Container security solutions and systems based on lightweight virtual machines

Abstract

The present disclosure provides a container security solution, system, electronic device and computer-readable storage medium based on a lightweight virtual machine to solve the problem of the life cycle of the container security tool being out of sync with the container. The container is a Kata container. The method includes: integrating the container security tool in the virtual machine operating system Guest OS of the Kata container; when running the container, synchronously running the container security tool in the Guest OS corresponding to the container to perform container security detection, and synchronizing the life cycle of the container security tool with the life cycle of the container during the container operation. The technical solution disclosed in the present disclosure can directly detect the security configuration of the Guest OS, so that the container security tool and the container have the same life cycle, and the deployment of the security tool is more lightweight; and there is no need to modify the Host OS, which is more conducive to the cross-platform deployment of the container security tool.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a container security solution based on a lightweight virtual machine, a container security solution system based on a lightweight virtual machine, an electronic device, and a computer-readable storage medium. Background Art

[0002] Compared to virtual machines, the Docker (Application Container Engine) platform shifts resource abstraction from the hardware level to the operating system level. While virtual machines abstract the entire hardware server, containers abstract the operating system kernel, creating a fundamentally different approach to virtualization. Docker containers are essentially processes on the host machine. Docker implements resource limits through control groups (cgroups). Cgroups can set limits on a process's use of CPU, memory, and disk IO (Input / Output) resources, prioritizing certain groups to receive more CPU (central processing unit) and other resources. Docker implements resource isolation through namespaces, which manage globally unique resources on the host and isolate them from each other. Processes running in isolated namespaces are invisible and believe they have exclusive access to the system.

[0003] However, both hardware virtualization and operating system virtualization require parasitism on the host operating system, so operating system security is a prerequisite for virtualization security. Although containers provide powerful software-level isolation mechanisms, the use of a shared kernel undoubtedly leads to a larger attack surface than a virtual machine manager or even a container-specific operating system. As a result, Docker faces various risks on the host operating system, including host operating system vulnerabilities, shared kernel security risks, improper user access rights, Docker version and installation environment risks, and host operating system file tampering risks.

[0004] At present, the traditional container security detection solution is to deploy security compliance detection tools in the host Host OS (host operating system) to perform security compliance verification on the container operating environment. However, the life cycle of this detection tool is independent of the life cycle of the container, and the detection solution is exactly the same for all containers. It can only detect the configuration at the Host OS level, cannot distinguish between the Guest OS and the Host OS, and cannot detect the security configuration of the Guest OS. In addition, it is impossible to achieve self-inspection and self-immunity of container security compliance during the process of creating the container, that is, it is impossible to automatically start the security compliance inspection and repair of the container at the same time as the container is created, and it is impossible to make compliance inspection and maintenance a part of the container life cycle. Summary of the Invention

[0005] In order to at least solve the above-mentioned technical problems existing in the prior art, the present disclosure provides a container security solution based on lightweight virtual machines, a container security solution system based on lightweight virtual machines, an electronic device and a computer-readable storage medium, which integrates a container security compliance verification and active repair tool (referred to as the container security tool) into Kata's GuestOS, and can directly detect the security configuration of the Guest OS, so that the container security tool and the container have the same life cycle, and the container operation, security detection and repair are started, stopped and deleted synchronously. In addition, the security detection and repair are more targeted, and the deployment of the security tool is more lightweight; and there is no need to modify the Host OS, which is more conducive to the cross-platform deployment of the container security tool.

[0006] In a first aspect, the present disclosure provides a container security solution based on a lightweight virtual machine, wherein the container is a Kata container, and the method includes:

[0007] Integrate container security tools into the Kata container's guest operating system.

[0008] When running a container, the container security tool in the Guest OS corresponding to the container is run synchronously to perform container security detection, and the life cycle of the container security tool is synchronized with the life cycle of the container during the container operation process.

[0009] Furthermore, when the container is running, the container security tool in the Guest OS corresponding to the container is synchronously run to perform container security detection, including:

[0010] Execute the run container command to start the virtual machine;

[0011] Use container security tools to perform virtual machine security compliance checks to determine whether the basic environment is compliant.

[0012] If so, pull the image and start the container in the virtual machine;

[0013] Use container security tools to perform container security compliance checks to determine whether running containers are compliant.

[0014] If so, start running the container.

[0015] Furthermore, the method further comprises:

[0016] If the basic environment is not compliant, perform security reinforcement on the basic environment;

[0017] After strengthening the basic environment, re-evaluate whether the basic environment is compliant.

[0018] Furthermore, the method further comprises:

[0019] If the running container is non-compliant, perform container security reinforcement;

[0020] After the container security is hardened, determine again whether the running container is compliant.

[0021] Furthermore, the container security reinforcement includes one or more of the following methods:

[0022] Harden the container host, limit network traffic between containers, configure TLS (Transport Layer Security) authentication for the container daemon, enable user namespace support, limit container memory usage, and set container CPU priority.

[0023] Furthermore, the method further comprises:

[0024] Configure corresponding container security tools for the container based on the container security level.

[0025] In a second aspect, the present disclosure provides a container security solution system based on a lightweight virtual machine, wherein the container is a Kata container, and the system includes:

[0026] An integration module configured to integrate container security tools into the guest OS of the Kata container virtual machine;

[0027] The running module is configured to synchronously run the container security tool in the Guest OS corresponding to the container to perform container security detection when running the container, and synchronize the life cycle of the container security tool with the life cycle of the container during the container operation process.

[0028] Furthermore, the operation module includes:

[0029] A first startup unit, configured to execute a run container command and start a virtual machine;

[0030] A first inspection unit is configured to perform a virtual machine security compliance inspection using a container security tool to determine whether the basic environment is compliant;

[0031] a second starting unit, configured to pull the image and start the container in the virtual machine if the first checking unit determines that the basic environment is compliant;

[0032] a second checking unit configured to perform a container security compliance check using a container security tool to determine whether the running container complies with the regulations;

[0033] The running unit is configured to start running the container if the second checking unit determines that the running container is compliant.

[0034] In a third aspect, the present disclosure provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program. When the processor runs the computer program stored in the memory, the processor executes a container security solution based on a lightweight virtual machine as described in any one of the first aspects.

[0035] In a fourth aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the container security solution based on a lightweight virtual machine described in any one of the first aspects above is implemented.

[0036] Beneficial effects:

[0037] The container security solution based on a lightweight virtual machine, the container security solution system based on a lightweight virtual machine, the electronic device, and the computer-readable storage medium provided by the present disclosure integrate the container security tool into the Guest OS of Kata, and can directly detect the security configuration of the Guest OS. This allows the container security tool to have the same life cycle as the container, and the container operation, security detection, and repair are started, stopped, and deleted synchronously. In addition, the security detection and repair are more targeted, and the deployment of the security tool is more lightweight. Moreover, there is no need to modify the Host OS, which is more conducive to the cross-platform deployment of the container security tool. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A flowchart of a container security solution based on a lightweight virtual machine provided in the first embodiment of the present disclosure;

[0039] Figure 2 A schematic diagram comparing the Docker container and the Kata container provided in the first embodiment of the present disclosure;

[0040] Figure 3 A schematic diagram comparing two container security solutions provided in Example 1 of the present disclosure;

[0041] Figure 4 A container security configuration specification diagram provided in the first embodiment of the present disclosure;

[0042] Figure 5 A schematic diagram of the workflow of a container security solution provided in the first embodiment of the present disclosure;

[0043] Figure 6 This is an architecture diagram of a container security solution system based on a lightweight virtual machine provided in the second embodiment of the present disclosure;

[0044] Figure 7 This is an architectural diagram of an electronic device provided in Example 7 of the present disclosure. DETAILED DESCRIPTION

[0045] To enable those skilled in the art to better understand the technical solutions of the present disclosure, the present disclosure is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments and drawings described herein are only used to explain the present disclosure, rather than to limit the present disclosure.

[0046] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence; and, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be arbitrarily combined with each other.

[0047] The terms used in the embodiments of the present disclosure are for the purpose of describing specific embodiments only and are not intended to limit the present disclosure. The singular forms "a," "an," "the," and "the" used in the embodiments of the present disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0048] In the subsequent description, suffixes such as "module," "component," or "unit" used to represent elements are used only to facilitate the description of the present disclosure and have no specific meaning. Therefore, "module," "component," or "unit" may be used interchangeably.

[0049] The following detailed examples illustrate the technical solution of this disclosure and how it addresses the technical issues of being unable to implement self-checking and self-immunization for container security compliance during container creation, and ensuring that the lifecycle of the detection tool is independent of the container lifecycle. The following specific examples can be combined with each other, and the same or similar concepts or processes may not be described in detail in some examples.

[0050] Figure 1A container security solution based on a lightweight virtual machine is provided in the first embodiment of the present disclosure. The container is a Kata container. The method includes:

[0051] Step S101: Integrate the container security tool into the virtual machine operating system Guest OS of the Kata container;

[0052] Step S102: When running the container, synchronously run the container security tool in the Guest OS corresponding to the container to perform container security detection, and synchronize the life cycle of the container security tool with the life cycle of the container during the container operation process.

[0053] Cloud computing is an internet-based computing method that enables shared hardware and software resources and information to be provided on-demand to computers and other devices. After more than a decade of development, cloud computing, as a key infrastructure for digital transformation, has evolved from migrating applications to the cloud to building applications for the cloud. This evolution, from a resource-centric approach to an application-centric approach, has led to the development of cloud-native infrastructure. In the construction of cloud-native applications and service platforms, Docker technology, with its lightweight nature, second-level deployment, ease of portability, elastic scalability, and robust and active community support, has become a key supporting technology for cloud-native applications and other scenarios.

[0054] Since containers use a shared kernel, they will result in a larger attack surface than virtual machine managers or even container-specific operating systems, which causes Docker to face various risks on the host operating system. Kata container was born to solve the problem of container security. Traditional containers are isolated based on namespace and cgroup. While they are lightweight and simple, they also bring security risks. In fact, although containers provide an execution environment that is isolated from other process resources in the system, they share a kernel with the host system. Once the application in the container escapes to the kernel, the consequences will be disastrous, especially in multi-tenant scenarios. Kata strikes a good balance between the isolation and security of traditional virtual machines and the simplicity and lightness of containers. The basic principle of Kata is to open a separate virtual machine for each container, and each virtual machine has an independent kernel, so that the delivered container has virtual machine-level isolation and security. The principle of Kata is as follows Figure 2 shown.

[0055] Although it is currently possible to perform security compliance checks on the container operating environment by deploying security compliance detection tools in the host operating system (Host OS), the life cycle of the detection tool is independent of the life cycle of the container, and it is impossible to achieve self-inspection and self-immunity of container security compliance during the process of creating the container, that is, automatically start the security compliance check and repair of the container while creating the container, and it is impossible to make compliance inspection and maintenance a part of the container life cycle. To this end, the embodiment of the present disclosure integrates the container security compliance verification and active repair tool (referred to as container security tool) into Kata's Guest OS. Since in Kata container technology, each container runs on a separate virtual machine, the life cycle of the virtual machine and the life cycle of the container are consistent. Therefore, the life cycles of the Guest OS, container security tool, and container can be kept consistent, and the operation, security detection and repair of the container can be run, stopped, and deleted synchronously. In this way, during the operation of the container, the security function module embedded in the virtual machine (which is equipped with a container security tool) can be consistent with the life cycle of the container, so as to achieve synchronization of container operation, detection, and repair.

[0056] The conventional container security detection and repair solution is compared with the container security solution of the embodiment of the present disclosure. Figure 3 As shown in the figure, R1 on the left is a conventional container security solution, R2 on the right is the container security solution of this embodiment, and the asterisk pattern is a container security tool. For each container, the container security tool is integrated in the Guest OS of its virtual machine. Each container corresponds to a virtual machine and a container security tool.

[0057] When running a container, the container security tool in the corresponding guest OS is run simultaneously. This tool can directly detect the guest OS's security configuration and automatically initiate security compliance checks and remediation for the container. This enables self-checking and self-immunization of container security compliance, synchronizing the lifecycle of the container security tool with that of the container. Furthermore, no modifications to the host OS are required, further facilitating cross-platform deployment of the container security tool.

[0058] Furthermore, when the container is running, the container security tool in the Guest OS corresponding to the container is synchronously run to perform container security detection, including:

[0059] Execute the run container command to start the virtual machine;

[0060] Use container security tools to perform virtual machine security compliance checks to determine whether the basic environment is compliant.

[0061] If so, pull the image and start the container in the virtual machine;

[0062] Use container security tools to perform container security compliance checks to determine whether running containers are compliant.

[0063] If so, start running the container.

[0064] The security risks faced by container technology include: host operating system and its security risks, Docker Daemon configuration and its security risks, container image and its security risks, runtime container and its security risks, container operation and its security risks, etc. Regarding Docker security configuration best practices, the CIS Docker Benchmark has a great influence. It is based on the consensus reached by experts from various industries and positions. The Docker security configuration baseline can be summarized as follows: Figure 4 The five aspects shown;

[0065] In the embodiment of the present disclosure, the container security tool in the Guest OS is run to perform a container security detection solution such as Figure 5 As shown, when running a container, execute the run container command, start the Kata virtual machine, and perform a virtual machine security compliance check through the container security tool to determine whether the basic environment is compliant. The container security tool can use various existing container security tools, such as Qualys Container Security, Anchore, Capsule 8, Sysdig, SNYK, etc. If it complies with the rules, pull the image, start the container in the Kata virtual machine, and perform a container security compliance check through the container security tool to determine whether the running container is compliant; if so, start running the container, and when performing the basic environment compliance check and the container security compliance check, you can use Figure 4 The container security configuration specifications shown are tested one by one, and if any violations are found during the test, security reinforcement is required.

[0066] Furthermore, the method further comprises:

[0067] If the basic environment is not compliant, perform security reinforcement on the basic environment;

[0068] After strengthening the basic environment, re-evaluate whether the basic environment is compliant.

[0069] When hardening the basic environment, you can use existing security hardening methods, such as using secure basic images, removing setuid and setgid permissions from the images, enabling Docker content trust, following the minimal installation principle, scanning images for security vulnerabilities (using Clair as an image security scanner), and running containers as non-root users. After hardening the basic environment, reassess whether the basic environment is compliant, and only proceed to the next step after it is compliant. This will better protect container security.

[0070] Furthermore, the method further comprises:

[0071] If the running container is non-compliant, perform container security reinforcement;

[0072] After the container security is hardened, determine again whether the running container is compliant.

[0073] During a container compliance check, if a running container is found to be non-compliant, container security hardening is required. The existing conventional container security testing and remediation solutions can be used to determine container compliance and perform container security hardening. These methods are not limited here. Container security hardening can better protect container and host security, and is performed directly when the container is started.

[0074] Furthermore, the container security reinforcement includes one or more of the following methods:

[0075] Harden the container host, limit network traffic between containers, configure TLS authentication for the container daemon, enable user namespace support, limit container memory usage, and set container CPU priority.

[0076] Container security hardening can reduce various security risks in containerized workloads and thus protect applications.

[0077] Furthermore, the method further comprises:

[0078] Configure corresponding container security tools for the container based on the container security level.

[0079] Container security tools are deployed in the Guest OS, and each container corresponds to a virtual machine. Therefore, a set of security tools can be used for each container. Different container security tools can be used for different containers. Therefore, corresponding container security tools can be configured for the container according to the container security level, making the container security tool configuration richer and more suitable for the container usage environment.

[0080] Compared with traditional container security solutions, the technical solution of the disclosed embodiment has the following advantages:

[0081] Traditional container security detection tools are directly deployed on the Host OS. The embodiments of the present disclosure are deployed on the Guest OS of Kata, filling the gap in this regard for container security detection tools. In Kata technology, the actual operation of the container is on the Guest OS, and the security configuration of the Guest OS directly affects the security compliance of the container. Traditional container security detection solutions can only detect the configuration at the Host OS level, and cannot distinguish between the Guest OS and the Host OS, let alone detect the security configuration of the Guest OS. The embodiments of the present disclosure can directly detect the security configuration of the Guest OS. In addition, the embodiments of the present disclosure can achieve the same life cycle of the container security tool and the container, and the container operation, security detection and repair are started, stopped and deleted synchronously, making the security detection and repair more targeted and the deployment of the security tool more lightweight. In addition, the container security tool is deployed in the Guest OS, and there is no need to modify the Host OS, which is more conducive to the cross-platform deployment of the container security tool.

[0082] Figure 6 This is an architecture diagram of a container security solution system based on a lightweight virtual machine provided in the second embodiment of the present disclosure, such as Figure 6 As shown, the system includes:

[0083] An integration module 11 is configured to integrate the container security tool into the virtual machine operating system GuestOS of the Kata container;

[0084] The running module 12 is configured to synchronously run the container security tool in the Guest OS corresponding to the container to perform container security detection when running the container, and synchronize the life cycle of the container security tool with the life cycle of the container during the container operation process.

[0085] Furthermore, the operation module 12 includes:

[0086] A first startup unit, configured to execute a run container command and start a virtual machine;

[0087] A first inspection unit is configured to perform a virtual machine security compliance inspection using a container security tool to determine whether the basic environment is compliant;

[0088] a second starting unit, configured to pull the image and start the container in the virtual machine if the first checking unit determines that the basic environment is compliant;

[0089] a second checking unit configured to perform a container security compliance check using a container security tool to determine whether the running container complies with the regulations;

[0090] The running unit is configured to start running the container if the second checking unit determines that the running container is compliant.

[0091] Furthermore, the operation module 12 further includes a first security reinforcement unit;

[0092] The first security reinforcement unit is configured to perform security reinforcement of the basic environment if the basic environment is not compliant;

[0093] The first checking unit is further configured to determine again whether the basic environment is compliant after the basic environment security is reinforced.

[0094] Furthermore, the operation module 12 also includes a second security reinforcement unit;

[0095] The second security reinforcement unit is configured to perform container security reinforcement if the running container is non-compliant;

[0096] The second inspection unit is further configured to determine again whether the running container is compliant after the container security is reinforced.

[0097] Furthermore, the container security reinforcement includes one or more of the following methods:

[0098] Harden the container host, limit network traffic between containers, configure TLS authentication for the container daemon, enable user namespace support, limit container memory usage, and set container CPU priority.

[0099] Furthermore, the integration module 11 is also configured to configure corresponding container security tools for the container according to the container security level.

[0100] This disclosed technical solution deploys container security tools in the Guest OS, synchronizing the lifecycle of the security tools with the container's lifecycle. Each container is equipped with a set of security tools, making the security tools more targeted. Furthermore, this disclosed technical solution requires that container security tools be deployed in advance on the Host OS, regardless of whether there are issues with running containers. By not deploying container security tools on the Host OS, the corresponding container security tools are only run when the container is running, further facilitating cross-platform deployment of container security tools.

[0101] The container security solution system based on a lightweight virtual machine in the embodiment of the present disclosure is used to implement the container security solution based on a lightweight virtual machine in the first embodiment of the implementation method, so the description is relatively simple. For details, please refer to the relevant description in the previous first embodiment of the method, which will not be repeated here.

[0102] In addition, if Figure 7As shown, embodiment eight of the present disclosure further provides an electronic device, including a memory 10 and a processor 20, wherein the memory 10 stores a computer program. When the processor 20 runs the computer program stored in the memory 10, the processor 20 executes the above-mentioned various possible methods.

[0103] The memory 10 is connected to the processor 20. The memory 10 may be a flash memory, a read-only memory, or other memory. The processor 20 may be a central processing unit or a single-chip microcomputer.

[0104] In addition, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored, and the computer program is used by a processor to execute the above-mentioned various possible methods.

[0105] The computer-readable storage medium includes volatile or nonvolatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), Digital Versatile Disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0106] It is understood that the above embodiments are merely exemplary embodiments for illustrating the principles of the present disclosure, and the present disclosure is not limited thereto. Those skilled in the art may make various modifications and improvements without departing from the spirit and substance of the present disclosure, and such modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. A container security solution based on lightweight virtual machines, characterized by: The container is a Kata container, and the method includes: Integrate container security tools into the Kata container's guest operating system. When running a container, synchronously run the container security tool in the Guest OS corresponding to the container to perform container security detection, and synchronize the life cycle of the container security tool with the life cycle of the container during the container operation process; When the container is running, the container security tool in the Guest OS corresponding to the container is synchronously run to perform container security detection, including: Execute the run container command to start the virtual machine; Use container security tools to perform virtual machine security compliance checks to determine whether the basic environment is compliant. If so, pull the image and start the container in the virtual machine; Use container security tools to perform container security compliance checks to determine whether running containers are compliant. If so, start running the container.

2. The method according to claim 1, characterized in that The method further comprises: If the basic environment is not compliant, perform security reinforcement on the basic environment; After strengthening the basic environment, re-evaluate whether the basic environment is compliant.

3. The method according to claim 1, characterized in that The method further comprises: If the running container is non-compliant, perform container security reinforcement; After the container security is hardened, determine again whether the running container is compliant.

4. The method according to claim 3, characterized in that The container security reinforcement may include one or more of the following methods: Harden the container host, limit network traffic between containers, configure TLS authentication for the container daemon, enable user namespace support, limit container memory usage, and set container CPU priority.

5. The method according to claim 1, wherein The method further comprises: Configure corresponding container security tools for the container based on the container security level.

6. A container security solution system based on lightweight virtual machines, characterized in that: The container is a Kata container, and the system includes: An integration module configured to integrate container security tools into the guest OS of the Kata container virtual machine; An operation module is configured to synchronously run a container security tool in a Guest OS corresponding to the container to perform container security detection when the container is running, and synchronize the lifecycle of the container security tool with the lifecycle of the container during the container operation; The operation module includes: A first startup unit, configured to execute a run container command and start a virtual machine; A first inspection unit is configured to perform a virtual machine security compliance inspection using a container security tool to determine whether the basic environment is compliant; a second starting unit, configured to pull the image and start the container in the virtual machine if the first checking unit determines that the basic environment is compliant; a second checking unit configured to perform a container security compliance check using a container security tool to determine whether the running container complies with the regulations; The running unit is configured to start running the container if the second checking unit determines that the running container is compliant.

7. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor runs the computer program stored in the memory, the processor executes the container security solution based on a lightweight virtual machine as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the container security solution based on a lightweight virtual machine according to any one of claims 1 to 5.

Images