Program access control method, device, electronic device and storage medium

Abstract

The embodiment of the present application provides a program access control method, device, electronic device and storage medium, wherein the method includes: adding a sidecar container to a program execution container group; intercepting traffic entering the program execution container group by using the sidecar container; converting the traffic into a configuration format to obtain traffic recognizable by the sidecar container; browsing the traffic recognizable by the sidecar container; reading the identity in the recognizable traffic through the sidecar container; and releasing the traffic according to the identity. The implementation of the embodiment of the present application makes the program lighter and more concise, while reducing the difficulty and efficiency of writing.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a program access control method, device, electronic device, and computer-readable storage medium. Background Art

[0002] There are generally three types of access control methods in enterprise environments: autonomous access control methods. At present, the access control modules in most information systems in my country basically rely on access control lists in autonomous access control methods; mandatory access control methods are used in military applications with multi-level security levels. Role-Based Access Control (RBAC) is currently recognized as an effective method to solve the unified resource access control of large enterprises.

[0003] Currently, common RBAC is implemented based on code, which means that programmers have to take permission control into consideration when writing business code. There will be a large number of logical branches for permission control in the business code, which makes the code in the program bloated, affects the simplicity of the program, and increases the difficulty and efficiency of writing. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a program access control method, device, electronic device and computer-readable storage medium, so as to make the program lighter and more concise, while reducing the difficulty of writing and improving the efficiency of writing.

[0005] In a first aspect, an embodiment of the present application provides a program access control method, the method comprising:

[0006] Add the sidecar container to the program execution container group;

[0007] Using the sidecar container to intercept traffic entering the program execution container group;

[0008] Convert the traffic into a configuration format to obtain traffic recognizable by the sidecar container;

[0009] Browse the traffic that can be identified by the sidecar container;

[0010] Reading the identity in the identifiable traffic through the sidecar container;

[0011] The traffic is released according to the identity identifier.

[0012] In the above implementation process, a sidecar container is added as a bridge between programs. The traffic entering the program is intercepted and detected through the sidecar container to ensure that the traffic entering the program is feasible and safe. At the same time, the size of the program is reduced, making the program more concise.

[0013] Furthermore, the step of intercepting traffic entering the program execution container group by using the sidecar container includes:

[0014] Obtaining the IP address of the traffic;

[0015] Determining whether the IP address of the traffic is identifiable by the program execution container group;

[0016] If so, send an instruction to the sidecar container to enable the sidecar container to set up a firewall to intercept the traffic.

[0017] In the above implementation process, the identifiable programs entering the program are intercepted by the sidecar container to ensure that the traffic entering the program is the corresponding traffic of the program, reduce the processing and identification process of the subsequent program on the traffic, and reduce the complexity of the program.

[0018] Furthermore, the step of converting the traffic into a configuration format to obtain traffic recognizable by the sidecar container includes:

[0019] Obtaining request parameters in the traffic;

[0020] The traffic is converted into traffic recognizable by the sidecar container according to the request parameters.

[0021] In the above implementation process, the traffic is converted into traffic that can be recognized by the sidecar container according to the specific request parameters in the traffic, which further facilitates the subsequent detection of the traffic by the sidecar container, avoids the tedious steps of the program to detect the traffic, and reduces the difficulty of program writing.

[0022] Furthermore, the step of releasing the traffic according to the identity includes:

[0023] Obtaining traffic policy and permission information in the identity;

[0024] If the permission information complies with the traffic policy, the traffic is released.

[0025] In the above implementation process, it is determined whether the permission information in the identity identifier complies with the traffic policy. If so, it can save the time for subsequent programs to process the traffic, while improving the efficiency of program writing and receiving traffic.

[0026] In a second aspect, an embodiment of the present application further provides a program access control device, the device comprising:

[0027] Add module for adding sidecar containers to the program execution container group;

[0028] An interception module, used to intercept traffic entering the program execution container group using the sidecar container;

[0029] A conversion module, used to convert the traffic into a configuration format to obtain traffic recognizable by the sidecar container;

[0030] A browsing module, used to browse the traffic identifiable by the sidecar container;

[0031] A reading module, configured to read an identity in the identifiable traffic through the sidecar container;

[0032] A receiving module is used to release the traffic according to the identity identifier.

[0033] In the above implementation process, a sidecar container is added as a bridge between programs. The traffic entering the program is intercepted and detected through the sidecar container to ensure that the traffic entering the program is feasible and safe. At the same time, the size of the program is reduced, making the program more concise.

[0034] Furthermore, the interception module is also used for:

[0035] Obtaining the IP address of the traffic;

[0036] Determining whether the IP address of the traffic is identifiable by the program execution container group;

[0037] If so, send an instruction to the sidecar container to enable the sidecar container to set up a firewall to intercept the traffic.

[0038] In the above implementation process, the identifiable programs entering the program are intercepted by the sidecar container to ensure that the traffic entering the program is the corresponding traffic of the program, reduce the processing and identification process of the subsequent program on the traffic, and reduce the complexity of the program.

[0039] Furthermore, the conversion module is also used for:

[0040] Obtaining request parameters in the traffic;

[0041] The traffic is converted into traffic recognizable by the sidecar container according to the request parameters.

[0042] In the above implementation process, the traffic is converted into traffic that can be recognized by the sidecar container according to the specific request parameters in the traffic, which further facilitates the subsequent detection of the traffic by the sidecar container, avoids the tedious steps of the program to detect the traffic, and reduces the difficulty of program writing.

[0043] Furthermore, the receiving module is also used for:

[0044] Obtaining traffic policy and permission information in the identity;

[0045] If the permission information complies with the traffic policy, the traffic is released.

[0046] In the above implementation process, matching the permission information in the identity with the program information in the sidecar container can save the time for subsequent programs to process traffic, while improving the efficiency of program writing and receiving traffic.

[0047] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the first aspects when executing the computer program.

[0048] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the first aspects.

[0049] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when running on a computer, enables the computer to execute the method as described in any one of the first aspects.

[0050] Other features and advantages of the present disclosure will be set forth in the following description, or some features and advantages may be inferred or unambiguously determined from the description, or may be learned by implementing the above-mentioned technology of the present disclosure.

[0051] And it can be implemented according to the contents of the specification. The following is a detailed description of the preferred embodiments of the present application with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0053] Figure 1 A flowchart of a program access control method provided in an embodiment of the present application;

[0054] Figure 2 A schematic diagram of the structure of a program access control device provided in an embodiment of the present application;

[0055] Figure 3 A schematic diagram of the structural composition of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0057] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0058] The specific implementation methods of the present application are further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present application but are not intended to limit the scope of the present application.

[0059] Embodiment 1

[0060] Figure 1 is a flowchart of a program access control method provided by an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0061] S1, add the sidecar container to the program execution container group;

[0062] S2, uses the sidecar container to intercept traffic entering the program execution container group;

[0063] S3, converts the traffic into a configuration format to obtain traffic that can be recognized by the sidecar container;

[0064] S4, browses the traffic identifiable by the sidecar container;

[0065] S5, reads the identity in the identifiable traffic through the sidecar container;

[0066] S6: Release the traffic based on the identity tag.

[0067] Taking this embodiment as an example, a sidecar container is added as a bridge between programs. The traffic entering the program is intercepted and detected through the sidecar container to ensure that the traffic entering the program is feasible and safe, while reducing the size of the program and making the program more concise.

[0068] The embodiment of the present application is implemented based on a unified distributed system, which sinks the RBAC permission management function to the bottom layer of the system, so that programmers do not have to control various permissions in the code, but only need to focus on business logic, thereby improving programmer development efficiency.

[0069] The overall system is implemented at the bottom layer using container technology, and container orchestration is performed by a unified container orchestration system. Optionally, the container orchestration system can be kubernetes (K8s), and the program execution container group is called a pod. Each service consists of a group of pods. A pod can contain multiple containers. Generally, only one application (referred to as the program) is deployed in a pod. In the embodiment of the present application, a container is injected into a pod, and the container is in the same pod as the application. The injected container is called a sidecar container. The sidecar program is a high-performance agent written in C++. When sidecar is started, IPtables (IP packet filtering system integrated in the Linux kernel, i.e., a firewall) is automatically set to intercept all traffic in and out of the program, Internet Protocol (IP).

[0070] Furthermore, S2 includes:

[0071] Get the IP address of the traffic;

[0072] Determine whether the IP address of the traffic is identifiable by the program execution container group;

[0073] If so, send instructions to the sidecar container to set up a firewall to intercept the traffic.

[0074] Taking this embodiment as an example, the identifiable programs entering the program are intercepted by the sidecar container to ensure that the traffic entering the program is the corresponding traffic of the program, reduce the processing and identification process of the subsequent program on the traffic, and reduce the complexity of the program.

[0075] Furthermore, S3 includes:

[0076] Get the request parameters in the traffic;

[0077] Convert traffic into traffic that can be recognized by the sidecar container based on request parameters.

[0078] Taking this embodiment as an example, the traffic is converted into traffic that can be recognized by the sidecar container according to the specific request parameters in the traffic, which further facilitates the subsequent detection of the traffic by the sidecar container, avoids the tedious steps of the program to detect the traffic, and reduces the difficulty of program writing.

[0079] Exemplarily, the permission access relationship between applications can be configured through the management page. This relationship can be managed to the interface level, that is, which interfaces of program B are allowed for program A to access, and which interfaces of application B are prohibited from access. All permission rules configured on the page are sent to the configuration conversion program via restful (Representational State Transfer, REST). The configuration conversion program converts the REST request parameters into a configuration format recognizable by sidecar. Sidecar connects to the configuration conversion program via grpc (a high-performance, open source RPC framework from Google) to pull the configuration in real time. The sidecar program will automatically update the configuration and it will take effect dynamically without restarting the program or the sidecar.

[0080] In S4, browsing is authenticated browsing by the sidecar container.

[0081] Furthermore, S6 includes:

[0082] Get the permission information in the traffic policy and identity;

[0083] If the permission information meets the traffic policy, the traffic is released.

[0084] In the embodiment of the present application, the traffic policy includes access rules for traffic to the program. The access of traffic to the program is divided into two layers. The first layer is to directly determine whether the traffic is the traffic corresponding to the program. If it is, the sidecar container can identify it and intercept the traffic for the next step of detection. At this time, specific permission information in the traffic is required. If it can be matched with the program information in the sidecar container, the traffic is received, indicating that the traffic is the traffic to access the program. If it cannot be matched, it means that the traffic is not the traffic to access the program and it is rejected.

[0085] Taking this embodiment as an example, it is determined whether the permission information in the identity identifier complies with the traffic policy. If so, it can save the time for subsequent programs to process the traffic, while improving the efficiency of program writing and receiving traffic.

[0086] Embodiment 2

[0087] In order to execute the method corresponding to the above embodiment 1 to achieve the corresponding functions and technical effects, a program access control device is provided below, such as Figure 2 As shown, the device comprises:

[0088] Add module 1, which is used to add the sidecar container to the program execution container group;

[0089] Interception module 2 is used to intercept the traffic entering the program execution container group using the sidecar container;

[0090] Conversion module 3 is used to convert the traffic into a configuration format to obtain traffic that can be recognized by the sidecar container;

[0091] Browsing module 4, used to browse the traffic identifiable by the sidecar container;

[0092] A reading module 5, used to read the identity in the identifiable traffic through the sidecar container;

[0093] The receiving module 6 is used to release the traffic according to the identity identifier.

[0094] In the above implementation process, a sidecar container is added as a bridge between programs. The traffic entering the program is intercepted and detected through the sidecar container to ensure that the traffic entering the program is feasible and safe. At the same time, the size of the program is reduced, making the program more concise.

[0095] Furthermore, the interception module 2 is also used for:

[0096] Get the IP address of the traffic;

[0097] Determine whether the IP address of the traffic is identifiable by the program execution container group;

[0098] If so, send instructions to the sidecar container to set up a firewall to intercept the traffic.

[0099] In the above implementation process, the identifiable programs entering the program are intercepted by the sidecar container to ensure that the traffic entering the program is the corresponding traffic of the program, reduce the processing and identification process of the subsequent program on the traffic, and reduce the complexity of the program.

[0100] Furthermore, the conversion module 3 is also used for:

[0101] Get the request parameters in the traffic;

[0102] Convert traffic into traffic that can be recognized by the sidecar container based on request parameters.

[0103] In the above implementation process, the traffic is converted into traffic that can be recognized by the sidecar container according to the specific request parameters in the traffic, which further facilitates the subsequent detection of the traffic by the sidecar container, avoids the tedious steps of the program to detect the traffic, and reduces the difficulty of program writing.

[0104] Furthermore, the receiving module 6 is also used for:

[0105] Get the permission information in the traffic policy and identity;

[0106] If the permission information meets the traffic policy, the traffic is released.

[0107] In the above implementation process, it is determined whether the permission information in the identity identifier complies with the traffic policy. If so, it can save the time for subsequent programs to process the traffic, while improving the efficiency of program writing and receiving traffic.

[0108] The program access control device described above can implement the method of the above embodiment 1. The options in the above embodiment 1 are also applicable to this embodiment and will not be described in detail here.

[0109] The rest of the contents of the embodiments of the present application can refer to the contents of the above-mentioned embodiment 1, and will not be repeated in this embodiment.

[0110] Embodiment 3

[0111] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the program access control method of the first embodiment.

[0112] Optionally, the above-mentioned electronic device may be a server.

[0113] See also Figure 3 , Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 31, a communication interface 32, a memory 33 and at least one communication bus 34. The communication bus 34 is used to realize direct connection and communication between these components. The communication interface 32 of the device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 31 may be an integrated circuit chip with signal processing capabilities.

[0114] The processor 31 mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor 31 can also be any conventional processor, etc.

[0115] The memory 33 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory 33 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 31, the device can execute the above-mentioned Figure 1 The method embodiment involves various steps.

[0116] Optionally, the electronic device may further include a storage controller and an input / output unit. The memory 33, the storage controller, the processor 31, the peripheral interface, and the input / output unit are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components may be electrically connected to each other via one or more communication buses 34. The processor 31 is used to execute executable modules stored in the memory 33, such as software function modules or computer programs included in the device.

[0117] The input and output unit is used to provide users with the task creation and to create an optional time period or preset execution time for the task to enable interaction between the user and the server. The input and output unit can be, but is not limited to, a mouse and a keyboard.

[0118] Understandably, Figure 3 The structure shown is for illustration only. The electronic device may also include Figure 3 More or fewer components as shown, or with Figure 3 Different configurations shown. Figure 3 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0119] In addition, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which implements the program access control method of the first embodiment when executed by a processor.

[0120] The embodiment of the present application also provides a computer program product, which, when running on a computer, enables the computer to execute the method described in the method embodiment.

[0121] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0122] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0123] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0124] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0125] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0126] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A program access control method, characterized in that: The method comprises: Add the sidecar container to the program execution container group; Using the sidecar container to intercept traffic entering the program execution container group; Convert the traffic into a configuration format to obtain traffic recognizable by the sidecar container; Browse the traffic that can be identified by the sidecar container; Reading the identity in the identifiable traffic through the sidecar container; Release the traffic according to the identity identifier; The step of using the sidecar container to intercept traffic entering the program execution container group includes: Obtaining the IP address of the traffic; Determining whether the IP address of the traffic is identifiable by the program execution container group; If so, send an instruction to the sidecar container to enable the sidecar container to set up a firewall to intercept the traffic; The step of converting the traffic into a configuration format to obtain traffic recognizable by the sidecar container includes: Obtaining request parameters in the traffic; Convert the traffic into traffic recognizable by the sidecar container according to the request parameters; The step of releasing the traffic according to the identity identifier includes: Obtaining traffic policy and permission information from the identity; If the permission information complies with the traffic policy, the traffic is released.

2. A program access control device, characterized in that: The device comprises: Add module for adding sidecar containers to the program execution container group; An interception module, used to intercept traffic entering the program execution container group using the sidecar container; A conversion module, used to convert the traffic into a configuration format to obtain traffic recognizable by the sidecar container; A browsing module, used to browse the traffic identifiable by the sidecar container; A reading module, configured to read an identity in the identifiable traffic through the sidecar container; A receiving module, used for releasing the traffic according to the identity identifier; The interception module is also used for: Obtaining the IP address of the traffic; Determining whether the IP address of the traffic is identifiable by the program execution container group; If so, send an instruction to the sidecar container to enable the sidecar container to set up a firewall to intercept the traffic; The conversion module is also used for: Obtaining request parameters in the traffic; Convert the traffic into traffic recognizable by the sidecar container according to the request parameters; The receiving module is also used for: Obtaining traffic policy and permission information in the identity; If the permission information complies with the traffic policy, the traffic is released.

3. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program so that the electronic device executes the program access control method according to claim 1.

4. A computer-readable storage medium, characterized in that: It stores a computer program, which implements the program access control method as claimed in claim 1 when executed by a processor.

Images