A device and method for mitigating application software vulnerabilities in a container

Abstract

The present invention discloses a device for mitigating application software vulnerabilities in a container without any sense and a mitigation method thereof, the device comprising: a container initiator additional process unit, used to modify the dynamic linking order of the application software vulnerability mitigation strategy loading unit and the application software vulnerability mitigation strategy execution unit to take precedence over the dynamic linking order of the dynamic link library in the container; an application software vulnerability mitigation strategy loading unit, used to load and initialize the application software vulnerability mitigation strategy; an application software vulnerability mitigation strategy execution unit, including copies for different dynamic link library calls, each copy is used to execute the corresponding application software vulnerability mitigation strategy according to the call of the corresponding dynamic link library. By implementing the present invention, after the application software vulnerability mitigation strategy is loaded and executed, matching and filtering of known vulnerability exploitation programs is achieved, so that users are free from targeted known vulnerability exploitation attacks.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a device for seamlessly mitigating application software vulnerabilities within a container and a mitigation method thereof. Background Art

[0002] Container is a lightweight virtualization technology that can be used in both cloud server scenarios and embedded scenarios. Its core is to use the sandbox interface provided by the operating system to deploy an appropriate sandbox runtime environment for a specified application and execute the application in the environment. Applications inside containers will inevitably have vulnerabilities. Regarding vulnerabilities, the main problems faced by security operations and maintenance are: first, software vendors cannot provide vulnerability patches in a timely manner; second, the installation of application vulnerability patches has a potential impact on the continuity and reliability of terminal business operations.

[0003] Existing vulnerability exploitation mitigation technologies generally refer to virtual patching technologies, which are technologies that prevent software vulnerability attacks by controlling the input and output of the protected system. In other words, a virtual patch policy implementation layer can be established without interrupting applications and business operations. Before malware endangers vulnerable targets, it can efficiently correct application input streams that may attack vulnerabilities, and can also effectively discover and intercept vulnerability attack behaviors. Usually, virtual patching technology is used in Web application systems and databases. However, virtual patching technology is usually implemented by independent application layer firewall devices, which has a high implementation cost. In small traffic scenarios, the performance of independent devices is far beyond the requirements. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a device for seamlessly mitigating application software vulnerabilities in a container and a mitigation method thereof, so as to solve the technical problem in the prior art that the cost of implementing vulnerability exploitation mitigation using virtual patch technology is high.

[0005] The technical solution proposed by the present invention is as follows:

[0006] According to a first aspect of an embodiment of the present invention, there is provided a device for seamlessly mitigating application software vulnerabilities in a container, comprising: a container launcher additional process unit, an application software vulnerability seamless mitigation policy loading unit and an application software vulnerability seamless mitigation policy execution unit, wherein the container launcher additional process unit is used to modify the dynamic linking order of the application software vulnerability seamless mitigation policy loading unit and the application software vulnerability seamless mitigation policy execution unit to give precedence over the dynamic linking order of the dynamic link library in the container; the application software vulnerability seamless mitigation policy loading unit is used to load and initialize the application software vulnerability seamless mitigation policy; the application software vulnerability seamless mitigation policy execution unit comprises copies for different dynamic link library calls, each copy being used to execute the corresponding application software vulnerability seamless mitigation policy according to the call of the corresponding dynamic link library.

[0007] Optionally, the container launcher additional process unit is also used to mount the locations of the application software vulnerability imperceptible mitigation strategy loading unit and the application software vulnerability imperceptible mitigation strategy execution unit into the container.

[0008] Optionally, the container launcher additional process unit is configured in the container launcher, attached to the container launch process execution link, and is used to be executed when the container launcher is started.

[0009] Optionally, the container initiator additional process unit is configured to the container initiator by replacing the original container initiator with a container initiator that complies with the standard OCI specification and contains the container initiator additional process.

[0010] Optionally, the application software vulnerability imperceptible mitigation strategy loading unit is attached to the operating system initialization execution link of the application program inside the container, and is used to initialize the application software vulnerability imperceptible mitigation strategy corresponding to the application software vulnerability imperceptible mitigation strategy execution unit.

[0011] Optionally, the application software vulnerability non-sensitive mitigation strategy loading unit program and the application software vulnerability non-sensitive mitigation strategy execution unit program are compiled into a binary dynamic link library.

[0012] Optionally, the storage location of the application software vulnerability non-sensitive mitigation strategy is the same as the storage location of the application software vulnerability non-sensitive mitigation strategy loading unit and the application software vulnerability non-sensitive mitigation strategy execution unit, and the application software vulnerability non-sensitive mitigation strategy is organized as a multi-tuple set.

[0013] Optionally, each copy in the application software vulnerability imperceptible mitigation strategy execution unit is used to call the real dynamic link library of the application program according to the call of the corresponding dynamic link library to obtain the data to be matched, execute the matching algorithm on the data to be matched according to the application software vulnerability imperceptible mitigation strategy corresponding to the current process and the matching algorithm state corresponding to the current thread, and return the corresponding return value according to the matching result.

[0014] A second aspect of an embodiment of the present invention provides a mitigation method for a device for seamlessly mitigating application software vulnerabilities in a container, comprising: when the container is started, the container launcher additional process unit modifies the dynamic link order of the application software vulnerability seamless mitigation policy loading unit and the application software vulnerability seamless mitigation policy execution unit to take precedence over the dynamic link order of the dynamic link library inside the container; when the application inside the container is started, the application software vulnerability seamless mitigation policy loading unit loads and initializes the application software vulnerability seamless mitigation policy; when a pre-specified dynamic link library call is executed in the application's own execution link, each copy of the application software vulnerability seamless mitigation policy execution unit executes the corresponding application software vulnerability seamless mitigation policy according to the call of the corresponding dynamic link library.

[0015] A third aspect of an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to execute the mitigation method of the device for seamlessly mitigating vulnerabilities of application software inside a container as described in the second aspect of the embodiment of the present invention.

[0016] The technical solution provided by the present invention has the following effects:

[0017] The embodiment of the present invention provides a device for mitigating application software vulnerabilities in a container without any sense and a mitigation method for the device, and sets a container launcher additional process unit to change the dynamic link order of the application software vulnerability mitigation strategy loading unit and the application software vulnerability mitigation strategy execution unit, sets the application software vulnerability mitigation strategy loading unit to load the application software vulnerability mitigation strategy, and sets the application software vulnerability mitigation strategy execution unit to implement the application software vulnerability mitigation strategy under the call of different dynamic link libraries. Thus, the device realizes the deployment of the software vulnerability mitigation loading unit and the application software vulnerability mitigation strategy execution unit in the container by modifying the container launcher execution process without affecting the existing configuration of the container and the original container running instructions; through the loading and execution of the application software vulnerability mitigation strategy, matching and filtering of known vulnerability exploits are realized, and finally, when the manufacturer cannot provide known vulnerability patches in time or cannot install such patches in time, a pure software application software vulnerability mitigation solution is provided to protect users from targeted known vulnerability exploit attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 is a structural block diagram of a device for seamlessly mitigating application software vulnerabilities within a container according to an embodiment of the present invention;

[0020] Figure 2 It is a schematic diagram of the structure of an application software vulnerability imperceptible mitigation strategy loading unit and an application software vulnerability imperceptible mitigation strategy execution unit in a memory according to an embodiment of the present invention;

[0021] Figure 3 is a flow chart of a mitigation method of a device for mitigating vulnerabilities of application software inside a container without any sense of vulnerability according to an embodiment of the present invention;

[0022] Figure 4 is a flow chart of a mitigation method of a device for mitigating vulnerabilities of application software inside a container without any sense of vulnerability according to another embodiment of the present invention;

[0023] Figure 5 is a schematic diagram of the structure of a computer-readable storage medium provided according to an embodiment of the present invention;

[0024] Figure 6 is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] The terms "first", "second", "third", "fourth", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] The embodiment of the present invention provides a device for mitigating application software vulnerabilities in a container without any sense of vulnerability. Figure 1 As shown, the device includes: a container launcher additional process unit, an application software vulnerability non-sensitive mitigation policy loading unit and an application software vulnerability non-sensitive mitigation policy execution unit, the container launcher additional process unit is used to modify the dynamic link order of the application software vulnerability non-sensitive mitigation policy loading unit and the application software vulnerability non-sensitive mitigation policy execution unit to give priority to the dynamic link order of the dynamic link library inside the container; the application software vulnerability non-sensitive mitigation policy loading unit is used to load and initialize the application software vulnerability non-sensitive mitigation policy; the application software vulnerability non-sensitive mitigation policy execution unit includes copies for different dynamic link library calls, each copy is used to execute the corresponding application software vulnerability non-sensitive mitigation policy according to the call of the corresponding dynamic link library.

[0028] The embodiment of the present invention provides a device for imperceptible mitigation of application software vulnerabilities within a container, and sets a container launcher additional process unit to change the dynamic link order of an application software vulnerability imperceptible mitigation strategy loading unit and an application software vulnerability imperceptible mitigation strategy execution unit, sets an application software vulnerability imperceptible mitigation strategy loading unit to load an application software vulnerability imperceptible mitigation strategy, and sets an application software vulnerability imperceptible mitigation strategy execution unit to implement the implementation of the application software vulnerability imperceptible mitigation strategy under the call of different dynamic link libraries. Thus, the device realizes the deployment of the software vulnerability imperceptible mitigation loading unit and the application software vulnerability imperceptible mitigation strategy execution unit in the container by modifying the execution process of the container launcher without affecting the existing configuration of the container and the original container running instructions; through the loading and execution of the application software vulnerability imperceptible mitigation strategy, matching and filtering of known vulnerability exploits are realized, and finally, a pure software application software vulnerability imperceptible mitigation solution is provided for users when the manufacturer cannot provide known vulnerability patches in time or cannot install such patches in time, so as to protect users from targeted known vulnerability exploit attacks.

[0029] In one embodiment, the container launcher additional process unit is also used to mount the location of the application software vulnerability non-sensitive mitigation strategy loading unit and the application software vulnerability non-sensitive mitigation strategy execution unit to the inside of the container. The mounting of the application software vulnerability non-sensitive mitigation strategy loading unit and the application software vulnerability non-sensitive mitigation strategy execution unit can be realized by calling the namespace-related mount dynamic link library; when modifying the dynamic link order of the application software vulnerability non-sensitive mitigation strategy loading unit and the application software vulnerability non-sensitive mitigation strategy execution unit, it can be realized by modifying the " / etc / ld.so.preload" file inside the container according to the specific situation of the container.

[0030] The dynamic link library inside the container can be a C library or an OpenSSL library, such as system calls such as read and recv in the C library, or calls such as encrypt in the OpenSSL library, or other dynamic link library function calls. The present invention does not specifically limit the dynamic link library inside the container. It is only necessary to modify the dynamic link order of the application software vulnerability non-sense mitigation strategy loading unit and the application software vulnerability non-sense mitigation strategy execution unit to take precedence over the dynamic link order of the dynamic link library inside the container, or in other words, the dynamic link order of the application software vulnerability non-sense mitigation strategy loading unit and the application software vulnerability non-sense mitigation strategy execution unit takes precedence over the dynamic link order of all dynamic link libraries inside the container.

[0031] Among them, the container launcher additional process unit is configured in the container launcher, attached to the container launch process execution link, and is used to be executed when the container launcher is started. Since the container launcher is generally an independent application and must follow the standard OCI (Open Container Initiative) specification, the container launcher additional process unit is configured to the container launcher by replacing the original container launcher with a container launcher that complies with the standard OCI specification and contains the container launcher additional process. Specifically, the configuration of the container launcher additional process unit can be implemented in the following additional manner: obtain the container launcher runc source code (runc is a widely used container launcher that implements all interfaces specified by the container launcher OCI standard), insert the container launcher additional process unit into the runc source code and recompile it, and replace the original container launcher with the modified compiled runc.

[0032] In one embodiment, the application software vulnerability non-sensitive mitigation policy loading unit is attached to the operating system initialization execution link of the application program inside the container, and is used to initialize the application software vulnerability non-sensitive mitigation policy corresponding to the application software vulnerability non-sensitive mitigation policy execution unit. Specifically, since the loading unit is attached to the operating system initialization execution link, according to the operating system dynamic link library loading rules, in the operating system initialization link of the application program, the operating system can call the application software vulnerability non-sensitive mitigation policy loading unit, thereby realizing the loading and initialization of the application software vulnerability non-sensitive mitigation policy.

[0033] Among them, the organization method of the application software vulnerability imperceptible mitigation strategy is a multi-tuple set, for example, it can be a triple set, a quadruple set or a quintuple set. Specifically, when it is a quadruple set, the quadruple set specifically includes four components: process file name, dynamic link library call name, filter string, and strategy. The storage location of the application software vulnerability imperceptible mitigation strategy is the same as the storage location of the application software vulnerability imperceptible mitigation strategy loading unit and the application software vulnerability imperceptible mitigation strategy execution unit. For example, the application software vulnerability imperceptible mitigation strategy can be formulated at the memory location where the application software vulnerability imperceptible mitigation strategy loading unit and the application software vulnerability imperceptible mitigation strategy execution unit are located. The formed application software vulnerability imperceptible mitigation strategy can be saved in the form of a file. Therefore, when the application software vulnerability imperceptible mitigation strategy is loaded, it is implemented through a file reading system call.

[0034] In addition, if Figure 2 As shown, different dynamic link libraries call different copies of the application software vulnerability non-sensitive mitigation strategy execution unit, and at the same time, the application software vulnerability non-sensitive mitigation strategy execution unit implements the execution of different application software vulnerability non-sensitive mitigation strategies. Therefore, after loading the application software vulnerability non-sensitive mitigation strategy, the application software vulnerability non-sensitive mitigation strategy corresponding to the application software vulnerability non-sensitive mitigation strategy execution unit called by different dynamic link libraries is also initialized. Specifically, during initialization, by traversing the application software vulnerability non-sensitive mitigation strategy, the dynamic link library call name in the application software vulnerability non-sensitive mitigation strategy quadruple is used as the classification basis, and a "process file name, filter string, strategy" triple set is formed for the application software vulnerability non-sensitive mitigation strategy execution units called by different dynamic link libraries.

[0035] In one embodiment, each copy in the application software vulnerability imperceptible mitigation strategy execution unit is used to call the application's real dynamic link library according to the call of the corresponding dynamic link library to obtain the data to be matched, execute the matching algorithm on the data to be matched according to the application software vulnerability imperceptible mitigation strategy corresponding to the current process and the matching algorithm state corresponding to the current thread, and return the corresponding return value according to the matching result.

[0036] Specifically, in existing containers, the dynamic link library calls of applications are usually implemented using the following process: for example, for the network data receiving function recv, the application first calls the dynamic link library function recv, and then the execution right is handed over to recv by the operating system. Recv implements its specific functions, such as reading certain data from the network card. Recv fills the reading result into the buffer provided by the application and returns the execution status of recv, that is, the return value; then the execution right is returned to the application by the operating system, and the application continues to process the received data. If the data is attack data, the application will be affected.

[0037] When the application software vulnerability senseless mitigation device is used in the container, take the application calling the dynamic link library function recv as an example. At this time, since the dynamic link order of the above-mentioned loading unit and execution unit is superior to other dynamic link orders, the execution right is returned to the application software vulnerability senseless mitigation strategy execution unit, and the execution unit calls the dynamic link library function recv (that is, the real dynamic link library). Recv reads data and fills it into the application buffer (the buffer data is the data to be matched), and returns the execution status of recv, that is, the return value; after that, the execution unit receives the execution right of the operating system, matches the buffer content based on the application software vulnerability senseless mitigation strategy, and returns the corresponding return value according to the matching result. For example, if the match fails, that is, there is no match (meaning no attack), then success is returned to the application; if a match is found (meaning an attack occurs), the attack content is cleared in the buffer, and a certain failure value is returned to the application. After that, the application continues to process the received data. If the data received by recv this time is attack data, due to the intervention of the strategy execution unit, the application will find that the recv call is unsuccessful, and the application will enter the error handling process instead of continuing to process the attack data.

[0038] Before matching, the application software vulnerability non-sensitive mitigation strategy execution unit first obtains the current process file name according to the current process PID number, and then selects the corresponding application software vulnerability non-sensitive mitigation strategy according to the process file name. If the current process PID number does not have a corresponding application software vulnerability non-sensitive mitigation strategy, it directly returns the return value of the real dynamic link library call. If the current process PID number has a corresponding application software vulnerability non-sensitive mitigation strategy, it further selects the matching algorithm state according to the current thread TID number, and then executes the matching algorithm. In the case of a match, an error code may be returned or a log may be recorded but the return value may not be modified.

[0039] Specifically, the matching algorithm used may be the Knuth-Morris-Pratt string matching algorithm used repeatedly or the Aho-Corasick automaton multi-mode string matching algorithm used once. In addition, the matching algorithm may also use other existing matching algorithms, which are not limited in the embodiment of the present invention.

[0040] The application software vulnerability senseless mitigation strategy loading unit program and the application software vulnerability senseless mitigation strategy execution unit program set in the application software vulnerability senseless mitigation device inside the container can be formed by compiling, that is, compiling the application software vulnerability senseless mitigation strategy loading unit program and the application software vulnerability senseless mitigation strategy execution unit program called for each dynamic link library into a binary dynamic link library. In addition, the application software vulnerability senseless mitigation strategy loading unit and the application software vulnerability senseless mitigation strategy execution unit can also be formed by other methods.

[0041] The device for seamlessly mitigating application software vulnerabilities within a container provided by an embodiment of the present invention, when applied in a container, does not require the developer of the application to modify the software, and the end user does not need to change the configuration and usage methods of the existing application. The vulnerability can be seamlessly mitigated by relying only on the virtual patch policy file for specific vulnerabilities issued by the device and the security service provider. At the same time, the set application software vulnerability seamless mitigation policy loading unit and application software vulnerability seamless mitigation policy execution unit can realize the loading of the seamless mitigation policy and filter and intercept the payload of the application software vulnerability exploitation attack, that is, the container environment configuration technology and dynamic link library hook technology are adopted to realize the pure software-based seamless mitigation of application software vulnerabilities. In addition, for the scenario of running multiple processes in the container and running multiple threads in the same process, the ability to specify different policies in a fine-grained manner is provided for multi-process and multi-thread containers, further improving the efficiency of seamless mitigation of container application software vulnerabilities.

[0042] The embodiment of the present invention provides a mitigation method for a container internal application software vulnerability non-sensitive mitigation device, such as Figure 3 and Figure 4 As shown, the method comprises the following steps:

[0043] Step S101: When the container is started, the container launcher additional process unit modifies the dynamic linking order of the application software vulnerability insensitive mitigation strategy loading unit and the application software vulnerability insensitive mitigation strategy execution unit to take precedence over the dynamic linking order of the dynamic link library inside the container.

[0044] Before adopting the mitigation method for senseless mitigation, first prepare the application software vulnerability senseless mitigation strategy execution unit program corresponding to the dynamic link library call according to the predetermined dynamic link library call range, that is, implement the setting of the application software vulnerability senseless mitigation strategy loading unit and the application software vulnerability senseless mitigation strategy execution unit. For example, the application software vulnerability senseless mitigation strategy loading unit program and the application software vulnerability senseless mitigation strategy execution unit program for each dynamic link library call are compiled into a binary dynamic link library.

[0045] After setting the application software vulnerability insensitive mitigation strategy loading unit and the application software vulnerability insensitive mitigation strategy execution unit, the application software vulnerability insensitive mitigation strategy is formulated in its storage location, and the application software vulnerability insensitive mitigation strategy can be saved in the same location as the application software vulnerability insensitive mitigation strategy loading unit and the application software vulnerability insensitive mitigation strategy execution unit in the form of a file. Among them, the application software vulnerability insensitive mitigation strategy can be a set of four tuples, each of which includes four components: process file name, dynamic link library call name, filter string, and strategy.

[0046] At the same time, before performing the imperceptible mitigation, the container launcher additional process unit is pre-configured into the container launcher. Since the container launcher is generally an independent application and must follow the standard OCI specification, the original container launcher can be replaced by a container launcher that can implement the standard OCI specification and contains the container launcher additional process. Among them, the container launcher additional process unit can be attached by obtaining the container launcher runc source code (runc is a widely used container launcher that implements all interfaces specified by the container launcher OCI standard), inserting the container launcher additional process unit into the runc source code and recompiling it, and replacing the original container launcher with the modified compiled runc.

[0047] After the above configuration is implemented, the imperceptible mitigation of the imperceptible mitigation device can be performed. First, when the container management program on the intelligent terminal such as the host normally starts the container through the container launcher, the container launcher additional process unit mounts the storage location of the application software vulnerability imperceptible mitigation strategy loading unit and the application software vulnerability imperceptible mitigation strategy execution unit to the inside of the container, modifies the dynamic link library configuration inside the container so that the dynamic link order of the application software vulnerability imperceptible mitigation strategy loading unit and the application software vulnerability imperceptible mitigation strategy execution unit precedes the dynamic link order of the dynamic link library inside the container, and then continues the normal container startup process.

[0048] Step S102: When the application program in the container is started, the application software vulnerability imperceptible mitigation strategy loading unit loads and initializes the application software vulnerability imperceptible mitigation strategy.

[0049] Specifically, when the application inside the container is started, according to the operating system dynamic link library loading rules, in the operating system initialization phase of the application, the operating system calls the binary dynamic link library computer program where the application software vulnerability insensitive mitigation strategy loading unit generated in step 101 is located, to load the application software vulnerability insensitive mitigation strategy and initialize the application software vulnerability insensitive mitigation strategy corresponding to the application software vulnerability insensitive mitigation strategy execution unit called by different dynamic link libraries. Among them, the application software vulnerability insensitive mitigation strategy initialization can be performed by traversing the application software vulnerability insensitive mitigation strategy, taking the dynamic link library call name in the application software vulnerability insensitive mitigation strategy quadruple as the classification basis, and forming a "process file name, filter string, strategy" triple set for the application software vulnerability insensitive mitigation strategy execution units called by different dynamic link libraries.

[0050] Step S103: When a pre-specified dynamic link library call is executed in the application program's own execution link, each copy of the application software vulnerability seamless mitigation strategy execution unit executes the corresponding application software vulnerability seamless mitigation strategy according to the call of the corresponding dynamic link library.

[0051] Specifically, when the pre-specified dynamic link library call is executed in the execution link of the application itself, according to the operating system dynamic link library loading and execution rules, the operating system first calls the application software vulnerability non-sensitive mitigation strategy execution unit corresponding to the dynamic link library call, and the corresponding application software vulnerability non-sensitive mitigation strategy execution unit calls the corresponding real dynamic link library (the dynamic link library actually called by the application), and the real dynamic link library call obtains the data to be matched, and then obtains the current process file name according to the current process PID number, and then selects the corresponding application software vulnerability non-sensitive mitigation strategy according to the process file name. If the current process PID number does not have a corresponding application software vulnerability non-sensitive mitigation strategy, the return value of the real dynamic link library call is directly returned. If the current process PID number has a corresponding application software vulnerability non-sensitive mitigation strategy, the matching algorithm state is further selected according to the current thread TID number, and the matching result is obtained according to the matching algorithm state, the data to be matched and the corresponding application software vulnerability non-sensitive mitigation strategy, and the return value to be returned is determined according to the matching result.

[0052] The mitigation method of the device for imperceptible mitigation of application software vulnerabilities within a container provided by the embodiment of the present invention adopts a container launcher additional process unit to change the dynamic link order of the application software vulnerability imperceptible mitigation strategy loading unit and the application software vulnerability imperceptible mitigation strategy execution unit, adopts the application software vulnerability imperceptible mitigation strategy loading unit to load the application software vulnerability imperceptible mitigation strategy, and adopts the application software vulnerability imperceptible mitigation strategy execution unit to implement the execution of the application software vulnerability imperceptible mitigation strategy under the call of different dynamic link libraries. Therefore, the method realizes the deployment of the software vulnerability imperceptible mitigation loading unit and the application software vulnerability imperceptible mitigation strategy execution unit in the container by modifying the execution process of the container launcher without affecting the existing configuration of the container and the original container running instructions; through the loading and execution of the application software vulnerability imperceptible mitigation strategy, matching and filtering of known vulnerability exploits are realized, and finally, a pure software application software vulnerability imperceptible mitigation solution is provided for users when the manufacturer cannot provide known vulnerability patches in time or cannot install such patches in time, so as to protect users from targeted known vulnerability exploit attacks.

[0053] The embodiment of the present invention also provides a storage medium, such as Figure 5 As shown, a computer program 601 is stored thereon, and when the instruction is executed by the processor, the steps of the mitigation method of the container internal application software vulnerability non-sensitive mitigation device in the above embodiment are implemented. The storage medium also stores audio and video stream data, feature frame data, interaction request signaling, encrypted data, and preset data size, etc. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviated: HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memory.

[0054] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0055] The embodiment of the present invention further provides an electronic device, such as Figure 6 As shown, the electronic device may include a processor 51 and a memory 52, wherein the processor 51 and the memory 52 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0056] The processor 51 may be a central processing unit (CPU). The processor 51 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0057] The memory 52 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as the corresponding program instructions / modules in the embodiment of the present invention. The processor 51 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory 52, that is, the mitigation method of the container internal application software vulnerability non-sense mitigation device in the above method embodiment is implemented.

[0058] The memory 52 may include a program storage area and a data storage area, wherein the program storage area may store an application required for operating the device and at least one function; the data storage area may store data created by the processor 51, etc. In addition, the memory 52 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 52 may optionally include a memory remotely arranged relative to the processor 51, and these remote memories may be connected to the processor 51 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0059] The one or more modules are stored in the memory 52 and when executed by the processor 51, perform the following steps: Figure 3 -4 is a mitigation method for the container internal application software vulnerability imperceptible mitigation device in the embodiment shown in FIG.

[0060] For details of the above electronic equipment, please refer to Figure 3 to Figure 4 The corresponding related descriptions and effects in the illustrated embodiments can be understood and will not be repeated here.

[0061] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A device for mitigating application software vulnerabilities in a container without any sense of vulnerability, characterized in that: include: Container launcher additional process unit, application software vulnerability non-sensitive mitigation strategy loading unit and application software vulnerability non-sensitive mitigation strategy execution unit, The container initiator additional process unit is used to modify the dynamic linking order of the application software vulnerability non-sensitive mitigation strategy loading unit and the application software vulnerability non-sensitive mitigation strategy execution unit to take precedence over the dynamic linking order of the dynamic link library inside the container; The application software vulnerability non-sensitive mitigation strategy loading unit is used to load and initialize the application software vulnerability non-sensitive mitigation strategy; The application software vulnerability imperceptible mitigation strategy execution unit includes copies for different dynamic link library calls, each copy is used to execute the corresponding application software vulnerability imperceptible mitigation strategy according to the call of the corresponding dynamic link library; The storage location of the application software vulnerability non-sensitive mitigation strategy is the same as the storage location of the application software vulnerability non-sensitive mitigation strategy loading unit and the application software vulnerability non-sensitive mitigation strategy execution unit, and the application software vulnerability non-sensitive mitigation strategy is organized as a multi-tuple set; Each copy in the application software vulnerability imperceptible mitigation strategy execution unit is used to call the real dynamic link library of the application program according to the call of the corresponding dynamic link library to obtain the data to be matched, execute the matching algorithm on the data to be matched according to the application software vulnerability imperceptible mitigation strategy corresponding to the current process and the matching algorithm state corresponding to the current thread, and return the corresponding return value according to the matching result.

2. The device for mitigating application software vulnerabilities in containers without any sense according to claim 1, characterized in that: The container launcher additional process unit is also used to mount the locations of the application software vulnerability imperceptible mitigation strategy loading unit and the application software vulnerability imperceptible mitigation strategy execution unit into the container.

3. The device for mitigating application software vulnerabilities in containers without any sense according to claim 1, characterized in that: The container launcher additional process unit is configured in the container launcher, attached to the container launch process execution link, and is used to be executed when the container launcher is started.

4. The device for mitigating application software vulnerabilities in containers without any sense according to claim 3, characterized in that: The container initiator additional process unit is configured to the container initiator by replacing the original container initiator with a container initiator that complies with the standard OCI specification and contains the container initiator additional process.

5. The device for mitigating application software vulnerabilities in containers without any sense according to claim 1, characterized in that: The application software vulnerability imperceptible mitigation strategy loading unit is attached to the operating system initialization execution link of the application program inside the container, and is used to initialize the application software vulnerability imperceptible mitigation strategy corresponding to the application software vulnerability imperceptible mitigation strategy execution unit.

6. The device for mitigating application software vulnerabilities in containers without any sense according to claim 1, characterized in that: The application software vulnerability non-sensitive mitigation strategy loading unit program and the application software vulnerability non-sensitive mitigation strategy execution unit program are compiled into a binary dynamic link library.

7. A mitigation method for a container internal application software vulnerability mitigation device, characterized in that: The mitigation device applied to the device for mitigating the vulnerability of application software inside the container without any sense of mitigation as claimed in any one of claims 1 to 6 comprises: When the container is started, the container launcher additional process unit modifies the dynamic linking order of the application software vulnerability non-sensitive mitigation strategy loading unit and the application software vulnerability non-sensitive mitigation strategy execution unit to take precedence over the dynamic linking order of the dynamic link library inside the container; When the application in the container is started, the application software vulnerability non-sensitive mitigation policy loading unit loads and initializes the application software vulnerability non-sensitive mitigation policy; When a pre-specified dynamic link library call is executed in the application's own execution link, each copy of the application software vulnerability seamless mitigation strategy execution unit executes the corresponding application software vulnerability seamless mitigation strategy according to the call of the corresponding dynamic link library.

8. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the mitigation method of the device for seamlessly mitigating vulnerabilities of application software inside a container as claimed in claim 7 by executing the computer instructions.

Images