Container-based hierarchical isolation protection method, device and medium

Abstract

The application discloses a container-based hierarchical isolation protection method, device and medium, the method is applied to a container platform, the container platform further comprises a service hierarchical management service and a security label management service, the service hierarchical management service is used for identifying a security level, and the security label management service is used for generating and verifying a security level label, and the method comprises the following steps: the service hierarchical management service and the security label management service label a container isolation running environment resource object; and isolation of container computing resources, container storage resources and container access paths is respectively created. The application improves the data hierarchical isolation protection capability of application software on the container platform, and can effectively protect the security of application data.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to a hierarchical isolation protection method and device based on a container and a medium. BACKGROUND

[0002] With the gradual adoption of microservices and cloud-native architecture by application software systems, container-based application software is widely deployed in cloud data centers, edge computing and other scenarios. Containerized application software collects, stores, processes and transmits a variety of data, resulting in a demand for hierarchical protection capabilities for data.

[0003] The container platform provides computing, storage and network resources for application software based on container cloud technology. The computing resource isolation is provided by adopting a namespace mechanism; the network resource isolation is provided by adopting a VxLAN mechanism, and the network resource isolation is usually consistent with the namespace; the storage resource isolation is provided by adopting a container storage class and a container storage volume, and different container storage classes can allocate data to different physical disks, and different storage classes and storage volumes can set different encryption keys. The container platform provides general isolation capabilities, but lacks support for the following capabilities in terms of hierarchical isolation protection requirements:

[0004] 1. Lack of identification of the security level of the application software microservice according to the security level, and further control and scheduling of the containerized microservice of the application software, to ensure the computing resource isolation and network resource isolation of the application software;

[0005] 2. Lack of identification of the security level of the storage class and the storage volume according to the security level, and lack of matching of the relationship between the terminal container microservice and the container storage volume according to the security level, to further control and schedule the storage resource isolation of the application software;

[0006] 3. Lack of matching of the traffic forwarding relationship between the terminal and the container microservice according to the security level, to control and ensure the hierarchical isolation of the access traffic of the terminal to the application software. SUMMARY

[0007] The application aims to overcome the defects of the prior art and provides a container-based hierarchical isolation protection method, device and medium.

[0008] The application achieves the above-mentioned purpose by the following technical solutions.

[0009] A container-based hierarchical isolation protection method, which is applied to a container platform, wherein the container platform further comprises a service hierarchical management service and a security label management service, the service hierarchical management service is used for identifying a security level, and the security label management service is used for generating and verifying a security label, and the method comprises the following steps.

[0010] The service hierarchical management service and the security label management service label a container isolation running environment resource object.

[0011] The isolation of a container computing resource, a container storage resource and a container access path is respectively created.

[0012] Further, the container isolation running environment resource object comprises a container namespace, a container service, a container storage class and a container storage volume.

[0013] Further, the creation of the isolation of the container computing resource specifically comprises the following steps.

[0014] The service hierarchical management service parses application template content, identifies a defined application software name with uniqueness, a defined security level and a defined container microservice;

[0015] The service hierarchical management service applies to the security label management service for creating and obtaining a namespace security label NSL-A according to the application software name with uniqueness;

[0016] The service hierarchical management service applies to the container platform for creating a namespace NS-A according to the application software name with uniqueness and the security level, and labels the newly created namespace with the security label NSL-A to identify the namespace NS-A;

[0017] The service hierarchy management service applies to and obtains a security label APPL-A generated by the security label management service from the security label management service;

[0018] The service hierarchy management service selects the namespace NS-A according to the application software name with uniqueness and the security level, creates a container microservice resource object in the namespace NS-A, and marks the newly created container microservice resource object with the security label APPL-A to identify the container microservice APP-A and its resources.

[0019] Further, the container platform further includes a storage hierarchy management service and a security key management service, the security key management service is used for security key generation and key identification, and the storage hierarchy management service is used for preprocessing storage resource objects in an application template, automatically creating a storage class corresponding to a security level according to the security level, automatically allocating a storage volume corresponding to the security level in the storage class corresponding to the security level, and associating the storage volume to a container microservice corresponding to the security level of the application software.

[0020] Further, the isolation of the container storage resource includes an inheritance key mode and an independent key mode.

[0021] Further,

[0022] In the inheritance key mode, the isolation of the container storage resource includes:

[0023] The service hierarchy management service transmits the security level in the application template, the container microservice security label APPL-A, the namespace security label NSL-A, and the container storage resource object content to the storage hierarchy management service;

[0024] The storage hierarchy management service applies to the security label management service to create and obtain a security identification SCL-A according to the security level;

[0025] The storage hierarchy management service applies to the security key management service to create and obtain a security key SK-A according to the security level;

[0026] The storage hierarchy management service queries the container platform according to the security level to determine whether a container storage class corresponding to the security level exists, applies to create the container storage class SC-A if the container storage class SC-A does not exist, injects the security key SK-A into the container storage class SC-A, and marks the newly created container storage class with the security label SCL-A to identify the container storage class SC-A;

[0027] The storage hierarchy management service applies to and obtains a security label SVL-A generated by the security label management service from the security label management service;

[0028] The storage hierarchical management service selects a matched container storage class SC-A according to the security level and the container storage resource object, then creates a container storage volume SV-A in the container storage class, automatically applies for storage space, and applies a security label SVL-A to the newly created container storage resource object to identify the container storage volume SV-A, while inheriting and loading the security key SK-A of the container storage class, thereby completing the automatic creation of the isolated protected container storage resource;

[0029] The storage hierarchical management service associates and mounts the created container storage volume SV-A to the container microservice APP-A matched by the container microservice security label APPL-A according to the container microservice security label APPL-A, and the container microservice APP-A is isolated and runs in the namespace NS-A matched by the namespace security label NSL-A.

[0030] Further, in the independent key mode, the isolation of the created container storage resource includes:

[0031] The service hierarchical management service delivers the security level, the container microservice security label APPL-A, the namespace security label NSL-A, and the container storage resource object content in the application template to the storage hierarchical management service;

[0032] The storage hierarchical management service applies for creating and obtains a security label SCL-A from the security label management service according to the security level;

[0033] The storage hierarchical management service queries whether there is a storage class of the corresponding security level from the container platform according to the security level, and if not, applies for creating a storage class SC-A, and applies a security label SCL-A to the newly created storage class to identify the storage class SC-A;

[0034] The storage hierarchical management service applies for and obtains a security label SVL-A for generating a storage volume from the security label management service;

[0035] The storage hierarchical management service applies for creating and obtaining a security key SK-A from the security key management service according to the security level;

[0036] The storage hierarchical management service selects a matched storage class SC-A according to the security level and the container storage resource object, then creates a container storage volume SV-A in the storage class, automatically applies for storage space, and applies a security label SVL-A to the newly created container storage resource object to identify the container storage volume SV-A, while injecting and adding the security key SK-A to the container storage volume SV-A, thereby completing the automatic creation of the isolated protected container storage resource;

[0037] The storage hierarchical management service associates and mounts the container storage volume SV-A to the container micro-service APP-A matched with the container micro-service security label APPL-A according to the container micro-service security label APPL-A, and the container micro-service APP-A is isolated and runs in the namespace NS-A matched with the namespace security label NSL-A.

[0038] Further, the container platform further comprises a service security gateway, the service security gateway is used for increasing security label identification, resolving the security level matched with the security label in the access request of the terminal, controlling that the traffic can be and only can be forwarded to the corresponding service of the supply security level, simultaneously combining the terminal IP address and the security level corresponding to the security label to implement access control on the terminal access request, and maintaining the traffic proxy strategy and the access control strategy of the containerized micro-service by the service hierarchical management service;

[0039] The isolation of the container access path specifically comprises:

[0040] The service security gateway receives the terminal access request, resolves and identifies the security label SL-A carried in the access request;

[0041] The service security gateway verifies the security label SL-A to the service hierarchical management service according to the security label, simultaneously queries the containerized micro-service corresponding to the security label SL-A and the corresponding traffic proxy strategy and access control strategy;

[0042] The service security gateway forwards the access request to the containerized micro-service according to the corresponding traffic proxy strategy and access control strategy.

[0043] On the other hand, the application further provides a computer device, the computer device includes a processor and a memory, the memory has a computer program, the computer program is loaded and executed by the processor to realize any one of the above-mentioned container-based hierarchical isolation protection methods.

[0044] On the other hand, the application further provides a computer readable storage medium, the storage medium has a computer program, the computer program is loaded and executed by the processor to realize any one of the above-mentioned container-based hierarchical isolation protection methods.

[0045] The beneficial effects of the application are that:

[0046] (1) compared with the general isolation ability of the existing container platform to resources, the application is based on container resource object allocation and scheduling, combined with the security label mechanism, controls the mechanism of container namespace and container network VxLAN allocated to the container platform, so that application software can obtain secure and isolated computing resources and network resources according to different security levels.

[0047] (2) The application combines the security label mechanism and the key management mechanism, so that the application software can obtain the storage resources of the corresponding security level under the isolated protection according to different security levels and only the storage resources of the corresponding security level under the isolated protection according to different security levels, and the terminal user can access the service instance of the corresponding security level and only the service instance of the corresponding security level, so that the data hierarchical isolation protection capability of the application software on the container platform is further improved, and the security of the application data can be effectively protected. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 is a hierarchical isolation protection method flowchart based on a container provided by the application;

[0049] Figure 2 is a hierarchical service identification and isolation control relationship diagram based on a container;

[0050] Figure 3 is a hierarchical storage volume identification and isolation control relationship diagram based on a container - inheritance key mode;

[0051] Figure 4 is a hierarchical storage volume identification and isolation control relationship diagram based on a container - independent key mode;

[0052] Figure 5 is a hierarchical service isolation access control relationship diagram based on a container. DETAILED DESCRIPTION

[0053] The embodiments of the application will be described in detail below with reference to specific examples. Those skilled in the art can easily understand other advantages and effects of the application from the disclosure. The application can also be implemented or applied by different specific embodiments, and the details in the specification can be modified or changed based on different views and applications without departing from the spirit of the application. It should be noted that the following examples and features in the examples can be combined with each other without conflict.

[0054] Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0055] The container platform provides general isolation capability, but lacks support for the following capabilities for data hierarchical isolation protection requirements:

[0056] 1. Lack of security level identification of application software microservice according to security level, and further control and scheduling of containerized microservice of application software, to ensure application software computing resource isolation and network resource isolation;

[0057] 2. Lack of security level identification storage class and storage volume, and lack of matching terminal container microservice and container storage volume according to security level, and further control and scheduling of application software storage resource isolation;

[0058] 3. Lack of traffic forwarding relationship matching terminal and container microservice according to security level, control and guarantee terminal access traffic classification isolation of application software.

[0059] To solve the above technical problems, the following embodiments of the application are proposed.

[0060] Embodiment 1

[0061] This embodiment is based on the allocation and management mechanism of container namespace, container service, container storage class, container storage volume resource object of container platform, and increases service classification management service and security label management service. The service classification management service is used to identify the security level, and the security label management service is used to generate and verify the security label.

[0062] Reference Figure 1 As Figure 1 The flowchart of the container-based hierarchical isolation protection method provided by this embodiment is shown. The method specifically includes:

[0063] The service classification management service and the security label management service mark the container isolation running environment resource object.

[0064] Isolation of container computing resources, container storage resources and container access paths is created respectively.

[0065] This embodiment improves the mechanism of the original container platform, marks and verifies the container namespace, container service, container storage class and container storage volume based on the security label mechanism, and performs data encryption isolation protection on the container storage class and container storage volume based on the key management mechanism. The method controls and schedules the container namespace, container service, container storage class and container storage volume resource object, and technically ensures that the corresponding security level application software can and only can process the corresponding level data, and improves the security in the process of data collection, processing, storage and transmission.

[0066] In subsequent embodiments, how to create isolation of computing resources, container storage resources and container access paths is introduced in detail.

[0067] Embodiment 2

[0068] This embodiment provides a method for creating computing resource isolation.

[0069] Currently, the container platform creates a corresponding namespace according to the namespace name specified by the namespace keyword in the application template, and then creates computing resources and network resources in the namespace. This method needs to plan the isolation measures in advance, and the same application software cannot automatically create and allocate computing resources and network resources of the corresponding security level according to the security level.

[0070] In the case that the application template does not fix the namespace in advance, the embodiment increases the micro-service security level identifier, and the service classification management service preprocesses the application template. According to the micro-service security level, the micro-service is automatically created and associated with the namespace of the corresponding security level of the application software.

[0071] Referring to Figure 2 As Figure 2 shown is a schematic diagram of the service classification identifier and isolation control relationship based on the container in the embodiment.

[0072] The creation of the computing resource isolation specifically includes the following steps:

[0073] 1. The service classification management service parses the application template content, identifies the defined application software name with uniqueness, the defined security level, and the defined container micro-service resource object;

[0074] 2. The service classification management service applies to the security tag management service for creating and obtaining the security tag NSL-A according to the application software name with uniqueness;

[0075] 3. The service classification management service applies to the container platform for creating the namespace NS-A according to the application software name with uniqueness and the security level, and marks the newly created namespace with the security tag NSL-A to identify the namespace NS-A;

[0076] 4. The service classification management service applies to the security tag management service for creating and obtaining the security tag APPL-A for generating the micro-service;

[0077] 5. The service classification management service selects the matching namespace NS-A according to the application software name with uniqueness and the security level, creates the container micro-service resource object in the namespace, and marks the newly created container micro-service resource object with the security tag APPL-A to identify the container micro-service APP-A and its resources, thereby completing the automatic creation of the computing and network resources of the container micro-service APP-A.

[0078] Embodiment 3

[0079] The embodiment provides a method for creating container storage resource isolation.

[0080] Currently, the container platform automatically creates a corresponding storage volume according to the storage class in the storage resource object in the application template, and associates it to the container microservice according to the storage volume size. The same application software cannot automatically create and allocate storage resources of corresponding security levels according to security levels.

[0081] The embodiment increases the security key management service in the traditional container platform, adds the security level identifier of the storage class, and pre-processes the storage resource object in the application template by the storage hierarchical management service. The corresponding security level storage class is automatically created according to the security level, and the corresponding security level storage volume is automatically allocated in the corresponding security level storage class. The storage volume is associated to the container microservice of the corresponding security level of the application software.

[0082] Reference Figure 3 As Figure 3 The following is a schematic diagram of the hierarchical identification and isolation control relationship-inheritance key mode of the container-based storage volume of the embodiment.

[0083] Under the inheritance key mode, the hierarchical identification and isolation control process of the container-based service is as follows:

[0084] The service hierarchical management service passes the security level, container microservice security label APPL-A, namespace security label NSL-A, and container storage resource object content in the application template to the storage hierarchical management service;

[0085] The storage hierarchical management service applies to the security label management service for creating and obtaining the security identifier SCL-A according to the security level;

[0086] The storage hierarchical management service applies to the security key management service for creating and obtaining the security key SK-A according to the security level;

[0087] The storage hierarchical management service queries the container platform according to the security level to determine whether there is a storage class of the corresponding security level. If not, it applies to create the storage class SC-A. Then, the security key SK-A is injected into the storage class SC-A, and the newly created storage class is marked with the security label SCL-A to identify the storage class SC-A;

[0088] The storage hierarchical management service applies to the security label management service for creating and obtaining the security label SVL-A of the storage volume;

[0089] The storage hierarchical management service selects the matching storage class SC-A according to the security level and the container storage resource object, and then creates the container storage volume SV-A and automatically applies for the storage space in the storage class. The newly created container storage resource object is marked with the security label SVL-A to identify the container storage volume SV-A, and the security key SK-A of the storage class is inherited and loaded, completing the automatic creation of the isolated protected container storage resource;

[0090] ⑦Storage hierarchical management service associates and mounts the container storage volume SV-A created according to the container micro-service security label APPL-A to the container micro-service APP-A matched by the container micro-service security label APPL-A, and the container micro-service APP-A runs in isolation in the namespace NS-A matched by the namespace security label NSL-A.

[0091] Embodiment 4

[0092] This embodiment provides another method for creating container storage resource isolation.

[0093] In addition to the container-based service hierarchical identification and isolation control method provided in Embodiment 3 in the inheritance key mode, the container-based service hierarchical identification and isolation control can also be implemented in the independent key mode.

[0094] Reference Figure 4 As shown in Figure 4 is a container-based storage volume hierarchical identification and isolation control relationship-independent key mode diagram of this embodiment.

[0095] In the independent key mode, the container-based service hierarchical identification and isolation control process is as follows:

[0096] ①The service hierarchical management service passes the security level, container micro-service security label APPL-A, namespace security label NSL-A, and container storage resource object content in the application template to the storage hierarchical management service for transmission;

[0097] ②The storage hierarchical management service applies to the security label management service for creating and obtaining the security identification SCL-A according to the security level;

[0098] ③The storage hierarchical management service queries the container platform according to the security level to check whether there is a storage class of the corresponding security level, and if not, applies to create the storage class SC-A, and marks the newly created storage class with the security label SCL-A to identify the storage class SC-A;

[0099] ④The storage hierarchical management service applies to the security label management service for and obtains the security label SVL-A for generating the storage volume;

[0100] ⑤The storage hierarchical management service applies to the security key management service for creating and obtaining the security key SK-A according to the security level;

[0101] ⑥The storage hierarchical management service selects a matching storage class SC-A according to the security level and the container storage resource object, and then creates a container storage volume SV-A in the storage class, automatically applies for storage space, and marks the newly created container storage resource object with a security label SVL-A to identify the container storage volume SV-A, while injecting and adding a security key SK-A to the container storage volume SV-A, thereby completing the automatic creation of the isolated container storage resource;

[0102] ⑦The storage hierarchical management service associates and mounts the created container storage volume SV-A to the container microservice APP-A matched by the container microservice security label APPL-A according to the container microservice security label APPL-A, and the container microservice APP-A is isolated and runs in the namespace NS-A matched by the namespace security label NSL-A.

[0103] Embodiment 5

[0104] The embodiment provides a method for creating isolation of a container access path.

[0105] Currently, the service gateway of the container platform automatically discovers the corresponding container microservice of the backend and establishes a traffic forwarding relationship, configures a traffic proxy strategy according to the domain name, port and path information of the container microservice, and provides traffic forwarding of terminal access service and access control based on the terminal IP address.

[0106] The embodiment adds a service security level identifier and a service security gateway, the service security gateway adds a security label identifier, parses the security level matched by the security label in the access request of the terminal, controls the traffic to be and only be forwarded to the corresponding service of the supply security level, simultaneously implements access control on the terminal access request in combination with the terminal IP address and the security level corresponding to the security label, and maintains the traffic proxy strategy and the access control strategy of the containerized microservice by the service hierarchical management service.

[0107] Reference Figure 5 As Figure 5 shown is a schematic diagram of service hierarchical isolation access control based on containers in the embodiment.

[0108] The service hierarchical isolation access control process based on containers is as follows:

[0109] ①The service security gateway receives a terminal access request, parses and identifies the security label SL-A carried in the access request;

[0110] ②The service security gateway verifies the security label SL-A to the service hierarchical management service according to the security label, simultaneously queries the containerized microservice corresponding to the security label SL-A, and the corresponding traffic proxy strategy and access control strategy;

[0111] ③The service security gateway forwards the access request to the containerized microservice according to the corresponding traffic proxy policy and access control policy.

[0112] The container-based hierarchical isolation protection method provided in the foregoing embodiments 1-5 controls the mechanism of allocating a container namespace and a container network VxLAN to the container platform based on container resource object allocation and scheduling in combination with a security label mechanism, so that application software can obtain secure and isolated computing resources and network resources according to different security levels; in combination with the security label mechanism and the key management mechanism, the application software can obtain only the storage resources of the corresponding security level that are protected by isolation according to different security levels, so that the terminal user can access only the service instance of the corresponding security level, and the data hierarchical isolation protection capability of the application software on the container platform is further improved, and the security of application data can be effectively protected.

[0113] Embodiment 6

[0114] The preferred embodiment provides a computer device that can implement the steps in any embodiment of the container-based hierarchical isolation protection method provided in the embodiments of the present application, and therefore can implement the beneficial effects of the container-based hierarchical isolation protection method provided in the embodiments of the present application. For details, refer to the foregoing embodiments, which will not be described here again.

[0115] Embodiment 7

[0116] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructions or by controlling relevant hardware by the instructions, which can be stored in a computer readable storage medium and loaded and executed by a processor. Therefore, the embodiments of the present application provide a storage medium in which a plurality of instructions are stored, which can be loaded by a processor to execute the steps in any embodiment of the container-based hierarchical isolation protection method provided in the embodiments of the present application.

[0117] The storage medium can include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0118] Since the instructions stored in the storage medium can execute the steps in any container-based hierarchical isolation protection method embodiment provided in the embodiments of the present application, the beneficial effects that can be achieved by any container-based hierarchical isolation protection method provided in the embodiments of the present application can be achieved. For details, refer to the foregoing embodiments, which will not be described here again.

[0119] The above merely describes preferred embodiments of the present application, and is not used to limit the present application, any modification, equivalent replacement and improvement within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A container-based hierarchical isolation protection method, the method is applied to a container platform, characterized in that, The container platform further comprises a service level management service and a security label management service, the service level management service is used for identifying a security level and calling the security label management service to generate a security label identifying a security level of a software microservice and a verification security label, and the method comprises: The service level management service and the security label management service label a container isolated running environment resource object; Isolation of container computing resources, container storage resources and container access paths is respectively created; The container isolated running environment resource object comprises a container namespace, a container service, a container storage class and a container storage volume; Creating isolation of container computing resources specifically comprises: The service level management service parses application template content, identifies a defined application software name with uniqueness, a defined security level and a defined container microservice; The service level management service applies to the security label management service for creating and obtaining a namespace security label NSL-A according to the application software name with uniqueness; The service level management service applies to the container platform for creating a namespace NS-A according to the application software name with uniqueness and the security level, and labels the newly created namespace with the security label NSL-A to identify the namespace NS-A; The service level management service applies to the security label management service for creating and obtaining a security label APPL-A of a microservice; The service level management service selects the namespace NS-A according to the application software name with uniqueness and the security level, creates a container microservice resource object in the namespace NS-A, and labels the newly created container microservice resource object with the security label APPL-A to identify the container microservice APP-A and resources thereof.

2. The container-based hierarchical isolation protection method of claim 1, wherein, The container platform further comprises a storage level management service and a security key management service, the security key management service is used for security key generation and key identification, and the storage level management service is used for preprocessing storage resource objects in an application template, automatically creating a storage class corresponding to a security level according to the security level, automatically allocating a storage volume corresponding to the security level in the storage class corresponding to the security level, and associating the storage volume to a container microservice corresponding to the security level of the application software.

3. The container-based hierarchical isolation protection method of claim 2, wherein, Creating isolation of container storage resources comprises an inheritance key mode and an independent key mode.

4. The container-based hierarchical isolation protection method of claim 3, wherein In the inheritance key mode, creating isolation of container storage resources comprises: The service level management service passes the security level, the container microservice security label APPL-A, the namespace security label NSL-A and the container storage resource object content in the application template to the storage level management service; The storage level management service applies to the security label management service for creating and obtaining a security identification SCL-A according to the security level; The storage level management service applies to the security key management service for creating and obtaining a security key SK-A according to the security level; The storage hierarchical management service queries the container platform whether there is a container storage class of the corresponding security level according to the security level, and applies for creating the container storage class SC-A if not, and then injects the security key SK-A into the container storage class SC-A, and marks the newly created container storage class with the security label SCL-A to identify the container storage class SC-A; The storage hierarchical management service applies to and obtains the security label SVL-A for generating the container storage volume from the security label management service; The storage hierarchical management service selects the matched container storage class SC-A according to the security level and the container storage resource object, and then creates the container storage volume SV-A and automatically applies for the storage space in the container storage class, marks the newly created container storage resource object with the security label SVL-A to identify the container storage volume SV-A, simultaneously inherits and loads the security key SK-A of the container storage class, and completes the automatic creation of the isolated protected container storage resource; The storage hierarchical management service associates and mounts the created container storage volume SV-A to the container microservice APP-A matched by the container microservice security label APPL-A, and the container microservice APP-A is isolated and runs in the namespace NS-A matched by the namespace security label NSL-A.

5. The container-based hierarchical isolation protection method of claim 3, wherein, In the independent key mode, the isolation of the created container storage resource includes: The service hierarchical management service delivers the security level, the container microservice security label APPL-A, the namespace security label NSL-A, and the container storage resource object content in the application template to the storage hierarchical management service; The storage hierarchical management service applies to and obtains the security label SCL-A for creating from the security label management service according to the security level; The storage hierarchical management service queries the container platform whether there is a storage class of the corresponding security level according to the security level, and applies for creating the storage class SC-A if not, and marks the newly created storage class with the security label SCL-A to identify the storage class SC-A; The storage hierarchical management service applies to and obtains the security label SVL-A for generating the storage volume from the security label management service; The storage hierarchical management service applies to and obtains the security key SK-A for creating from the security key management service according to the security level; The storage hierarchical management service selects the matched storage class SC-A according to the security level and the container storage resource object, and then creates the container storage volume SV-A and automatically applies for the storage space in the storage class, marks the newly created container storage resource object with the security label SVL-A to identify the container storage volume SV-A, simultaneously injects and adds the security key SK-A into the container storage volume SV-A, and completes the automatic creation of the isolated protected container storage resource; The storage hierarchical management service associates and mounts the created container storage volume SV-A to the container microservice APP-A matched by the container microservice security label APPL-A, and the container microservice APP-A is isolated and runs in the namespace NS-A matched by the namespace security label NSL-A.

6. The container-based hierarchical isolation protection method of claim 4 or 5, wherein, The container platform further comprises a service security gateway, which is configured to add security tag identification, parse a security level matched by a security tag in a terminal access request, control forwarding of traffic to a corresponding service supporting the security level, and implement access control on the terminal access request in combination with a terminal IP address and a security level corresponding to the security tag, and maintain traffic proxy policies and access control policies of the containerized microservice by a service hierarchical management service; The isolation of creating a container access path specifically comprises: The service security gateway receives a terminal access request, parses and identifies a security tag SL-A carried in the access request; The service security gateway verifies the security tag SL-A according to the security tag, and queries a containerized microservice corresponding to the security tag SL-A, and corresponding traffic proxy policies and access control policies; The service security gateway forwards the access request to the containerized microservice according to the corresponding traffic proxy policies and access control policies.

7. A computer device, comprising: The computer device comprises a processor and a memory, and the memory stores a computer program, which is loaded and executed by the processor to implement the container-based hierarchical isolation protection method according to any one of claims 1-6.

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which is loaded and executed by the processor to implement the container-based hierarchical isolation protection method according to any one of claims 1-6.

Images