the container resource occupancy ratio is greater than the preset threshold.

[0012] In some embodiments, the stopping calling action includes: stopping starting the container image file that was started last time.

[0013] In some embodiments, the container metadata includes a container identifier, a process identifier, and container resource occupied data; the calling action includes downloading a container image file, starting a container image file, deleting a container image file, modifying a container image file, and stopping and starting a container image file.

[0014] In some embodiments, the image authentication service is configured to: verify the container metadata using pre-stored metadata information; and verify the call token using pre-stored token information.

[0015] In some embodiments, the container proxy service is further configured to: listen to the call instructions to the container in the edge computing gateway to obtain user permissions; send a verification notification to the image authentication service when the user permissions are super permissions; and intercept the call instructions when the user permissions are ordinary permissions.

[0016] According to another aspect of an embodiment of the present disclosure, a container security authentication device is provided, including: a memory; and a processor coupled to the memory, wherein the processor is configured to execute the aforementioned container security authentication method based on instructions stored in the memory.

[0017] According to another aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the aforementioned container security authentication method is implemented.

[0018] In the environment where edge computing gateways are deployed using containers, this embodiment of the present disclosure proxies, authenticates, and authorizes containers and images in edge computing gateways, which can not only ensure that images are trustworthy to avoid illegal startup of containers, but also confirm to the cloud platform whether the user has the authority corresponding to the call action in the call instruction, and whether the call instruction is an operation issued by the user himself to avoid misoperation. Therefore, this embodiment can supervise the legitimacy of the container, effectively control a series of operations on the container, avoid the installation and deployment of bad applications, and thus improve the security of the edge computing gateway.

[0019] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0021] Figure 1 A schematic diagram of a process flow of a container security authentication method according to some embodiments of the present disclosure is shown.

[0022] Figure 2 A flowchart diagram of some embodiments of executing a call instruction is shown.

[0023] Figure 3 A schematic diagram of the structure of a container security authentication system according to some embodiments of the present disclosure is shown.

[0024] Figure 4 Shows the intention of deploying a security authentication system on the edge computing gateway.

[0025] Figure 5 A schematic structural diagram of a container safety authentication device according to some embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present disclosure and its application or use. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0027] The inventor has found through research that there are many network applications on the edge computing gateway, including many business and non-business applications, which require a variety of technologies and resources to support them, resulting in large differences in the requirements of different applications for the environment and resources. Illegally installed application containers and containers with high resource occupancy rates often have serious negative impacts on the edge computing gateway and other network management applications during operation, often causing the gateway to crash due to excessive computing overhead, and making the gateway data and user data in an unsafe state. If the edge computing gateway monitors and controls the security of the container image and the resources occupied by the image after containerization, it will help the smooth, safe and reliable operation of applications on the edge computing gateway.

[0028] In view of this, the inventor proposes a container security authentication method, firstly combining Figure 1 Some embodiments of the container security authentication method disclosed in the present disclosure are described. In this embodiment, monitoring and management functions are integrated into the edge computing gateway architecture to implement container proxy services, image authentication services, operation authorization services, and resource monitoring services.

[0029] Figure 1A schematic diagram of a process flow of a container security authentication method according to some embodiments of the present disclosure is shown. Figure 1 As shown, this embodiment includes steps S101 to S109.

[0030] In step S101, the container proxy service listens for the call instruction to the container in the edge computing gateway.

[0031] The cloud platform sends image metadata and call actions to the edge computing gateway based on the MAC address of the edge computing gateway and the negotiated key. After the message proxy server verifies the source address and destination address of the message, it establishes a connection with the communication proxy client on the edge computing gateway side and completes the authentication process. Subsequently, the message proxy server sends the image metadata and call actions to the communication proxy client. The edge computing gateway can start a listening process at the application layer through the container proxy service. The listening process is bound to the container daemon, that is, a socket data channel is formed with the container daemon, and the call and management of the container can be monitored. Those skilled in the art should understand that when calling and managing containers, a call instruction is usually sent to the container daemon, and then the container daemon calls the container runtime daemon to execute the call action.

[0032] In step S102, the container proxy service obtains container metadata, a call action, and a call token.

[0033] The container metadata may include the container identifier, process identifier, and container resource usage data, etc. The container resource usage data may include, for example, data on CPU, memory, and other resources. The call action may include downloading a container image file, starting a container image file, deleting a container image file, modifying a container image file, and stopping and starting a container image file. The container proxy service may obtain container metadata, call actions, and call tokens by calling a socket application program interface.

[0034] In step S103, the container proxy service sends a verification notification to the image authentication service, wherein the verification notification carries container metadata, a call action, and a call token.

[0035] In some embodiments, the container proxy service monitors the call instructions for the container in the edge computing gateway and obtains the user's authority. Then, the container proxy service sends a verification notification to the image authentication service if the user's authority is a super authority, and intercepts the call instructions if the user's authority is a normal authority.

[0036] In step S104, the image authentication service verifies the container metadata and the call token.

[0037] For example, the image authentication service uses pre-stored metadata information to verify the container metadata. For another example, the image authentication service uses pre-stored token information to verify the call token.

[0038] If the verification fails, step S105 is executed. In step S105, the image authentication service intercepts the call instruction.

[0039] If the verification is successful, step S106 is executed. In step S106, the image authentication service sends an authorization notification to the operation authorization service.

[0040] In step S107, the operation authorization service sends a container call authentication request to the cloud platform.

[0041] The call authentication request carries a call action.

[0042] In step S108, the operation authorization service receives a call authorization response from the cloud platform.

[0043] In case a call authorization response is received from the cloud platform, step S109 is executed. In step S109, the operation authorization service executes the call instruction.

[0044] If no call authorization response is received from the cloud platform, step S110 is executed. In step S110, the intercept call instruction is executed.

[0045] In the environment where edge computing gateways are deployed using containers, this embodiment proxies, authenticates, and authorizes containers and images in edge computing gateways, which can not only ensure that images are trustworthy to avoid illegal startup of containers, but also confirm to the cloud platform whether the user has the authority corresponding to the call action in the call instruction, and whether the call instruction is an operation issued by the user himself to avoid misoperation. Therefore, this embodiment can supervise the legitimacy of the container, effectively control a series of operations on the container, avoid the installation and deployment of bad applications, and thus improve the security of the edge computing gateway.

[0046] Combine the following Figure 2 Some embodiments of executing a call instruction are described.

[0047] Figure 2 Schematic diagram of the process of executing some embodiments of the call instruction is shown. Figure 2 As shown, this embodiment includes steps S2091 to S2095.

[0048] In step S2091, the operation authorization service forwards the call authorization response to the mirror authentication service.

[0049] In step S2092, the image authentication service forwards the call authorization response to the container proxy service.

[0050] In step S2093, the container proxy service sends a call instruction execution notification to the container runtime daemon process.

[0051] The call instruction execution notification carries the container metadata and the call action to notify the container runtime daemon to execute the call action on the container corresponding to the container metadata. After the container runtime daemon executes the relevant call action, it returns the execution result to the resource monitoring service within the specified time, and the execution result can be, for example, the successful opening of the image file.

[0052] In step S2094, the resource monitoring service receives the execution result sent by the container runtime daemon process, and triggers monitoring of the container resource occupancy ratio.

[0053] In step S2095 , the resource monitoring service sends the container resource occupancy ratio to the container proxy service.

[0054] Those skilled in the art should understand that the resource monitoring service may send the execution result to the container proxy service at the same time as sending the container resource occupancy ratio to the container proxy service.

[0055] In step S2096, the container proxy service stops the calling action when the container resource occupancy ratio is greater than a preset threshold.

[0056] The container proxy service can send the container resource usage ratio and execution results to the communication proxy client, which forwards it to the message proxy server, and then the message proxy server notifies the cloud platform to stop the call action. The specific stop call action can be, for example, stopping the start of the most recently started container image file.

[0057] After the image is instantiated, this embodiment can monitor the real-time status of the container locally through the resource monitoring service when the container is running, meet the management and control requirements for containers with high resource occupancy, and perform local and direct management and control of containers with excessively high resource occupancy. When an abnormal situation occurs, the resource monitoring service can promptly notify the container proxy service to shut down the relevant container, thereby ensuring that the container is manageable and controllable, ensuring the normal state of the edge computing gateway, ensuring that the edge computing gateway can communicate normally with the cloud platform, and avoiding the situation where the edge computing gateway cannot communicate with the cloud platform due to excessive resource consumption. Therefore, this embodiment can make the container running on the edge computing gateway more reliable and secure, and ensure the coordination and security of the edge computing gateway. For container applications installed through legal processes, when the container resource occupancy ratio is too high, the relevant activities of the container can be quickly stopped on the local side, so that other services on the edge computing gateway can run safely and reliably.

[0058] Combine the following Figure 3 Some embodiments of the container security authentication system disclosed herein are described.

[0059] Figure 3 FIG. 1 is a schematic diagram showing the structure of a container security authentication system according to some embodiments of the present disclosure. Figure 3 As shown, the container security authentication system 30 in this embodiment includes: a container proxy service 301, which is configured to: listen to the call instructions of the container in the edge computing gateway, obtain the container metadata, call action and call token, and send a verification notification to the image authentication service, the verification notification carries the container metadata, call action and call token; the image authentication service 302, which is configured to: verify the container metadata and the call token; intercept the call instruction if the verification fails, and send an authorization notification to the operation authorization service if the verification succeeds; the operation authorization service 303, which is configured to: send a container call authentication request to the cloud platform, the call authentication request carries the call action; execute the call instruction if a call authorization response is received from the cloud platform, and intercept the call instruction if a call authorization response is not received from the cloud platform.

[0060] In the environment where edge computing gateways are deployed using containers, this embodiment proxies, authenticates, and authorizes containers and images in edge computing gateways, which can not only ensure that images are trustworthy to avoid illegal startup of containers, but also confirm to the cloud platform whether the user has the authority corresponding to the call action in the call instruction, and whether the call instruction is an operation issued by the user himself to avoid misoperation. Therefore, this embodiment can supervise the legitimacy of the container, effectively control a series of operations on the container, avoid the installation and deployment of bad applications, and thus improve the security of the edge computing gateway.

[0061] In some embodiments, the container security authentication system 30 also includes a resource monitoring service 304. The operation authorization service 303 is configured to forward the call authorization response to the image authentication service; the image authentication service 302 is configured to forward the call authorization response to the container proxy service; the container proxy service 301 is configured to send a call instruction execution notification to the container runtime daemon, and the call instruction execution notification carries the container metadata and the call action to notify the container runtime daemon to execute the call action on the container corresponding to the container metadata; the resource monitoring service 304 is configured to monitor the container resource occupancy ratio and send the container resource occupancy ratio to the container proxy service; the container proxy service 301 is configured to stop the call action when the container resource occupancy ratio is greater than the preset threshold.

[0062] After the image is instantiated, this embodiment can monitor the real-time status of the container locally through the resource monitoring service when the container is running, meet the management and control needs for containers with high resource occupancy, and perform local and direct management and control of containers with excessive resource occupancy. When an abnormal situation occurs, the resource monitoring service can promptly notify the container proxy service to shut down the relevant container, thereby ensuring that the container is manageable and controllable, ensuring the normal state of the edge computing gateway, ensuring that the edge computing gateway can communicate normally with the cloud platform, and avoiding the situation where the edge computing gateway cannot communicate with the cloud platform due to excessive resource consumption. Therefore, this embodiment can make the container running on the edge computing gateway more reliable and secure, and ensure the coordination and security of the edge computing gateway. For container applications installed through legal processes, when the container resource occupancy ratio is too high, the relevant activities of the container can be quickly stopped on the local side, so that other services on the edge computing gateway can run safely and reliably.

[0063] In some embodiments, the stopping calling action includes: stopping starting the container image file that was started last time.

[0064] In some embodiments, the container metadata includes a container identifier, a process identifier, and container resource occupied data; the calling action includes downloading a container image file, starting a container image file, deleting a container image file, modifying a container image file, and stopping and starting a container image file.

[0065] In some embodiments, the image authentication service 302 is configured to: verify the container metadata using pre-stored metadata information; and verify the call token using pre-stored token information.

[0066] In some embodiments, the container proxy service is further configured to: listen to the call instructions to the container in the edge computing gateway and obtain user permissions; send a verification notification to the image authentication service when the user permissions are super permissions; and intercept the call instructions when the user permissions are ordinary permissions.

[0067] Combine the following Figure 4 Describes an application example of deploying a secure authentication system in an edge computing gateway.

[0068] Figure 4 The intention of deploying a security authentication system on the edge computing gateway is shown. Figure 4As shown, the edge computing gateway can use a general-purpose ARM or x86 architecture CPU chip, and a general-purpose Linux operating system is installed in the edge computing gateway, including but not limited to Ubuntu, Centos, etc. The edge computing gateway also needs to install container virtualization software and communication software to provide support for container virtualization and gateway communication and management. For ordinary privileged users, user privileges are used to restrict users from further operations on containers; for super users, the security authentication system can prevent users from directly or indirectly operating the installation and use of illegal containers during container runtime by supervising the process proxy virtualization runtime, thereby ensuring the credibility of the running images and containers.

[0069] Combine the following Figure 5 Some embodiments of the container security authentication device disclosed herein are described.

[0070] Figure 5 The schematic diagram of the structure of the container safety authentication device of some embodiments of the present disclosure is shown. Figure 5 As shown, the container security authentication device 50 of this embodiment includes: a memory 510 and a processor 520 coupled to the memory 510, and the processor 520 is configured to execute the container security authentication method in any of the aforementioned embodiments based on instructions stored in the memory 510.

[0071] The memory 510 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, and other programs.

[0072] The container security authentication device 50 may also include an input / output interface 530, a network interface 540, a storage interface 550, etc. These interfaces 530, 540, 550, the memory 510, and the processor 520 may be connected, for example, via a bus 560. The input / output interface 530 provides a connection interface for input / output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 540 provides a connection interface for various networked devices. The storage interface 550 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0073] The present disclosure also includes a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the container security authentication method in any of the aforementioned embodiments.

[0074] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0076] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0077] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure should be included in the protection scope of the present disclosure.

Claims

1. A container security authentication method, comprising: The container proxy service monitors the call instructions for the container in the edge computing gateway, obtains the user authority, container metadata, call action and call token, and sends a verification notification to the image authentication service if the user authority is a super authority. The verification notification carries the container metadata, the call action and the call token, and intercepts the call instruction if the user authority is a normal authority. The image authentication service verifies the container metadata and the call token; If the verification fails, the calling instruction is intercepted, and if the verification succeeds, an authorization notification is sent to the operation authorization service; The operation authorization service sends a container call authentication request to the cloud platform, and the call authentication request carries the call action; executes the call instruction when a call authorization response is received from the cloud platform, and intercepts the call instruction when no call authorization response is received from the cloud platform.

2. The container security authentication method according to claim 1, wherein: The executing of the calling instruction comprises: The operation authorization service forwards the call authorization response to the image authentication service; The image authentication service forwards the call authorization response to the container proxy service; The container proxy service sends a call instruction execution notification to the container runtime daemon process, where the call instruction execution notification carries the container metadata and the call action, so as to notify the container runtime daemon process to execute the call action on the container corresponding to the container metadata; The resource monitoring service receives the execution result sent by the daemon process when the container is running, triggers the monitoring of the container resource occupancy ratio, and sends the container resource occupancy ratio to the container proxy service; The container proxy service stops the calling action when the container resource occupancy ratio is greater than a preset threshold.

3. The container security authentication method according to claim 2, wherein: The stopping the calling action includes: stopping starting the container image file that was started last time.

4. The container security authentication method according to claim 1, wherein: The container metadata includes a container identifier, a process identifier, and container resource occupancy data; The calling action includes downloading a container image file, starting a container image file, deleting a container image file, modifying a container image file, and stopping and starting a container image file.

5. The container security authentication method according to claim 1, wherein: The image authentication service verifies the container metadata and the call token including: The image authentication service verifies the container metadata using pre-stored metadata information; The image authentication service verifies the calling token using pre-stored token information.

6. A container security authentication system, comprising: The container proxy service is configured to: monitor the call instruction of the container in the edge computing gateway, obtain the user authority, container metadata, call action and call token, and send a verification notification to the image authentication service when the user authority is a super authority, the verification notification carries the container metadata, the call action and the call token, and intercept the call instruction when the user authority is a normal authority; The image authentication service is configured to: verify the container metadata and the call token; If the verification fails, the calling instruction is intercepted, and if the verification succeeds, an authorization notification is sent to the operation authorization service; The operation authorization service is configured to: send a container call authentication request to the cloud platform, the call authentication request carries the call action; execute the call instruction when a call authorization response is received from the cloud platform, and intercept the call instruction when no call authorization response is received from the cloud platform.

7. The container security authentication system according to claim 6 further comprises a resource monitoring service; wherein: The operation authorization service is configured to: forward the call authorization response to the image authentication service; The image authentication service is configured to: forward the call authorization response to the container proxy service; The container proxy service is configured to: send a call instruction execution notification to the container runtime daemon process, where the call instruction execution notification carries the container metadata and the call action, so as to notify the container runtime daemon process to execute the call action on the container corresponding to the container metadata; The resource monitoring service is configured to: receive the execution result sent by the container runtime daemon process, trigger monitoring of the container resource occupancy ratio, and send the container resource occupancy ratio to the container proxy service; The container proxy service is configured to: stop the calling action when the container resource occupancy ratio is greater than a preset threshold.

8. The container security authentication system according to claim 7, wherein: The stopping the calling action includes: stopping starting the container image file that was started last time.

9. The container security authentication system according to claim 6, wherein: The container metadata includes a container identifier, a process identifier, and container resource occupancy data; The calling action includes downloading a container image file, starting a container image file, deleting a container image file, modifying a container image file, and stopping and starting a container image file.

10. The container security authentication system according to claim 6, wherein: The image authentication service is configured as follows: Verifying the container metadata using pre-stored metadata information; The calling token is verified using pre-stored token information.

11. A container safety authentication device, comprising: Memory; as well as A processor coupled to the memory, wherein the processor is configured to execute the container security authentication method according to any one of claims 1 to 5 based on instructions stored in the memory.

12. A computer-readable storage medium, wherein: The computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the container security authentication method according to any one of claims 1 to 5 is implemented.

Images