Container protection connection method, device, equipment and medium based on middleware deployment

Abstract

The present invention discloses a container protection connection method, device, equipment and medium based on middleware deployment. The method includes: generating a service object and creating an endpoint object according to the service address of a cluster server, monitoring the container according to the endpoint object to obtain and store container monitoring information, judging whether the container has address drift according to the access information of the service object and the container monitoring information, and if address drift occurs, reconnecting the protection plug-in based on the container monitoring address of the mirror container. The present invention belongs to the field of network security technology and can generate middleware such as service objects and create endpoint objects. It is easy to judge whether address drift occurs through the deployed middleware monitoring. If address drift occurs, reconnecting the protection plug-in based on the container monitoring address of the mirror container is performed, thereby avoiding the protection plug-in from being unable to perform the anti-tampering monitoring function due to the drift of the sending container, and greatly improving the stability of protecting the container through the protection plug-in.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a container protection connection method, device, equipment and medium based on middleware deployment. Background Art

[0002] With the continuous development of Web applications and related technologies, the number of domain names has increased year by year, and the number of Web-related information security vulnerabilities has also risen accordingly. High-risk vulnerabilities exist in both corporate commercial websites and government and university websites. A large number of Web vulnerabilities have corresponding attack tools, but there are no better solutions. In addition, the number of related variants of various malware such as ransomware and mining is also very large. Common methods of tampering with application pages include vulnerability exploitation, SQL injection, XSS injection, etc. Docker is an open source application container engine. Using containers to host applications can greatly reduce overhead and improve performance, and therefore has been increasingly used. By configuring protection plug-ins for containers, data information in the container can be monitored for tamper-proofing. The protection plug-in can be used to avoid malware attacks and ensure the security of data information. However, in actual application, the configured container is easily migrated from one node in the cluster server to other nodes, that is, container drift occurs, which directly leads to the inability to use the anti-tampering monitoring function of the container. Therefore, the existing technical methods have the problem of unstable protection function when monitoring containers through protection plug-ins. Summary of the Invention

[0003] The embodiments of the present invention provide a container protection connection method, device, equipment and medium based on middleware deployment, which aims to solve the problem of unstable protection function when monitoring containers through protection plug-ins in the prior art.

[0004] In a first aspect, an embodiment of the present invention provides a container protection connection method based on middleware deployment, which is applied to a cluster server and includes:

[0005] Generate a corresponding service object according to the service address of the cluster server;

[0006] Create an endpoint object corresponding to each of the service objects according to the service objects;

[0007] Monitoring the container configured in the cluster server according to the endpoint object to obtain corresponding container monitoring information and store it;

[0008] determining whether address drift occurs in the container according to the access information of the service object and the container monitoring information;

[0009] If any of the containers has an address drift, the container monitoring information corresponding to the mirror container with the drifted address is obtained and the protection plug-in is reconfigured.

[0010] In a second aspect, an embodiment of the present invention provides a container protection connection device based on middleware deployment, which is configured in a cluster server and includes:

[0011] A service object generating unit, configured to generate a corresponding service object according to the service address of the cluster server;

[0012] An endpoint object creation unit, configured to create an endpoint object corresponding to each of the service objects according to the service objects;

[0013] a container monitoring information storage unit, configured to monitor the container configured in the cluster server according to the endpoint object to obtain and store corresponding container monitoring information;

[0014] An address drift determination unit, configured to determine whether address drift occurs in the container based on the access information of the service object and the container monitoring information;

[0015] The reconnection configuration unit is used to obtain container monitoring information corresponding to the mirror container with the drifted address and perform reconnection configuration of the protection plug-in if address drift occurs in any of the containers.

[0016] In the third aspect, an embodiment of the present invention further provides a computer device, which includes a memory, a processor, and a computer program stored on the memory and runnable on the processor. When the processor executes the computer program, it implements the container protection connection method based on middleware deployment as described in the first aspect above.

[0017] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, which, when executed by a processor, implements the container protection connection method based on middleware deployment as described in the first aspect above.

[0018] The embodiments of the present invention provide a container protection connection method, device, equipment and medium based on middleware deployment. A service object is generated according to the service address of the cluster server and an endpoint object is created. Dissolution is monitored according to the endpoint object to obtain container monitoring information and store it. Whether the container has address drift is determined based on the access information of the service object and the container monitoring information. If address drift occurs, the protection plug-in is reconnected and configured based on the container monitoring address of the mirror container. Through the above method, middleware such as service objects and endpoint objects can be generated. It is easy to determine whether address drift occurs through the deployed middleware monitoring. If address drift occurs, the protection plug-in is reconnected and configured based on the container monitoring address of the mirror container, thereby avoiding the protection plug-in from being unable to perform the anti-tampering monitoring function due to the drift of the sending container, and greatly improving the stability of the protection of the container by the protection plug-in. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 A schematic diagram of a process for a container protection connection method based on middleware deployment provided in an embodiment of the present invention;

[0021] Figure 2 A schematic diagram of another sub-process of the container protection connection method based on middleware deployment provided by an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of another sub-process of the container protection connection method based on middleware deployment provided by an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of another sub-process of the container protection connection method based on middleware deployment provided in an embodiment of the present invention;

[0024] Figure 5 Another schematic diagram of a flow chart of a container protection connection method based on middleware deployment provided by an embodiment of the present invention;

[0025] Figure 6 Another flowchart of the container protection connection method based on middleware deployment provided by an embodiment of the present invention;

[0026] Figure 7 A schematic diagram of the latter sub-process of the container protection connection method based on middleware deployment provided in an embodiment of the present invention;

[0027] Figure 8 A schematic block diagram of a container protection connection device based on middleware deployment provided by an embodiment of the present invention;

[0028] Figure 9 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0030] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0031] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the present invention. As used in the specification and appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0032] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0033] See also Figure 1 , Figure 1 A flow chart of a container protection connection method based on middleware deployment provided in an embodiment of the present invention; the container protection connection method based on middleware deployment is applied to a cluster server, and the container protection connection method based on middleware deployment is executed by application software installed in the cluster server. The cluster server can establish a network connection with other terminal devices to provide services to other terminal devices. The cluster server is a cluster processing server for executing the container protection connection method based on middleware deployment to connect the internally configured container with the protection plug-in through the deployed middleware. Figure 1 As shown, the method includes steps S110 to S150.

[0034] S110: Generate a corresponding service object according to the service address of the cluster server.

[0035] A corresponding service object is generated according to the service address of the cluster server. The cluster server is configured with multiple containers, and the containers can be protected by protection plug-ins to ensure that the data information stored in the container is not tampered with, which can also prevent the website network data from being tampered with, thereby maintaining the integrity of the data. The containers in the cluster server in this solution can protect static pages, dynamic web page files of various formats, pictures, audio, video, file names (including suffixes), file attributes and other data information. The protection can be based on the entire directory or a single file, or individual directories or files can be excluded for protection.

[0036] Specifically, a kubernetes service can be deployed in a cluster server. The kubernetes service can be used to obtain newly added containers. The kubernetes service is an abstraction of a set of containers with the same label. Other services inside and outside the cluster can communicate with each other through the kubernetes service. The kubernetes service can be obtained through CroeDNS deployed in the cluster server. The containers (pods) inside the cluster server communicate between the various services in the cluster through DNS, thereby obtaining the cluster address (cluster IP) configured corresponding to the kubernetes service in the cluster server, that is, obtaining the service address. The service in this embodiment exists in the form of a VIP (Cluster IP). The cluster IP type service is the default service exposure method of the kubernetes cluster. The kubernetes service can only be used for communication within the cluster and can be accessed by each container. After obtaining the service address, a service object can be generated according to the service address, that is, each service address can generate a service object. A service can correspond to multiple containers, that is, the service object can receive access from one or more containers.

[0037] S120: Create an endpoint object corresponding to each of the service objects according to the service objects.

[0038] An endpoint object corresponding to each of the service objects is created based on the service object. When a service object is generated, an endpoint object (endpoint object) will also be created. The endpoint is used for container discovery. The service only connects multiple containers. The actual routing and forwarding are all implemented by the kube-proxy component in the kubernetes cluster. Therefore, the service must be used in conjunction with kube-proxy. There are multiple nodes configured in the kubernetes cluster. Each node can be configured with a container or not. The kube-proxy component can run on every node in the kubernetes cluster, or it can only run on a few separate nodes. The kube-proxy component can adjust the routing rules stored in iptables or ipvs on the node according to changes in the service and endpoint objects.

[0039] S130: Monitor the container configured in the cluster server according to the endpoint object to obtain corresponding container monitoring information and store it.

[0040] The endpoint objects are used to monitor the containers configured in the cluster servers to obtain and store corresponding container monitoring information. The created endpoint objects can then be controlled by the endpoints controller configured in the management server. The endpoints controller is the controller that can be used to generate and maintain all endpoints objects. By maintaining node objects, it monitors changes in services and corresponding containers and updates the configuration of the endpoint objects corresponding to the services accordingly.

[0041] In one embodiment, if Figure 2 As shown, step S130 includes sub-steps S131 and S132.

[0042] S131 : Monitor, according to the controller of the endpoint object, a container corresponding to each of the endpoint objects configured in the cluster server to obtain container monitoring information.

[0043] Specifically, after the service object is generated and the endpoint object is created, the container configured in the cluster server can be monitored through the controller corresponding to the endpoint object. One or more containers can access the corresponding service object. Each service object corresponds to an endpoint object, and an endpoint object also corresponds to one or more containers. The container monitoring information of the container corresponding to each endpoint object can be obtained by corresponding monitoring.

[0044] S132: Determine whether the status information in the container monitoring information of each container is running.

[0045] The container monitoring information includes the status information of the container. It can be determined whether the status information in the container monitoring information is running. When the status of the container is running, it means that the container is ready.

[0046] S133: Acquire status information for monitoring information of the running container and store it in the corresponding endpoint object.

[0047] The container monitoring information may also include the corresponding container address, and the container monitoring information corresponding to the running container can be obtained. According to the correspondence between the container and the endpoint object, the container address of the running container and other related information are stored in the endpoint object corresponding to the container. Each endpoint object also stores the connection port provided by the service object corresponding to the endpoint object, that is, the discovery of the container corresponding to the service object is realized through the endpoint object (endpoints).

[0048] S140: Determine whether address drift occurs in the container according to the access information of the service object and the container monitoring information.

[0049] Determine whether the container has experienced address drift based on the access information of the service object and the container monitoring information. Determine whether the container has experienced address drift based on the access information of the service object and the container monitoring information. Specifically, this process can be implemented through the kube-proxy component configured in the cluster server. The kube-proxy component can monitor updated information in the service object and endpoint object and call its proxy module to refresh routing and forwarding rules on the nodes of the cluster server.

[0050] In one embodiment, if Figure 3 As shown, step S140 includes sub-steps S141, S142 and S143.

[0051] S141: Obtain an access address corresponding to the connection port in the access information.

[0052] Containers can access service objects, and service objects can record the access process to form access information. Containers access service objects in the following manner: container ---> service cluster IP: service port --> (iptables) DNAT (Destination Network Address Translation) --> container IP: container port. The service cluster IP: service port is the connection port that the container can use to connect to the service object. The container IP: container port is the container address used to access the current service object, also known as the access address. The access information includes the mapping between the connection port and the access address. The access address corresponding to the current service object's connection port can be obtained from the access information.

[0053] S142: Obtain a target container address corresponding to the connection port in the container monitoring information.

[0054] The container monitoring information contains the correspondence between the corresponding container and the service object. The correspondence between the container and the service object can be reflected by the correspondence between the connection port and the container address in the container monitoring information stored by the endpoint object. A connection port provided by the service object corresponds to a container address. A container address corresponding to the connection port in the access information can be obtained from the stored container monitoring information as the target container address.

[0055] S143: Determine whether the access address is inconsistent with the target container address, so as to determine whether the container corresponding to the target container address has address drift.

[0056] When a container migrates from one node to another, the access address for accessing the service object will also change accordingly. It can be determined whether the access address is inconsistent with the target container address. If they are inconsistent, it indicates that the container address has changed, that is, the container has experienced address drift. If the access address is consistent with the target container address, it indicates that the container address has not changed, that is, the container has not experienced address drift.

[0057] S150: If any of the containers has an address drift, obtain container monitoring information corresponding to the mirror container with the drifted address and perform reconnection configuration of the protection plug-in.

[0058] If any of the containers experience address drift, the container monitoring information corresponding to the mirrored container with the drifted address is obtained and the protection plug-in is reconfigured for reconnection. If it is determined that any container has experienced address drift, the drifted container can be determined as a mirrored container, and the protection plug-in is configured to connect to the initial container corresponding to the mirrored container. When the initial container drifts and migrates to another node, the connection established between the protection plug-in and the initial container cannot protect the data information stored in the container. Based on the container monitoring information corresponding to the mirrored container, the protection plug-in can be reconfigured for reconnection. The connection between the protection plug-in and the mirrored container is then reestablished, and the protection plug-in can protect and monitor the data information stored in the mirrored container.

[0059] In one embodiment, if Figure 4 As shown, step S150 includes sub-steps S151 and S152.

[0060] S151. Obtain a container address in the container monitoring information and associate it with a mirror address corresponding to the mirror container to obtain an associated address pair; S152. Reconnect and configure the protection plug-in with the mirror container according to the associated address pair.

[0061] The container address of the initial container corresponding to the mirrored container can be obtained from the container monitoring information. The container address can be associated with the mirrored container's mirrored address to obtain an associated address pair. Specifically, the two addresses can be associated to form an associated address pair using the command docker run-it -d --link container id mirror id. Based on the associated address pair, a reconnection configuration can be configured between the protection plug-in and the mirrored container. This reconnection between the protection plug-in and the mirrored container can then be reestablished, thereby reconnecting the protection plug-in on the host machine to the corresponding container. The protection plug-in is, in fact, the anti-tampering plug-in.

[0062] In one embodiment, if Figure 5 As shown, step S150 further includes step S160.

[0063] S160: Start the protection plug-in to monitor and protect data information in the container connected to the protection plug-in.

[0064] After configuring the protection plug-in to reconnect to the image container, you can start the protection plug-in to monitor the data information stored in the container connected to the protection plug-in. Protection monitoring is to protect the data information stored therein from tampering to prevent the data information from being illegally tampered with.

[0065] In one embodiment, if Figure 6 As shown, step S161 and S162 are included before step S160.

[0066] S161: Determine whether the image container is a newly added container according to a pre-stored container configuration table.

[0067] Specifically, the management server also stores a container configuration table, and can determine whether the mirror container is a newly added container based on the container configuration table. If the container address drift is caused only by the migration of a container configured on one node to a container already configured on another node, then the migrated container is an existing container, not a newly added container; if the container address drift is caused by the migration of a container configured on one node to another node and a new container is generated, then the migrated container is a newly generated container, that is, a newly added container. The container configuration table of the management server contains configuration information corresponding to each configured container, and the container feature information corresponding to the mirror container can be obtained, and the container feature information of the mirror container can be determined based on the container configuration table to determine whether it already exists in the container configuration table, thereby determining whether the mirror container is a newly added container. Among them, the container feature information includes feature information such as the container name, container code, and container generation time.

[0068] S162. If the image container is a newly added container, determine whether the newly added container meets the preset protection rules; if the newly added container meets the protection rules, execute the startup of the protection plug-in to monitor and protect the data information in the container connected to the protection plug-in.

[0069] The cluster server is also configured with protection rules to determine whether a newly added container meets the protection rules. If the newly added container meets the protection rules, it indicates that the newly added container requires monitoring and protection; if the newly added container does not meet the protection rules, it indicates that the newly added container does not require monitoring and protection. If the newly added container meets the protection rules, the subsequent step S160 is executed. If the newly added container does not meet the protection rules, the subsequent steps are not required. Not activating the protection plug-in to monitor and protect the newly added container can save cluster server system resources.

[0070] In one embodiment, if Figure 7 As shown, step S162 includes sub-steps S1621 and S1622.

[0071] S1621. Obtain the service type of the connection port corresponding to the newly added container.

[0072] The newly added container has accessed the corresponding service object and formed access information. The service type that matches the connection port can be determined based on the connection port in the corresponding access information of the newly added container. The service type is the service type provided by the service object for corresponding data processing. The service type can be personal information service, file information service, etc.

[0073] S1622: Determine whether the service type is a target service type configured in the protection rule to determine whether the newly added container satisfies the protection rule.

[0074] The protection rule is configured with multiple target service types. It can determine whether the service type corresponding to the connection port is included in the target service type, thereby determining whether the newly added container meets the protection rule. If the service type is included in the target service type, it indicates that the data information stored in the newly added container corresponding to the service type is very important and requires corresponding monitoring and protection. In this case, the newly added container is determined to meet the protection rule. Otherwise, the newly added container is determined not to meet the protection rule, which means that the data information stored in the newly added container corresponding to the service type is not important and does not require corresponding monitoring and protection.

[0075] In the container protection connection method based on middleware deployment provided in an embodiment of the present invention, a service object is generated and an endpoint object is created according to the service address of the cluster server. Dissolution is monitored according to the endpoint object to obtain and store container monitoring information. It is determined whether the container has address drift based on the access information of the service object and the container monitoring information. If address drift occurs, the protection plug-in is reconnected and configured based on the container monitoring address of the mirror container. Through the above method, middleware such as service objects and endpoint objects can be generated. It is easy to determine whether address drift occurs through the deployed middleware monitoring. If address drift occurs, the protection plug-in is reconnected and configured based on the container monitoring address of the mirror container, thereby avoiding the protection plug-in from being unable to perform the anti-tampering monitoring function due to the drift of the sending container, and greatly improving the stability of the protection of the container by the protection plug-in.

[0076] The embodiment of the present invention also provides a container protection connection device based on middleware deployment, which can be configured in a cluster server and is used to execute any embodiment of the container protection connection method based on middleware deployment. Figure 8 , Figure 8 A schematic block diagram of a container protection connection device based on middleware deployment provided in an embodiment of the present invention.

[0077] like Figure 8 As shown, the container protection connection device 100 based on middleware deployment includes a service object generation unit 110, an endpoint object creation unit 120, a container monitoring information storage unit 130, an address drift determination unit 140 and a reconnection configuration unit 150.

[0078] The service object generating unit 110 is configured to generate a corresponding service object according to the service address of the cluster server.

[0079] The endpoint object creation unit 120 is configured to create an endpoint object corresponding to each of the service objects according to the service objects.

[0080] The container monitoring information storage unit 130 is configured to monitor the container configured in the cluster server according to the endpoint object to obtain and store corresponding container monitoring information.

[0081] In a specific embodiment, the container monitoring information storage unit 130 includes subunits: a container monitoring information acquisition unit, which is used to monitor the container corresponding to each endpoint object configured in the cluster server according to the controller of the endpoint object to obtain container monitoring information; a status information judgment unit, which is used to judge whether the status information in the container monitoring information of each container is running; and an information storage unit, which is used to obtain container monitoring information whose status information is running and store it in the corresponding endpoint object.

[0082] The address drift determining unit 140 is configured to determine whether address drift occurs in the container according to the access information of the service object and the container monitoring information.

[0083] In a specific embodiment, the address drift determination unit 140 includes subunits: an access address acquisition unit, configured to acquire an access address corresponding to a connection port in the access information; a target container address acquisition unit, configured to acquire a target container address corresponding to the connection port in the container monitoring information; and an address determination unit, configured to determine whether the access address is inconsistent with the target container address, so as to determine whether address drift occurs in the container corresponding to the target container address.

[0084] The reconnection configuration unit 150 is configured to obtain container monitoring information corresponding to the image container with the drifted address and perform reconnection configuration of the protection plug-in if address drift occurs in any of the containers.

[0085] In a specific embodiment, the reconnection configuration unit 150 includes subunits: an address association unit, which is used to obtain the container address in the container monitoring information and the image address corresponding to the image container to associate to obtain an associated address pair; and a configuration unit, which is used to reconnect the protection plug-in with the image container according to the associated address pair.

[0086] In a specific embodiment, the container protection connection device 100 based on middleware deployment further includes a sub-unit: a monitoring and protection unit, which is used to start the protection plug-in to monitor and protect data information in the container connected to the protection plug-in.

[0087] In a specific embodiment, the container protection connection device 100 based on middleware deployment also includes sub-units: a mirror container judgment unit, which is used to judge whether the mirror container is a newly added container based on a pre-stored container configuration table; a new container judgment unit, which is used to judge whether the newly added container meets the preset protection rules if the mirror container is a newly added container; if the newly added container meets the protection rules, execute the steps corresponding to the monitoring and protection unit.

[0088] In a specific embodiment, the newly added container determination unit includes subunits: a service type acquisition unit, configured to acquire a service type of a connection port corresponding to the newly added container; and a service type determination unit, configured to determine whether the service type is a target service type configured in the protection rule, so as to determine whether the newly added container satisfies the protection rule.

[0089] The container protection connection device based on middleware deployment provided in the embodiment of the present invention applies the above-mentioned container protection connection method based on middleware deployment, generates a service object and creates an endpoint object according to the service address of the cluster server, monitors the dissolution according to the endpoint object to obtain container monitoring information and stores it, and determines whether the container has address drift based on the access information of the service object and the container monitoring information. If address drift occurs, the protection plug-in is reconnected and configured based on the container monitoring address of the mirror container. Through the above-mentioned method, middleware such as service objects and endpoint objects can be generated, and it is easy to determine whether address drift occurs through the deployed middleware monitoring. If address drift occurs, the protection plug-in is reconnected and configured based on the container monitoring address of the mirror container, thereby avoiding the protection plug-in from being unable to perform the anti-tampering monitoring function due to the drift of the sending container, and greatly improving the stability of the protection of the container by the protection plug-in.

[0090] The container protection connection device based on middleware deployment can be implemented in the form of a computer program. The computer program can be used in Figure 9 Runs on the computer equipment shown.

[0091] See also Figure 9 , Figure 9 1 is a schematic block diagram of a computer device provided by an embodiment of the present invention. The computer device may be a cluster server for executing a container protection connection method based on middleware deployment to connect an internally configured container with a protection plug-in through the deployed middleware.

[0092] See Figure 9 The computer device 500 includes a processor 502 , a memory, and a network interface 505 connected via a system bus 501 , wherein the memory may include a storage medium 503 and an internal memory 504 .

[0093] The storage medium 503 can store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, the processor 502 can execute a container protection connection method based on middleware deployment, wherein the storage medium 503 can be a volatile storage medium or a non-volatile storage medium.

[0094] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500.

[0095] The internal memory 504 provides an environment for the operation of the computer program 5032 in the storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute the container protection connection method based on the middleware deployment.

[0096] The network interface 505 is used for network communication to provide data information transmission, and the network communication is wired network communication and / or wireless network communication. Those skilled in the art will understand that Figure 9 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention and does not constitute a limitation on the computer device 500 to which the solution of the present invention is applied. The specific computer device 500 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0097] The processor 502 is used to run the computer program 5032 stored in the memory to implement the corresponding functions of the above-mentioned container protection connection method based on middleware deployment.

[0098] Those skilled in the art will understand that Figure 9 The embodiment of the computer device shown in the figure does not constitute a limitation on the specific composition of the computer device. In other embodiments, the computer device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, in some embodiments, the computer device may only include a memory and a processor. In such an embodiment, the structure and function of the memory and processor are the same as those in the figure. Figure 9 The embodiments shown are consistent and will not be described again here.

[0099] It should be understood that in the embodiment of the present invention, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0100] In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium. The computer-readable storage medium stores a first computer program, a second computer program, or a third computer program. When the first computer program is executed by a first processor, the second computer program is executed by a second processor, and the third computer program is executed by a third processor, the computer program implements the steps of the above-described container protection connection method based on middleware deployment.

[0101] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0102] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, or units with the same function may be combined into one unit. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be an electrical, mechanical or other form of connection.

[0103] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.

[0104] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0105] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a computer-readable storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned computer-readable storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk.

[0106] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and such modifications or substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A container protection connection method based on middleware deployment, characterized in that: The method is applied to a cluster server, and the method includes: Generate a corresponding service object according to the service address of the cluster server; Create an endpoint object corresponding to each of the service objects according to the service objects; Monitoring the container configured in the cluster server according to the endpoint object to obtain corresponding container monitoring information and store it; determining whether address drift occurs in the container according to the access information of the service object and the container monitoring information; If any of the containers has an address drift, obtain the container monitoring information corresponding to the mirror container with the drifted address and reconfigure the protection plug-in; Determining whether address drift occurs in the container according to the access information of the service object and the container monitoring information includes: Obtaining an access address corresponding to the connection port in the access information; Obtaining a target container address corresponding to the connection port in the container monitoring information; It is determined whether the access address is inconsistent with the target container address to determine whether the container corresponding to the target container address has address drift.

2. The container protection connection method based on middleware deployment according to claim 1 is characterized in that: The monitoring of the container configured in the cluster server according to the endpoint object to obtain corresponding container monitoring information and storing the information includes: monitoring, according to the controller of the endpoint object, a container corresponding to each of the endpoint objects configured in the cluster server to obtain container monitoring information; Determining whether the status information in the container monitoring information of each container is running; The acquired status information is the running container monitoring information stored in the corresponding endpoint object.

3. The container protection connection method based on middleware deployment according to claim 1 is characterized in that: The obtaining of container monitoring information corresponding to the image container with drifted address and performing reconnection configuration of the protection plug-in includes: Obtaining a container address in the container monitoring information and an image address corresponding to the image container, and associating them to obtain an associated address pair; The protection plug-in is reconnected and configured with the image container according to the associated address.

4. The container protection connection method based on middleware deployment according to claim 1 or 3 is characterized in that: After obtaining the container monitoring information corresponding to the image container with the drifted address and performing the reconnection configuration of the protection plug-in, the method further includes: The protection plug-in is started to monitor and protect the data information in the container connected to the protection plug-in.

5. The container protection connection method based on middleware deployment according to claim 4 is characterized in that: Also includes: Determine whether the image container is a newly added container according to a pre-stored container configuration table; If the image container is a newly added container, determine whether the newly added container meets the preset protection rules; If the newly added container meets the protection rule, the protection plug-in is started to monitor and protect the data information in the container connected to the protection plug-in.

6. The container protection connection method based on middleware deployment according to claim 5 is characterized in that: The determining whether the newly added container satisfies the preset protection rules includes: Obtain the service type of the connection port corresponding to the newly added container; It is determined that the service type is a target service type configured in the protection rule, so as to determine whether the newly added container satisfies the protection rule.

7. A container protection connection device based on middleware deployment, characterized in that: The device is configured in a cluster server, and includes: A service object generating unit, configured to generate a corresponding service object according to the service address of the cluster server; An endpoint object creation unit, configured to create an endpoint object corresponding to each of the service objects according to the service objects; a container monitoring information storage unit, configured to monitor the container configured in the cluster server according to the endpoint object to obtain and store corresponding container monitoring information; An address drift determination unit, configured to determine whether address drift occurs in the container based on the access information of the service object and the container monitoring information; A reconnection configuration unit, configured to obtain container monitoring information corresponding to the image container with the drifted address and perform reconnection configuration of the protection plug-in if address drift occurs in any of the containers; The address drift determination unit includes subunits: an access address acquisition unit, configured to acquire an access address corresponding to a connection port in the access information; a target container address acquisition unit, configured to acquire a target container address corresponding to the connection port in the container monitoring information; and an address determination unit, configured to determine whether the access address is inconsistent with the target container address, so as to determine whether address drift occurs in a container corresponding to the target container address.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the container protection connection method based on middleware deployment according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the container protection connection method based on middleware deployment as described in any one of claims 1 to 6.

Images