A security protection method and system based on kyverno security policy

Abstract

This invention discloses a security protection method and system based on Kyverno security policies, relating to the field of cloud-native security. The method includes: obtaining a set of business logic characteristics from developers and operations personnel; performing principal component analysis on the set of business logic characteristics to obtain a dimensionality-reduced characteristic set; using the dimensionality-reduced characteristic set as business logic characteristics; selecting a business security policy based on the business logic characteristics; inputting policy configuration parameters based on the business security policy; when the policy configuration parameters are passed to a Generator, the Generator searches for a corresponding policy rule template in Etcd, renders it, and generates policy rules; and applying the policy rules to Kyverno to generate security protection behaviors. This solves the technical problems of existing technologies, which involve significant learning costs for developers and operations personnel, and the time-consuming and labor-intensive process of writing tests.

Description

Technical Field

[0001] This invention relates to the field of cloud-native security, and in particular to a security protection method and system based on the Kyverno security strategy. Background Technology

[0002] With technological advancements, Kubernetes has gradually become an industry-recognized container orchestration and scheduling platform. It automates the deployment, scaling, and operation of application containers, becoming a fundamental infrastructure in the cloud-native field. However, as businesses migrate to the cloud, Kubernetes security has become a key concern for the industry.

[0003] To ensure the security of production workloads, Kubernetes provides many security features, one of which is "Admission Controllers". Before using other advanced security features, such as establishing a security configuration baseline across the entire namespace with Pod security policies, requests must first pass through the Kubernetes Admission Controller.

[0004] A Kubernetes admission controller is a plugin that controls and enforces the use of a cluster. It can be viewed as an interceptor that blocks (authenticated) API requests; it can modify the request object or even completely reject the request. Its "admission control chain" (such as...) Figure 1 As shown, admission control is divided into two phases: Mutating admission control, which modifies the requested object; and Validating admission control, which validates the requested object. Therefore, admission controllers can be used for both muting and validation, or a combination of both.

[0005] Kubernetes leverages this mechanism to propose the Security Admission Controller (PSP), which can grant fine-grained authorization for Pod operations, detect and block the startup of high-privilege Pods, and ensure the security of the cloud environment to a certain extent. However, its shortcomings are also quite obvious: the authorization model coverage is not broad enough, the functionality is easy to enable but difficult to disable, the API interface lacks consistency and extensibility, it cannot handle dynamically injected sidecars, and it can only perform verification but not modification or hardening.

[0006] Kyverno is a policy engine designed for Kubernetes based on these pain points. It can manage authorization for various resources, easily enable and disable functions, support tag selectors and regular expression matching, run as a dynamic admission controller, and verify and modify resources.

[0007] However, it has been found that the above method has at least the following technical problems:

[0008] Existing technologies have a high learning curve for developers and operations and maintenance personnel, and writing tests is time-consuming and labor-intensive. Summary of the Invention

[0009] This application provides a security protection method and system based on Kyverno security policies, solving the technical problems of existing technologies that involve significant learning costs for developers and operations personnel, and the time-consuming and laborious process of writing tests. It enables operations and development personnel to quickly and efficiently deploy and execute security policies simply by inputting the policy name and related parameters. This not only reduces the difficulty of rule formulation but also allows developers to choose the security rules most suitable for their business needs, avoiding excessive security controls and thus minimizing the impact on other business operations. Furthermore, this solution is highly scalable. As new security vulnerabilities and requirements emerge, security personnel can develop new security policy templates, enriching the policy template rule set of this solution and providing more comprehensive technical protection for business operations.

[0010] In view of the above problems, the present invention is proposed to provide a method for overcoming or at least partially solving the above problems.

[0011] Firstly, this application provides a security protection method based on Kyverno security policies. The method includes: obtaining a set of business logic characteristics from development and operations personnel; performing principal component analysis on the set of business logic characteristics to obtain a set of dimensionality-reduced characteristics; using the set of dimensionality-reduced characteristics as business logic characteristics; selecting a business security policy based on the business logic characteristics; inputting policy configuration parameters based on the business security policy; when the policy configuration parameters are passed to the Generator, the Generator searches for a corresponding policy rule template in Etcd for rendering to generate policy rules; and applying the policy rules to Kyverno to generate security protection behavior.

[0012] On the other hand, this application also provides a security protection system based on Kyverno security policies. The system includes: a business logic characteristic set acquisition module for acquiring a set of business logic characteristics from development and operations personnel; a principal component analysis module for performing principal component analysis on the set of business logic characteristics to obtain a dimensionality-reduced characteristic set; a business logic characteristic acquisition module for using the dimensionality-reduced characteristic set as business logic characteristics; a business security policy selection module for selecting a business security policy based on the business logic characteristics; a policy configuration parameter input module for inputting policy configuration parameters based on the business security policy; a policy rule generation module for generating policy rules by having the Generator find a corresponding policy rule template in Etcd and render it when the policy configuration parameters are passed to the Generator; and a security protection behavior generation module for applying the policy rules to Kyverno to generate security protection behaviors.

[0013] Thirdly, this application provides an electronic device including a bus, a transceiver, a memory, a processor, and a computer program stored in the memory and executable on the processor. The transceiver, the memory, and the processor are connected via the bus, and the computer program, when executed by the processor, implements the steps of any of the methods described above.

[0014] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described above.

[0015] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0016] This solution employs a technical approach that selects a business security policy based on business logic characteristics, then inputs policy configuration parameters based on that policy. When these parameters are passed to the Generator, the Generator retrieves the corresponding policy rule template from Etcd, renders it, generates policy rules, and applies these rules to Kyverno to generate security protection behaviors. This allows operations and maintenance developers to quickly and efficiently deploy and execute security policies simply by inputting the policy name and related parameters. This not only reduces the difficulty of rule creation but also allows developers to choose the most suitable security rules for their business needs, avoiding excessive security controls and minimizing the impact on other business operations. Furthermore, this solution is highly scalable. As new security vulnerabilities and requirements emerge, security personnel can create new security policy templates, enriching the policy template rule set and providing more comprehensive technical protection for business operations.

[0017] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a security protection method based on the Kyverno security strategy proposed in this application.

[0019] Figure 2 This is a flowchart illustrating the technical architecture of a security protection method based on the Kyverno security policy, as described in an embodiment of this application.

[0020] Figure 3 This is a schematic diagram of a security protection system based on the Kyverno security strategy according to an embodiment of this application;

[0021] Figure 4 This is a schematic diagram of the structure of an exemplary electronic device according to an embodiment of this application.

[0022] The attached diagrams are labeled as follows: Module 11 for obtaining business logic feature set, Module 12 for principal component analysis, Module 13 for obtaining business logic features, Module 14 for selecting business security policy, Module 15 for inputting policy configuration parameters, Module 16 for generating policy rules, Module 17 for generating security protection behavior, Bus 1110, Processor 1120, Transceiver 1130, Bus Interface 1140, Memory 1150, Operating System 1151, Application Program 1152, and User Interface 1160. Detailed Implementation

[0023] As will be apparent to those skilled in the art from the description of this application, this application can be implemented as a method, apparatus, electronic device, and computer-readable storage medium. Therefore, this application can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software. Furthermore, in some embodiments, this application can also be implemented as a computer program product contained in one or more computer-readable storage media, which includes computer program code.

[0024] The aforementioned computer-readable storage medium may be any combination of one or more computer-readable storage media. Computer-readable storage media include: electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media include: portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, flash memory, optical fiber, optical disc read-only memory, optical storage devices, magnetic storage devices, or any combination thereof. In this application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0025] The acquisition, storage, use, and processing of data in this application all comply with relevant national laws and regulations.

[0026] This application describes the provided methods, apparatus, and electronic devices using flowcharts and / or block diagrams.

[0027] It should be understood that each block of a flowchart and / or block diagram, as well as combinations of blocks in a flowchart and / or block diagram, can be implemented by computer-readable program instructions. These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine that, when executed by a computer or other programmable data processing apparatus, creates means for implementing the functions / operations specified in the blocks of the flowchart and / or block diagram.

[0028] These computer-readable program instructions may also be stored in a computer-readable storage medium that enables a computer or other programmable data processing device to function in a particular manner. In this way, the instructions stored in the computer-readable storage medium produce an instruction apparatus product that includes the functions / operations specified in the blocks of a flowchart and / or block diagram.

[0029] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer-implemented process, such that the instructions that execute on the computer or other programmable data processing apparatus provide a process for implementing the functions / operations specified in the blocks of the flowchart and / or block diagram.

[0030] This application will now be described with reference to the accompanying drawings.

[0031] Example 1

[0032] like Figure 1 As shown, this application provides a security protection method based on the Kyverno security policy, the method comprising:

[0033] Step S100: Obtain the set of business logic characteristics for development and operations personnel;

[0034] Step S200: Perform principal component analysis on the business logic characteristic set to obtain a dimensionality-reduced characteristic set;

[0035] Step S300: Use the set of dimensionality reduction features as business logic features;

[0036] Specifically, the first step is to obtain the set of business logic characteristics of the development and operation personnel. The set of business logic characteristics consists of multiple business logic characteristics. Business logic generally consists of domain entities, business rules, integrity constraints, business processes and workflows, which are the logic of the developed software within a certain business domain.

[0037] Principal component analysis (PCA) is performed on the aforementioned set of business logic characteristics. PCA is a multivariate statistical method and one of the most commonly used dimensionality reduction methods. It transforms a set of potentially correlated variables into a set of linearly uncorrelated variables through orthogonal transformation. The transformed variables are called principal components, aiming to retain as much information as possible from the original variables while ensuring they are mutually uncorrelated. PCA yields a dimensionality-reduced set of business logic characteristics, which serves as the core of the business logic. This approach uses fewer data dimensions while retaining more characteristics of the original data points, thus achieving data dimensionality reduction, minimizing interference from irrelevant information, and reducing information loss after dimensionality reduction.

[0038] Step S400: Select a business security strategy based on the business logic characteristics;

[0039] Furthermore, in the step of selecting a business security strategy based on the business logic characteristics, this application S400 also includes:

[0040] Step S410: Obtain custom parameters based on the information extracted by security personnel;

[0041] Step S420: Based on the business logic characteristics, the development and maintenance personnel select from the custom parameters to construct the business security policy.

[0042] Furthermore, the custom parameters include:

[0043] Policy rule name, resource type, namespace name, namespace tag, Pod tag, application advanced resource type, audit or block.

[0044] Specifically, such as Figure 2 As shown, development or operations personnel select the corresponding business security policy according to the characteristics of their own business logic. A security policy is a set of rules used for all security-related activities within a certain security zone. A security zone usually refers to a series of processing and communication resources belonging to a certain organization.

[0045] The following three typical cases illustrate the written Kyverno policy. First, regarding the "privilege escape" problem, this policy blocks all Pods whose `securityContext.allowPrivilegeEscalation` is not false, preventing escape behavior. However, for different business scenarios, some may require broader privileges. Therefore, this policy can be applied only to the namespaces that need control, simplifying the process so that operations and development personnel only need to input the namespace parameter.

[0046] Next, regarding the issue of "default security configuration," most business teams only focus on their own business logic and do not pay attention to the default security parameters in Kubernetes Pods, which can lead to numerous security risks. By simplifying this strategy, operations and development personnel only need to specify the pod-policies.kyverno.io / autogen-controllersAnnotation and the Namespace name to automatically add basic security configurations to Pods and parent resources (DaemonSet, Deployment, Job, StatefulSet, etc.) in the Namespace, ensuring the security of business operations without affecting the operation of other businesses.

[0047] Finally, regarding the issue of "Exec entering Pods," this strategy takes into account that different services have different security levels. Disallowing Exec from entering Pods provides a high level of security for those services. This strategy restricts access based on the Namespace's `exec = false` label, preventing Exec from entering Pods in Namespaces with this label. This label can also be customized. In its simplified form, operations and development personnel only need to focus on parameters such as the label and Namespace.

[0048] As described in the three examples above, if a corresponding rule template is established, development and operations personnel only need to understand a few parameters to quickly formulate policies. Therefore, the following design is implemented: For the parameter part, security personnel extract custom parameters, i.e., the parameters required for the policy, as shown in Table 1 below. These custom parameters include: policy rule name (Name), resource type (Kind), namespace name (Namespace), namespace label (NsLabel), pod label (PodLabel), application advanced resource type (HighKind), audit or blocking behavior, etc., for development and operations personnel to choose from. They only need to input a few parameters to build a security policy suitable for their business. After deployment and implementation, operations and development personnel can quickly and efficiently complete the distribution and execution of security policies by only inputting the policy name and related parameters.

[0049] Table 1 Parameters required for the strategy

[0050]

[0051]

[0052] Step S500: Based on the aforementioned business security policy, input the policy configuration parameters;

[0053] Step S600: When the strategy configuration parameters are passed to the Generator, the Generator finds the corresponding strategy rule template in Etcd and renders it to generate the strategy rule;

[0054] Furthermore, the Generator searches for the corresponding policy rule template in Etcd for rendering, and S600 of this application also includes:

[0055] Step S610: The Etcd stores a set of policy rule templates;

[0056] Step S620: Based on the set of policy rule templates, the Generator selects the policy rule template from Etcd for rendering.

[0057] Furthermore, this application S610 also includes:

[0058] Step S611: The security personnel extract the strategy template information;

[0059] Step S612: Construct a set of policy rule templates based on the policy template information;

[0060] Step S613: Store the set of policy rule templates into the Etcd.

[0061] Specifically, based on the selected business security policy, the corresponding policy configuration parameters are input. For example, the policy rule name (Name), resource type (Kind), and namespace name (Namespace) parameters are input. When the policy configuration parameters are passed to the Generator, the Generator will search for the corresponding policy rule template in Etcd (an open-source, distributed key-value data storage system developed in Go) for rendering. For the functional part of the policy, the security personnel extract the policy template information and construct a policy rule template set based on this information. This set of policy rule templates is stored in Etcd. Therefore, Etcd stores various policy rule templates specified by the security personnel. By storing the policy rule template set in the Etcd database, a program is written to read the input parameters, thereby forming the corresponding policy rule file.

[0062] This solution allows operations and maintenance developers to quickly and efficiently deploy and execute security policies simply by inputting the policy name and related parameters. This not only reduces the difficulty of rule creation but also enables developers to choose the security rules best suited to their business needs, avoiding excessive security controls and minimizing the impact on other business operations. Furthermore, it is highly scalable; as new security vulnerabilities and requirements emerge, security personnel can create new security policy templates, enriching the policy template rule set and providing more comprehensive protection for business operations.

[0063] Step S700: Apply the policy rules to Kyverno to generate security protection behavior.

[0064] Furthermore, the application of the policy rules to Kyverno to generate security protection behavior, in S700 of this application, also includes:

[0065] Step S710: Apply the policy rules to Kyverno and interact with the Kubernetes API to generate the security protection behavior.

[0066] Specifically, by applying the policy rules to the admission controller Kyverno and interacting with the Kubernetes API to generate actual policies, automatic protective actions are generated to safeguard the corresponding resources, workloads, and business containers within Kubernetes. This achieves the technical effect of allowing developers to choose the security rules most suitable for their business needs, avoiding excessive security controls, and thus reducing the impact on other business operations.

[0067] In summary, the security protection method and system based on the Kyverno security strategy provided in this application have the following technical effects:

[0068] This technical solution employs a method where, when a user request arrives at the server, a thread-based middleware preprocesses the request and records the user information from the request into local variables. The server then processes the request, obtains data change information, and sends different request commands based on the type of the data change information, using the data change information as command parameters. The application code receives the request commands through a command dispatcher, parses the command parameters, obtains the data change information, reads the user information from the local variables, and records both the user information and the data change information into a log file. This achieves the technical effect of embedding the application code into the project code as a standalone app, with low code intrusion, requiring no modification to the original project code, no need to parse Binlog, low implementation difficulty, and the ability to obtain operator information for page operations as an auditing basis, thereby automatically logging all data changes in the project.

[0069] Example 2

[0070] Based on the same inventive concept as the security protection method based on the Kyverno security policy in the foregoing embodiments, this invention also provides a security protection system based on the Kyverno security policy, such as... Figure 3 As shown, the system includes:

[0071] Module 11, which obtains the set of business logic features from development and operations personnel, is used to obtain the set of business logic features from development and operations personnel.

[0072] Principal component analysis module 12 is used to perform principal component analysis on the business logic characteristic set to obtain a dimensionality-reduced characteristic set;

[0073] The business logic characteristic acquisition module 13 is used to take the dimensionality reduction characteristic set as business logic characteristics;

[0074] The business security policy selection module 14 is used to select a business security policy based on the characteristics of the business logic.

[0075] The policy configuration parameter input module 15 is used to input policy configuration parameters based on the business security policy;

[0076] The strategy rule generation module 16 is used to generate strategy rules by having the Generator find the corresponding strategy rule template in Etcd and render it when the strategy configuration parameters are passed to the Generator.

[0077] The security protection behavior generation module 17 is used to apply the policy rules to Kyverno to generate security protection behaviors.

[0078] Furthermore, the business security policy selection module also includes:

[0079] The custom parameter acquisition unit is used to obtain custom parameters based on the extraction of security personnel;

[0080] The business security policy construction unit is used to construct the business security policy based on the business logic characteristics, by having the development and operations personnel select from the custom parameters.

[0081] Furthermore, the custom parameter acquisition unit also includes:

[0082] Custom parameter components are used for policy rule names, resource types, namespace names, namespace tags, Pod tags, application advanced resource types, and auditing or blocking.

[0083] Furthermore, the policy rule generation module also includes:

[0084] A policy rule template set storage unit is used for storing a policy rule template set in the Etcd;

[0085] The strategy rule template selection unit is used to select the strategy rule template from Etcd for rendering based on the set of strategy rule templates.

[0086] Furthermore, the policy rule template set storage unit also includes:

[0087] A policy template information extraction unit is used by the security personnel to extract policy template information.

[0088] The strategy rule template set construction unit is used to construct a strategy rule template set based on the strategy template information.

[0089] The strategy rule template set storage unit is used to store the strategy rule template set into the Etcd.

[0090] Furthermore, the security protection behavior generation module also includes:

[0091] The security protection behavior generation unit is used to apply the policy rules to Kyverno and interact with the Kubernetes API to generate the security protection behavior.

[0092] The foregoing Figure 1 The various variations and specific examples of the security protection method based on the Kyverno security policy in Embodiment 1 are also applicable to the security protection system based on the Kyverno security policy in this embodiment. Through the foregoing detailed description of the security protection method based on the Kyverno security policy, those skilled in the art can clearly understand the implementation method of the security protection system based on the Kyverno security policy in this embodiment. Therefore, for the sake of brevity, it will not be described in detail here.

[0093] In addition, this application also provides an electronic device, including a bus, a transceiver, a memory, a processor, and a computer program stored in the memory and executable on the processor. The transceiver, the memory, and the processor are respectively connected via the bus. When the computer program is executed by the processor, it implements the various processes of the above-described method embodiment for controlling output data and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0094] Exemplary electronic devices

[0095] For details, see Figure 4As shown, this application also provides an electronic device, which includes a bus 1110, a processor 1120, a transceiver 1130, a bus interface 1140, a memory 1150, and a user interface 1160.

[0096] In this application, the electronic device further includes: a computer program stored in the memory 1150 and executable on the processor 1120, which, when executed by the processor 1120, implements the various processes of the method embodiment described above for controlling the output data.

[0097] Transceiver 1130 is used to receive and send data under the control of processor 1120.

[0098] In this application, a bus architecture (represented by bus 1110) is used. Bus 1110 may include any number of interconnected buses and bridges. Bus 1110 connects various circuits, including one or more processors represented by processor 1120 and memory represented by memory 1150.

[0099] Bus 1110 represents one or more of several types of bus architectures, including memory buses and memory controllers, peripheral buses, accelerated graphics ports, processors, or local buses using any bus architecture from various bus architectures. As an example and not a limitation, such architectures include: industry-standard architecture buses, microchannel architecture buses, extended buses, video electronics standards associations, and peripheral interconnect buses.

[0100] The processor 1120 can be an integrated circuit chip with signal processing capabilities. In implementation, the steps of the above method embodiments can be completed by integrated logic circuits in the processor hardware or by instructions in software form. The processors described above include: general-purpose processors, central processing units, network processors, digital signal processors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), complex programmable logic devices (CPLs), programmable logic arrays, microcontroller units or other programmable logic devices, discrete gates, transistor logic devices, and discrete hardware components. They can implement or execute the methods, steps, and logic block diagrams disclosed in this application. For example, the processor can be a single-core processor or a multi-core processor, and the processor can be integrated on a single chip or located on multiple different chips.

[0101] Processor 1120 can be a microprocessor or any conventional processor. The method steps disclosed in this application can be directly executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in readable storage media known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, registers, etc. The readable storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0102] Bus 1110 can also connect various other circuits, such as peripheral devices, voltage regulators, or power management circuits. Bus interface 1140 provides an interface between bus 1110 and transceiver 1130, all of which are well known in the art. Therefore, this application will not describe them further.

[0103] Transceiver 1130 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. For example, transceiver 1130 receives external data from other devices, and transceiver 1130 transmits data processed by processor 1120 to other devices. Depending on the nature of the computer device, a user interface 1160 may also be provided, such as a touchscreen, physical keyboard, monitor, mouse, speaker, microphone, trackball, joystick, or stylus.

[0104] It should be understood that, in this application, memory 1150 may further include memory remotely configured relative to processor 1120, and such remotely configured memory can be connected to a server via a network. One or more portions of the aforementioned network may be an ad hoc network, intranet, extranet, virtual private network, local area network, wireless local area network, wide area network, wireless wide area network, metropolitan area network, the Internet, public switched telephone network, conventional telephone network, cellular telephone network, wireless network, wireless fidelity network, and combinations of two or more of the aforementioned networks. For example, cellular telephone networks and wireless networks may be Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA), Global System for Microwave Interconnection and Access (GSMA), General Packet Radio Service (GPRS), Wideband Code Division Multiple Access (WDMA), Long Term Evolution (LTE), LTE Frequency Division Duplex (FDMA), LTE Time Division Duplex (TDMA), Advanced Long Term Evolution (ALE), Universal Mobile Communications (UMC), Enhanced Mobile Broadband (EMB), Massive Machine-Type Communications (MMTC), Ultra Reliable Low Latency Communications (ULSC).

[0105] It should be understood that the memory 1150 in this application may be volatile memory or non-volatile memory, or may include both volatile memory and non-volatile memory. Non-volatile memory includes: read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, or flash memory.

[0106] Volatile memory includes random access memory (RAM) used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SRAM), double data rate synchronous dynamic random access memory (DRAM), enhanced synchronous dynamic random access memory (ERRAM), synchronous linked dynamic random access memory (SRAM), and direct memory bus (DMB) RAM. The memory 1150 of the electronic device described in this application includes, but is not limited to, the above-described and any other suitable types of memory.

[0107] In this application, memory 1150 stores the following elements of operating system 1151 and application program 1152: executable modules, data structures, or subsets thereof, or extended sets thereof.

[0108] Specifically, the operating system 1151 includes various device programs, such as a framework layer, a core library layer, and a driver layer, used to implement various basic business functions and handle hardware-based tasks. The application program 1152 includes various applications, such as a media player and a browser, used to implement various application functions. Programs implementing the methods of this application can be included in the application program 1152. The application program 1152 includes applets, objects, components, logic, data structures, and other computer device executable instructions that perform specific tasks or implement specific abstract data types.

[0109] In addition, this application also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the various processes of the above-described method embodiment for controlling output data and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0110] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A security protection method based on the Kyverno security strategy, characterized in that, The method includes: Obtain the set of business logic characteristics of the development and operations personnel; Principal component analysis is performed on the set of business logic characteristics to obtain a dimensionality-reduced set of characteristics; The aforementioned set of dimensionality reduction features will be used as business logic features; Select a business security strategy based on the aforementioned business logic characteristics; Based on the aforementioned business security policy, input the policy configuration parameters; When the strategy configuration parameters are passed to the Generator, the Generator finds the corresponding strategy rule template in Etcd, renders it, and generates the strategy rule. The policy rules are applied to Kyverno to generate security protection behaviors.

2. The method as described in claim 1, characterized in that, The step of selecting a business security strategy based on the business logic characteristics includes: Custom parameters are obtained based on information extracted by security personnel; Based on the aforementioned business logic characteristics, the development and operations personnel select from the custom parameters to construct the business security policy.

3. The method as described in claim 2, characterized in that, The custom parameters include: Policy rule name, resource type, namespace name, namespace tag, Pod tag, application advanced resource type, audit or block.

4. The method as described in claim 1, characterized in that, The Generator retrieves the corresponding policy rule template from Etcd for rendering, including: The Etcd stores a set of policy rule templates; Based on the set of policy rule templates, the Generator selects the policy rule template from Etcd for rendering.

5. The method as described in claim 2, characterized in that, The Etcd stores a set of policy rule templates, including: The security personnel extract strategy template information; Based on the strategy template information, construct a set of strategy rule templates; Store the set of policy rule templates in the Etcd.

6. The method as described in claim 1, characterized in that, The step of applying the policy rules to Kyverno to generate security protection behaviors includes: The policy rules are applied to Kyverno and interact with the Kubernetes API to generate the security protection behavior.

7. A security protection system based on the Kyverno security strategy, characterized in that, The system includes: The business logic feature set acquisition module is used to obtain the business logic feature set of development and operations personnel; The principal component analysis module is used to perform principal component analysis on the set of business logic characteristics to obtain a dimensionality-reduced set of characteristics. A business logic characteristic acquisition module is used to take the set of dimensionality reduction characteristics as business logic characteristics; The business security policy selection module is used to select a business security policy based on the characteristics of the business logic. The policy configuration parameter input module is used to input policy configuration parameters based on the business security policy; The strategy rule generation module is used to generate strategy rules by having the Generator find the corresponding strategy rule template in Etcd and render it when the strategy configuration parameters are passed to the Generator. The security protection behavior generation module is used to apply the policy rules to Kyverno to generate security protection behaviors.

8. A security protection electronic device based on the Kyverno security strategy, comprising a bus, a transceiver, a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the transceiver, the memory, and the processor are connected via the bus, characterized in that, When the computer program is executed by the processor, it implements the steps of the method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-6.

10. A computer program product comprising a computer program and / or instructions, characterized in that, When the computer program and / or instructions are executed by a processor, they implement the steps of the method described in any one of claims 1-6.

Images