A container image detection method and client and server

Abstract

The present invention discloses a method for detecting container images, as well as a client and a server. The main purpose is to solve the problem that the existing centralized container image repository detection method cannot cover the images running at the edge. It includes: the client obtains the image data of the container to be scanned from the container engine of the edge network node; the image data is parsed to obtain image layering information, and a vulnerability scanning request carrying the image layering information is sent to the server of the cloud platform control center; the server receives a vulnerability scanning request from at least one edge network node client, extracts the image layering information carried in the vulnerability scanning request in the order of the time of receiving the vulnerability scanning request; performs vulnerability scanning on the image layering information based on the vulnerability database downloaded from a third party, and sends the scanning result to the client. The client receives the scanning result sent by the server and completes the image detection of the container to be scanned.

Description

Technical Field

[0001] The present invention relates to the technical field of software detection, and in particular to a container image detection method, a client, and a server. Background Art

[0002] A container image is a specialized file system created by standardizing the application code and its runtime environment. It contains a packaged application, its dependencies, and information about the processes it runs at startup. If a container image contains vulnerabilities or other anomalies, the corresponding container becomes vulnerable to security risks.

[0003] Currently, existing container image detection methods mostly use a centralized scanning mechanism. Specifically, a container image repository is deployed on a server, and during detection, the server scans the image files in the container image repository for centralized scanning. However, this centralized container image repository detection method fails to cover images running at the edge. This results in image file vulnerabilities in edge network nodes not being discovered in a timely manner, posing a container security risk. Summary of the Invention

[0004] In view of this, the present invention provides a container image detection method, client, and server. The main purpose is to solve the problem that the existing centralized scanning container image repository detection method cannot cover the images running at the edge, resulting in the vulnerability of the image files in the edge network nodes cannot be discovered in time.

[0005] According to one aspect of the present invention, a method for detecting a container image is provided, which is applied to a client of an edge network node, comprising:

[0006] Obtain the image data of the container to be scanned from the container engine of the edge network node;

[0007] Parsing the image data to obtain image layer information, and sending a vulnerability scanning request carrying the image layer information to a server in a cloud platform control center, so that the server performs a vulnerability scan based on the image layer information;

[0008] Receive the scan result sent by the server and complete the image detection of the container to be scanned.

[0009] Furthermore, the parsing of the image data to obtain image layer information includes:

[0010] Obtaining code data of the mirror data;

[0011] The image layer information of the image data is obtained by detecting the unique identification code information stored in each image layer in the code data.

[0012] Furthermore, after receiving the scan result sent by the server and completing the image detection of the container to be scanned, the method further includes:

[0013] Obtaining an image layer list of the container to be scanned from a container engine of the edge network node, and comparing a first image layer in the image layer list with a second image layer in the image layer information to obtain a difference image layer;

[0014] If it is detected that the difference image layer is a missing image layer, a missing image layer query request is sent to the server, so that the server loads the missing image layer information corresponding to the missing image layer from the local cache;

[0015] If it is detected that the difference image layer is a newly added image layer, the image data corresponding to the newly added image layer is obtained from the container engine and parsed to obtain the newly added image layer information, and a vulnerability scanning request carrying the newly added image layer information is sent to the server.

[0016] According to another aspect of the present invention, another container image detection method is provided, which is applied to a server of a cloud platform control center, comprising:

[0017] Download vulnerability databases from third parties and save them locally;

[0018] receiving a vulnerability scanning request from a client of at least one edge network node, and extracting image layering information carried in the vulnerability scanning request in a time sequence of receiving the vulnerability scanning request;

[0019] Perform vulnerability scanning on the image layer information based on the vulnerability database, and send the scanning result to the client.

[0020] Furthermore, the performing vulnerability scanning on the image layer information based on the vulnerability database includes:

[0021] Matching the data in the image layering information with different types of vulnerability data in the vulnerability database one by one;

[0022] The vulnerability type successfully matched with the vulnerability data is output as the result of the vulnerability scan.

[0023] Furthermore, after receiving a vulnerability scan request from a client of at least one edge network node and extracting the image layering information carried in the vulnerability scan request in the order in which the vulnerability scan request is received, the method further includes:

[0024] Storing the image layering information in a local cache;

[0025] When a missing image layer query request sent by the client is received, image layering information of the missing image layer to be queried in the missing image layer query request is obtained from the local cache.

[0026] Furthermore, the method further comprises:

[0027] Receive vulnerability scanning requests with newly added image layering information;

[0028] Perform vulnerability scanning on the newly added image layer information based on the vulnerability database, and send the scanning result to the client.

[0029] According to one aspect of the present invention, there is provided a client, comprising:

[0030] A data acquisition module is used to obtain the image data of the container to be scanned from the container engine of the edge network node;

[0031] a parsing and sending module that parses the image data to obtain image layer information, and sends a vulnerability scanning request carrying the image layer information to a server in a cloud platform control center, so that the server performs a vulnerability scan based on the image layer information;

[0032] The receiving module receives the scanning result sent by the server and completes the image detection of the container to be scanned.

[0033] Furthermore, the parsing and sending module also includes:

[0034] A code acquisition unit, configured to acquire code data of the mirror data;

[0035] The identification unit is configured to obtain the image layer information of the image data by detecting the unique identification code information stored in each image layer in the code data.

[0036] Furthermore, the client further includes:

[0037] a comparison module, configured to obtain an image layer list of the container to be scanned from a container engine of the edge network node, and compare the image layers in the image layer list with the image layers in the image layer information to obtain difference image layers;

[0038] a missing image query module, configured to, if it is detected that the difference image layer is a missing image layer, send a missing image layer query request to the server, so that the server loads the missing image layer information corresponding to the missing image layer from a local cache;

[0039] A new image parsing module is added, which is used to obtain the image data corresponding to the new image layer from the client and parse it to obtain the new image layer information if it is detected that the difference image layer is a new image layer, and send a vulnerability scanning request carrying the new image layer information to the server.

[0040] According to one aspect of the present invention, a server is provided, comprising:

[0041] Database download module, used to download vulnerability database from third party and save it locally;

[0042] An information extraction module is configured to receive vulnerability scanning requests from a client of at least one edge network node, and extract image layering information carried in the vulnerability scanning requests in a chronological order of receiving the vulnerability scanning requests;

[0043] A vulnerability scanning module is used to perform vulnerability scanning on the image layer information based on the vulnerability database and send the scanning result to the client.

[0044] Furthermore, the vulnerability scanning module also includes:

[0045] a vulnerability matching unit, configured to match the data in the image layering information with vulnerability data of different vulnerability types in the vulnerability database one by one;

[0046] The result output unit is used to determine the vulnerability type corresponding to the successfully matched vulnerability data as the vulnerability result of the vulnerability scan.

[0047] Furthermore, the server also includes:

[0048] A storage module, configured to store the image layering information in a local cache;

[0049] The missing image acquisition module is configured to, upon receiving a missing image layer query request sent by the client, acquire image layering information of the missing image layer to be queried in the missing image layer query request from the local cache.

[0050] Furthermore, the server also includes:

[0051] Added an image receiving module to receive vulnerability scanning requests carrying newly added image layering information;

[0052] A new image scanning module is added, which is used to perform vulnerability scanning on the newly added image layer information based on the vulnerability database and send the scanning results to the client.

[0053] According to one aspect of the present invention, a storage medium is provided, wherein the storage medium stores at least one executable instruction, wherein the executable instruction causes a processor to execute operations corresponding to the above-mentioned container image detection method.

[0054] According to one aspect of the present invention, a computer device is provided, comprising a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0055] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to any of the above container image detection methods.

[0056] According to one aspect of the present invention, another storage medium is provided, wherein the storage medium stores at least one executable instruction, wherein the executable instruction causes a processor to perform operations corresponding to any of the above-mentioned container image detection methods.

[0057] According to one aspect of the present invention, another computer device is provided, comprising a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0058] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to any of the above container image detection methods.

[0059] By means of the above technical solution, the technical solution provided by the embodiment of the present invention has at least the following advantages:

[0060] The present invention provides a container image detection method, client, and server. Compared with the prior art method of deploying a container image repository on a server and scanning the image files in the container image repository for centralized scanning during detection, the present invention uses a client to obtain image data of the container to be scanned from the container engine of an edge network node; parses the image data to obtain image layer information; sends a vulnerability scan request carrying the image layer information to a server in a cloud platform control center, so that the server performs a vulnerability scan based on the image layer information; receives the scan results sent by the server, and completes the image detection of the container to be scanned. The server in the cloud platform control center downloads a vulnerability database from a third party and stores it locally; receives vulnerability scan requests from clients of at least one edge network node, extracts the image layer information carried in the vulnerability scan request in the order in which the vulnerability scan requests are received; performs a vulnerability scan on the image layer information based on the vulnerability database, and sends the scan results to the client. This method implements distributed vulnerability scanning of container images running in different edge network nodes, thereby timely and effectively discovering vulnerabilities in container images of different edge network nodes, and improving the vulnerability scanning efficiency of container images of each edge network node.

[0061] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0063] Figure 1 A flowchart of a method for detecting a container image provided by an embodiment of the present invention is shown;

[0064] Figure 2 A flowchart of a method for detecting a container image provided by an embodiment of the present invention is shown;

[0065] Figure 3 A flowchart of a method for detecting a container image provided by an embodiment of the present invention is shown;

[0066] Figure 4 A flowchart of a method for detecting a container image provided by an embodiment of the present invention is shown;

[0067] Figure 5 An interactive flow chart of a container image detection method provided by an embodiment of the present invention is shown;

[0068] Figure 6 A block diagram showing the composition of a client provided by an embodiment of the present invention is shown;

[0069] Figure 7 A block diagram showing the composition of a server provided by an embodiment of the present invention is shown;

[0070] Figure 8 A schematic structural diagram of a computer device provided by an embodiment of the present invention is shown;

[0071] Figure 9 A schematic structural diagram of another computer device provided by an embodiment of the present invention is shown;

[0072] Figure 10 A block diagram of a container image detection system provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0073] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0074] The embodiment of the present invention provides a method for detecting a container image, which can be applied to a client of an edge network node, such as Figure 1 As shown, the method includes:

[0075] 101. Obtain the image data of the container to be scanned from the container engine of the edge network node;

[0076] In an embodiment of the present invention, the image data of the container is stored in the container engine of the edge network node corresponding to the current client. When scanning the image of the container in the edge network node, it is necessary to first obtain the image data of the container to be scanned from the container engine of the edge network node. The container engine provides powerful cluster management and orchestration for the edge network node. Commonly used application container engines include Docker, etc., which are not specifically limited in the embodiment of the present invention. The image data of the container includes a packaged application, its dependencies, and data content such as the process information running at startup.

[0077] 102. Parse the image data to obtain image layer information, and send a vulnerability scan request carrying the image layer information to a server in a cloud platform control center, so that the server performs a vulnerability scan based on the image layer information.

[0078] In an embodiment of the present invention, after obtaining the image data of the container to be scanned, the client of the current edge network node needs to parse the image data to obtain the image layer information in the image data. The image layer information is used to represent the information or data contained in each layer in the image data, such as the information or data contained in each layer such as the image layer roLayer, the init layer, and the container layer mountLayer. The embodiment of the present invention does not specifically limit this. The current client sends a vulnerability scanning request carrying the image layer information to the server, so that the server performs a vulnerability scan based on the image layer information.

[0079] It should be noted that the client of the current edge network node only parses the image data obtained from the container engine of the corresponding edge network node. When there are multiple edge network nodes, each client also only parses the image data obtained from the container engine of the corresponding edge network node, and sends vulnerability scanning requests to the server of the same cloud platform control center to form a distributed scanning structure.

[0080] 103. Receive the scanning result sent by the server and complete the image detection of the container to be scanned.

[0081] In an embodiment of the present invention, a client of the current edge network node receives a vulnerability scan result sent by a server of the cloud platform control center. For example, if the image data of the scanned container to be tested does not have a vulnerability, or if one or more of the vulnerability types such as SQL injection vulnerability, directory traversal vulnerability, and cross-site scripting vulnerability exist, the embodiment of the present invention does not make specific limitations, and completes the image detection of the scanned container to be tested.

[0082] The present invention provides a method for detecting container images. In one embodiment of the present invention, the method obtains image data of a container to be scanned from a container engine of an edge network node; parses the image data to obtain image layering information; sends a vulnerability scan request carrying the image layering information to a server in a cloud platform control center, so that the server performs a vulnerability scan based on the image layering information; and receives the scan results sent by the server to complete the image detection of the container to be scanned. This allows for timely detection of container image data in edge network nodes, early detection of security vulnerabilities in containers running in edge network nodes, and ensures the security and reliability of container images in edge network nodes.

[0083] Furthermore, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another container image detection method is provided, wherein the steps of parsing the image data to obtain image layer information include:

[0084] Obtaining code data of the mirror data;

[0085] The image layer information of the image data is obtained by detecting the unique identification code information stored in each image layer in the code data.

[0086] In an embodiment of the present invention, in order to more efficiently and conveniently identify and obtain the layered information of each image, the current client obtains the code data of the image data. The code data of the image data contains the unique identification code stored in each image layer, such as the image's unique identifier imageID, the index chainID used by the Docker content addressing mechanism, the image layer verification diffID, etc., which are not specifically limited in the embodiment of the present invention. The current client obtains the image layered information of the image data by detecting the unique identification code information stored in each image layer in the code data.

[0087] Furthermore, as a refinement and extension of the specific implementation of the above embodiment, in order to simplify the container image detection method, after the first vulnerability scan of the container to be scanned, all the image data of the container to be scanned is no longer repeatedly obtained. Instead, through detection, the newly added image data of the container to be scanned is obtained for parsing and scanning, or the missing image layering information of the container to be scanned is retrieved from the server of the cloud platform control center for vulnerability scanning. This not only improves the vulnerability scanning efficiency of the edge network node, but also reduces the workload of the vulnerability scanning of the server of the cloud platform control center. Another container image detection method is provided, such as Figure 2 As shown, after receiving the scanning result sent by the server and completing the image detection of the container to be scanned, the method further includes:

[0088] 201. Obtain an image layer list of the container to be scanned from a container engine of the edge network node, compare a first image layer in the image layer list with a second image layer in the image layer information, and obtain a difference image layer;

[0089] In an embodiment of the present invention, the client of the current edge network node obtains the image layer list of the container to be scanned from the container engine of the corresponding edge network node. The image layer list is used to count the number, name, and other information of the container image layers, which is not specifically limited in the embodiment of the present invention. The current client compares the first image layer in the image layer list with the second image layer in the image layer information to obtain a difference image layer. The difference image layer is used to represent the difference between the first image layer and the second image layer, including missing image layers and newly added image layers.

[0090] 202. If it is detected that the difference image layer is a missing image layer, a missing image layer query request is sent to the server, so that the server loads missing image layer information corresponding to the missing image layer from a local cache;

[0091] In an embodiment of the present invention, if the current client detects that the difference image layer is a missing image layer, it sends a missing image layer query request to the server of the cloud platform control center. After receiving the query request of the current client, the server of the cloud platform control center loads the missing image layer information corresponding to the missing image layer from the local cache, and the server performs a vulnerability scan based on the vulnerability database.

[0092] It should be noted that the local cache of the cloud platform control center server stores the image layering information carried by the first vulnerability scan request of the container to be scanned. When querying for missing image layers, the missing image layering information is loaded by detecting the unique identification code information in the code data of the missing image layer.

[0093] 203. If it is detected that the difference image layer is a newly added image layer, the image data corresponding to the newly added image layer is obtained from the container engine and parsed to obtain the newly added image layer information, and a vulnerability scanning request carrying the newly added image layer information is sent to the server.

[0094] In an embodiment of the present invention, if the client of the current edge network node detects that the difference image layer is a newly added image layer, it obtains the image data corresponding to the newly added image layer from the container engine corresponding to the edge network node. The current client obtains the code data of the image data corresponding to the newly added image layer, detects the unique identification code information of the code data, obtains the newly added image layer information of the newly added image layer, and sends a vulnerability scanning request carrying the newly added image layer information to the server of the cloud platform control center. After receiving the newly added image layer information, the server performs vulnerability detection based on the vulnerability database and stores the newly added image layer information in the local cache of the cloud platform control center.

[0095] The present invention provides a method for detecting container images. In one embodiment of the present invention, the method obtains image data of a container to be scanned from a container engine of an edge network node; parses the image data to obtain image layering information; sends a vulnerability scan request carrying the image layering information to a server in a cloud platform control center, so that the server performs a vulnerability scan based on the image layering information; and receives the scan results sent by the server to complete the image detection of the container to be scanned. This allows for timely detection of container image data in edge network nodes, early detection of security vulnerabilities in containers running in edge network nodes, and ensures the security and reliability of container images in edge network nodes.

[0096] The embodiment of the present invention provides another method for detecting container images, which can be applied to the server of the cloud platform control center, such as Figure 3 As shown, including:

[0097] 301. Download vulnerability database from third party and save it locally;

[0098] In this embodiment of the present invention, the server of the current cloud platform control center downloads a vulnerability database from a third party and stores the vulnerability database locally on the server. The vulnerability database downloaded by the third party contains data on various types of vulnerabilities, including but not limited to SQL injection vulnerabilities, directory traversal vulnerabilities, and cross-site scripting vulnerabilities, which are not specifically limited in this embodiment of the present invention.

[0099] 302. Receive a vulnerability scan request from a client of at least one edge network node, and extract image layering information carried in the vulnerability scan request in a chronological order of receiving the vulnerability scan request;

[0100] In an embodiment of the present invention, a server in a current cloud platform control center receives vulnerability scan requests from clients of one or more associated edge network nodes and processes the vulnerability scan requests based on the order in which they were received, i.e., the earliest vulnerability scan request is processed first, and later vulnerability scan requests are processed later. When processing a vulnerability scan request, the current server first obtains image layering information carried in the vulnerability scan request.

[0101] It should be noted that the time here is based on the time of the server in the cloud platform control center to avoid confusion in the request receiving time caused by inconsistent time of the clients of each edge network node.

[0102] 303. Perform vulnerability scanning on the image layer information based on the vulnerability database, and send the scanning result to the client.

[0103] In an embodiment of the present invention, after obtaining image layering information, the current server performs a vulnerability scan on the image layering information based on a vulnerability database. During the vulnerability scan, the image layering information is compared one-to-one with different types of vulnerability data in the vulnerability database to identify vulnerabilities, and the identified vulnerabilities are sent to the client corresponding to the vulnerability scan request. If no vulnerability information is identified, a scan result indicating that no vulnerability data exists is sent to the client corresponding to the vulnerability scan request.

[0104] The present invention provides a method for detecting container images. An embodiment of the present invention downloads a vulnerability database from a third party and stores it locally; receives a vulnerability scan request from a client of at least one edge network node, extracts the image layering information carried in the vulnerability scan request in the order in which the vulnerability scan request is received; performs a vulnerability scan on the image layering information based on the vulnerability database, and sends the scan results to the client. This allows the server of the current cloud platform control center to process vulnerability scan requests from clients of multiple edge network nodes, forming a distributed vulnerability scanning structure. This not only facilitates the management of container images of clients of each edge network node, but also reduces the storage pressure on the server of the cloud platform control center.

[0105] Furthermore, as a refinement and extension of the above-mentioned embodiment, in order to improve the efficiency and accuracy of vulnerability scanning of image data, another container image detection method is provided, wherein the steps of performing vulnerability scanning on the image layer information based on the vulnerability database include:

[0106] Matching the data in the image layering information with vulnerability data of different vulnerability types in the vulnerability database one by one;

[0107] The vulnerability type corresponding to the successfully matched vulnerability data is determined as the vulnerability result of the vulnerability scan.

[0108] In an embodiment of the present invention, the server of the current cloud platform control center matches the data in the image data layering information with different types of vulnerability data in the vulnerability database one by one. When matching, it can first extract features of the different types of vulnerability data in the vulnerability database and perform matching based on the extracted features; it can also detect keywords of different types of vulnerability data in the vulnerability database and perform matching based on the keywords. The embodiment of the present invention does not make specific limitations. The server of the current cloud platform control center outputs the successfully matched vulnerability type as the result of the vulnerability scan. When the image layering information fails to match any type of vulnerability data in the vulnerability database, the scan result indicating that no vulnerability exists is output.

[0109] Furthermore, as a refinement and extension of the specific implementation of the above embodiment, in order to perform vulnerability scanning only on missing image layers and improve the vulnerability scanning efficiency of the server of the cloud platform control center, another container image detection method is provided, which includes the steps of receiving a vulnerability scanning request from a client of at least one edge network node, extracting the image layer information carried in the vulnerability scanning request in the order of the time of receiving the vulnerability scanning request, and then performing the following steps: Figure 4 As shown, the method further includes:

[0110] 401. Store the image layer information in a local cache;

[0111] 402. When receiving the missing image layer query request sent by the client, obtain image layer information of the missing image layer to be queried in the missing image layer query request from the local cache.

[0112] In this embodiment of the present invention, the server at the current cloud platform control center stores the image layering information of all image layers of the container to be scanned in a local cache in order to later locate the client's missing image layering information in the local cache. Upon receiving a missing image layer query request from a client at an edge network node, the server detects the unique identification code information of the missing image layer, retrieves the image layering information corresponding to the missing image layer from the local cache of the cloud platform control center, and performs a vulnerability scan.

[0113] It should be noted that the content of the difference image layers of clients at different edge network nodes may vary. Some edge network node clients' difference image layers may contain missing image layers, while others may contain newly added image layers. Only clients that detect missing image layers will send a missing image layer query request to the current server. The server will search the local cache for the missing image layer information in the order in which the query requests were received.

[0114] Furthermore, as a refinement and extension of the specific implementation of the above embodiment, in order to perform vulnerability scanning only on newly added image layers, reduce the data parsing work of the client of each edge network node, and improve the vulnerability scanning efficiency of the server of the cloud platform control center, another container image detection method is provided, which also includes:

[0115] Receive vulnerability scanning requests with newly added image layering information;

[0116] Perform vulnerability scanning on the newly added image layer information based on the vulnerability database, and send the scanning result to the client.

[0117] In an embodiment of the present invention, the contents of the difference image layers of the clients of different edge network nodes are different. The difference image layers of the clients of some edge network nodes contain missing image layers, while the difference image layers of the clients of some edge network nodes contain newly added image layers. Only when a client containing a newly added image layer is detected will a vulnerability scanning request carrying the newly added image layering information be sent to the current server. The current server performs a vulnerability scan on the newly added image layering information of the newly added image layer based on the vulnerability database. Before scanning, feature extraction can be performed on different types of vulnerability data in the vulnerability database, and matching can be performed based on the extracted features; keywords of different types of vulnerability data in the vulnerability database can also be detected, and matching can be performed based on the keywords. This embodiment of the present invention does not make specific limitations. The results of the vulnerability scan are sent to the client.

[0118] For the embodiment of the present invention, in order to timely perform vulnerability detection on the image data of the container running in each edge network node, the container image data in the container engine corresponding to each edge network node is parsed to obtain the image layering information, and then the image layering information is sent to the server for vulnerability scanning. The image layering information of the client container of each edge network node is saved in the cache of the server of the cloud platform control center. When the image layer is missing, the server provides query services for each client. When the container of each client is updated, the server provides vulnerability scanning services for the newly added image layering information, which not only reduces the data parsing work of the client, but also reduces the vulnerability scanning work of the server, thereby improving the overall scanning efficiency of the distributed vulnerability scanning system. In addition, since the client of the edge network node in the embodiment of the present invention can be the application end of different businesses such as the merchant management system, the code scanning ordering system, the smart home control management system, and the green travel management system, the interactive steps of the data processing in the embodiment of the present invention with the server of the cloud platform control center are as follows: Figure 5 shown.

[0119] The present invention provides a method for detecting container images. An embodiment of the present invention downloads a vulnerability database from a third party and stores it locally; receives a vulnerability scan request from a client of at least one edge network node, extracts the image layering information carried in the vulnerability scan request in the order in which the vulnerability scan request is received; performs a vulnerability scan on the image layering information based on the vulnerability database, and sends the scan results to the client. This allows the server of the current cloud platform control center to process vulnerability scan requests from clients of multiple edge network nodes, forming a distributed vulnerability scanning structure. This not only facilitates the management of container images of clients of each edge network node, but also reduces the storage pressure on the server of the cloud platform control center.

[0120] As the above Figure 1The embodiment of the present invention provides a client, such as Figure 6 As shown, the client includes:

[0121] The data acquisition module 51 is used to obtain the image data of the container to be scanned from the container engine of the edge network node;

[0122] The parsing and sending module 52 parses the image data to obtain image layer information, and sends a vulnerability scanning request carrying the image layer information to a server in the cloud platform control center, so that the server performs a vulnerability scan based on the image layer information.

[0123] The receiving module 53 receives the scanning result sent by the server and completes the image detection of the container to be scanned.

[0124] Furthermore, the parsing and sending module also includes:

[0125] A code acquisition unit, configured to acquire code data of the mirror data;

[0126] The identification unit is configured to obtain the image layer information of the image data by detecting the unique identification code information stored in each image layer in the code data.

[0127] Furthermore, the client further includes:

[0128] a comparison module, configured to obtain an image layer list of the container to be scanned from a container engine of the edge network node, and compare the image layers in the image layer list with the image layers in the image layer information to obtain difference image layers;

[0129] a missing image query module, configured to, if it is detected that the difference image layer is a missing image layer, send a missing image layer query request to the server, so that the server loads the missing image layer information corresponding to the missing image layer from a local cache;

[0130] A new image parsing module is added, which is used to obtain the image data corresponding to the new image layer from the client and parse it to obtain the new image layer information if it is detected that the difference image layer is a new image layer, and send a vulnerability scanning request carrying the new image layer information to the server.

[0131] The present invention provides a client. Embodiments of the present invention obtain image data of a container to be scanned from a container engine of an edge network node; parse the image data to obtain image layering information; and send a vulnerability scanning request carrying the image layering information to a server in a cloud platform control center, so that the server performs a vulnerability scan based on the image layering information; and receive the scan results sent by the server to complete image detection of the container to be scanned. This allows for timely detection of container image data in edge network nodes, preemptive discovery of security vulnerabilities in containers running in edge network nodes, and guaranteed security and reliability of container images in edge network nodes.

[0132] As the above Figure 3 The embodiment of the present invention provides a server, such as Figure 7 As shown, the server includes:

[0133] A database download module 61 is used to download a vulnerability database from a third party and save it locally;

[0134] An information extraction module 62 is configured to receive vulnerability scanning requests from a client of at least one edge network node and extract image layer information carried in the vulnerability scanning requests in the order in which the vulnerability scanning requests are received;

[0135] The vulnerability scanning module 63 is configured to perform vulnerability scanning on the image layer information based on the vulnerability database and send the scanning result to the client.

[0136] Furthermore, the vulnerability scanning module also includes:

[0137] a vulnerability matching unit, configured to match the data in the image layering information with vulnerability data of different vulnerability types in the vulnerability database one by one;

[0138] The result output unit is used to determine the vulnerability type corresponding to the successfully matched vulnerability data as the vulnerability result of the vulnerability scan.

[0139] Furthermore, the server also includes:

[0140] A storage module, configured to store the image layering information in a local cache;

[0141] The missing image acquisition module is configured to, upon receiving a missing image layer query request sent by the client, acquire image layering information of the missing image layer to be queried in the missing image layer query request from the local cache.

[0142] Furthermore, the server also includes:

[0143] Added an image receiving module to receive vulnerability scanning requests carrying newly added image layering information;

[0144] A new image scanning module is added, which is used to perform vulnerability scanning on the newly added image layer information based on the vulnerability database and send the scanning results to the client.

[0145] The present invention provides a server. An embodiment of the present invention downloads a vulnerability database from a third party and stores it locally; receives a vulnerability scan request from a client of at least one edge network node, extracts the image layering information carried in the vulnerability scan request in the order in which the vulnerability scan request is received; performs a vulnerability scan on the image layering information based on the vulnerability database, and sends the scan result to the client. This allows the server of the current cloud platform control center to process vulnerability scan requests from clients of multiple edge network nodes, forming a distributed vulnerability scanning structure. This not only facilitates the management of container images of clients of each edge network node, but also reduces the storage pressure of the server of the cloud platform control center.

[0146] According to one embodiment of the present invention, a storage medium is provided, wherein the storage medium stores at least one executable instruction. The computer-executable instruction can execute operations corresponding to the container image detection method in any of the above method embodiments.

[0147] Figure 8 A schematic structural diagram of a computer device provided according to an embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the computer device.

[0148] like Figure 8 As shown, the computer device may include: a processor (processor) 702 , a communication interface (Communications Interface) 704 , a memory (memory) 706 , and a communication bus 708 .

[0149] The processor 702 , the communication interface 704 , and the memory 706 communicate with each other via a communication bus 708 .

[0150] The communication interface 704 is used to communicate with other devices such as clients or other servers.

[0151] The processor 702 is configured to execute the program 710 , and specifically may execute the relevant steps in the above-mentioned data processing method embodiment.

[0152] Specifically, the program 710 may include program codes, which include computer operation instructions.

[0153] Processor 702 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The one or more processors included in a computer device may be of the same type, such as one or more CPUs, or may be of different types, such as one or more CPUs and one or more ASICs.

[0154] The memory 706 is used to store the program 710. The memory 706 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0155] The program 710 may be specifically configured to cause the processor 702 to perform the following operations:

[0156] Obtain the image data of the container to be scanned from the container engine of the edge network node;

[0157] Parsing the image data to obtain image layer information, and sending a vulnerability scanning request carrying the image layer information to a server in a cloud platform control center, so that the server performs a vulnerability scan based on the image layer information;

[0158] Receive the scan result sent by the server and complete the image detection of the container to be scanned.

[0159] Figure 9 A schematic structural diagram of another computer device provided according to an embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the computer device.

[0160] like Figure 9 As shown, the computer device may include: a processor 802 , a communications interface 804 , a memory 806 , and a communication bus 808 .

[0161] The processor 802 , the communication interface 804 , and the memory 806 communicate with each other via a communication bus 808 .

[0162] The communication interface 804 is used to communicate with other devices such as clients or other servers.

[0163] The processor 802 is configured to execute the program 810 , and specifically may execute the relevant steps in the above-mentioned data processing method embodiment.

[0164] Specifically, the program 810 may include program codes, which include computer operation instructions.

[0165] Processor 802 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The one or more processors included in a computer device may be of the same type, such as one or more CPUs, or may be of different types, such as one or more CPUs and one or more ASICs.

[0166] The memory 806 is used to store the program 810. The memory 806 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0167] The program 810 may be specifically configured to enable the processor 802 to perform the following operations:

[0168] Download vulnerability databases from third parties and save them locally;

[0169] receiving a vulnerability scanning request from a client of at least one edge network node, and extracting image layering information carried in the vulnerability scanning request in a time sequence of receiving the vulnerability scanning request;

[0170] Perform vulnerability scanning on the image layer information based on the vulnerability database, and send the scanning result to the client.

[0171] The embodiment of the present invention provides a container image detection system, such as Figure 10 As shown, it includes: client 901 and server 902;

[0172] The client 901 is used to obtain the image data of the container to be scanned from the container engine of the edge network node;

[0173] The client 901 is further configured to parse the image data to obtain image layer information, and send a vulnerability scanning request carrying the image layer information to a server in the cloud platform control center, so that the server performs a vulnerability scan based on the image layer information.

[0174] The client 901 is further configured to receive the scan result sent by the server and complete the image detection of the container to be scanned.

[0175] The server 902 is used to download the vulnerability database from a third party and store it locally;

[0176] The server 902 is further configured to receive vulnerability scanning requests from a client of at least one edge network node, and extract image layering information carried in the vulnerability scanning requests in the order in which the vulnerability scanning requests are received;

[0177] The server 902 is further configured to perform vulnerability scanning on the image layer information based on the vulnerability database, and send the scanning result to the client.

[0178] Obviously, those skilled in the art will appreciate that the various modules or steps of the present invention described above can be implemented using a general-purpose computing device, centralized on a single computing device, or distributed across a network of multiple computing devices. Alternatively, they can be implemented using program code executable by a computing device, which can then be stored in a storage device and executed by the computing device. In some cases, the steps shown or described can be performed in a different order than that shown, or can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0179] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A container image detection method, applied to a client of an edge network node, characterized in that: include: Obtain the image data of the container to be scanned from the container engine of the edge network node; Parsing the image data to obtain image layer information, and sending a vulnerability scanning request carrying the image layer information to a server in a cloud platform control center, so that the server performs a vulnerability scan based on the image layer information; Receive the scan result sent by the server and complete the image detection of the container to be scanned; After receiving the scan result sent by the server and completing the image detection of the container to be scanned, the method further includes: Obtaining an image layer list of the container to be scanned from a container engine of the edge network node, and comparing a first image layer in the image layer list with a second image layer in the image layer information to obtain a difference image layer; If it is detected that the difference image layer is a missing image layer, a missing image layer query request is sent to the server, so that the server loads the missing image layer information corresponding to the missing image layer from the local cache, and the server performs a vulnerability scan based on the vulnerability database; If it is detected that the difference image layer is a newly added image layer, the image data corresponding to the newly added image layer is obtained from the container engine and parsed to obtain the newly added image layer information, and a vulnerability scanning request carrying the newly added image layer information is sent to the server.

2. The method according to claim 1, characterized in that The parsing of the image data to obtain image layer information includes: Obtaining code data of the mirror data; The image layer information of the image data is obtained by detecting the unique identification code information stored in each image layer in the code data.

3. A container image detection method, applied to the server of the cloud platform control center, characterized in that: include: Download vulnerability databases from third parties and save them locally; Receiving a vulnerability scanning request from a client of at least one edge network node, and extracting image layering information carried in the vulnerability scanning request in a time sequence of receiving the vulnerability scanning request; Performing vulnerability scanning on the image layer information based on the vulnerability database, and sending the scanning result to the client; The method further comprises: Storing the image layering information in a local cache; When receiving a missing image layer query request sent by the client, obtaining image layer information of the missing image layer to be queried in the missing image layer query request from the local cache, and performing vulnerability scanning based on the vulnerability database by the server; The method further comprises: Receive vulnerability scanning requests with newly added image layering information; Perform vulnerability scanning on the newly added image layer information based on the vulnerability database, and send the scanning result to the client.

4. The method according to claim 3, characterized in that The performing vulnerability scanning on the image layer information based on the vulnerability database includes: Matching the data in the image layering information with vulnerability data of different vulnerability types in the vulnerability database one by one; The vulnerability type corresponding to the successfully matched vulnerability data is determined as the vulnerability result of the vulnerability scan.

5. A client, characterized in that: include: A data acquisition module is used to obtain the image data of the container to be scanned from the container engine of the edge network node; a parsing and sending module that parses the image data to obtain image layer information, and sends a vulnerability scanning request carrying the image layer information to a server in a cloud platform control center, so that the server performs a vulnerability scan based on the image layer information; A receiving module receives the scanning result sent by the server and completes the image detection of the container to be scanned; After receiving the scan result sent by the server and completing the image detection of the container to be scanned, the client further includes: a comparison module, configured to obtain an image layer list of the container to be scanned from a container engine of the edge network node, and compare a first image layer in the image layer list with a second image layer in the image layer information to obtain a difference image layer; a missing image query module, configured to, if it is detected that the difference image layer is a missing image layer, send a missing image layer query request to the server, so that the server loads the missing image layer information corresponding to the missing image layer from the local cache, and performs a vulnerability scan based on the vulnerability database; A new image parsing module is added, which is used to obtain the image data corresponding to the new image layer from the client and parse it to obtain the new image layer information if it is detected that the difference image layer is a new image layer, and send a vulnerability scanning request carrying the new image layer information to the server.

6. A server, characterized in that: include: Database download module, used to download vulnerability database from third party and save it locally; An information extraction module is configured to receive vulnerability scanning requests from a client of at least one edge network node, and extract image layering information carried in the vulnerability scanning requests in a chronological order of receiving the vulnerability scanning requests; A vulnerability scanning module, configured to perform vulnerability scanning on the image layer information based on the vulnerability database and send the scanning result to the client; The server also includes: A storage module, configured to store the image layering information in a local cache; a missing image acquisition module, configured to, upon receiving a missing image layer query request sent by the client, obtain image layer information of the missing image layer to be queried in the missing image layer query request from the local cache, and perform vulnerability scanning based on the vulnerability database by the server; The server also includes: Added an image receiving module to receive vulnerability scanning requests carrying newly added image layering information; A new image scanning module is added, which is used to perform vulnerability scanning on the newly added image layer information based on the vulnerability database and send the scanning results to the client.

7. A storage medium storing at least one executable instruction, wherein the executable instruction executes an operation corresponding to the container image detection method according to any one of claims 1 to 2.

8. A computer device comprising a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, where the executable instruction enables the processor to perform an operation corresponding to the container image detection method according to any one of claims 1 to 2.

9. A storage medium storing at least one executable instruction, wherein the executable instruction executes an operation corresponding to the container image detection method according to any one of claims 3 to 4.

10. A computer device comprising a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, where the executable instruction enables the processor to perform an operation corresponding to the container image detection method according to any one of claims 3 to 4.

Images