A method and system for detecting weak passwords in containerized application services

Abstract

This invention relates to the field of information technology, specifically disclosing a method and system for detecting weak passwords in containerized application services. The method includes: obtaining container nelink socket information in the kernel based on the container's NameSpaceID, and obtaining the container's network port information; enriching and associating container network port and process information; obtaining all processes of the container and matching them with the container based on the network information of the container's nelink socket information; and obtaining the network IP address of the container corresponding to the host machine. This invention uses kernel nelink sockets to construct container network and process information to accurately filter and identify weak password detection targets and detection methods, enabling real-time detection of dynamically changing weak password security issues during container process runtime, reducing false negatives and false positives.

Description

Technical Field

[0001] This invention relates to the field of information technology, specifically to a method and system for detecting weak passwords in containerized application services. Background Technology

[0002] Traditional weak password detection within containers, based on static container image file scanning, cannot detect weak password issues caused by dynamic human factors after the image starts, such as mounting configuration files with weak passwords at startup or starting container processes with image parameters containing weak passwords. External weak password scanning tools cannot detect weak passwords for applications whose ports are not exposed to the container. Furthermore, detection methods based on traversing process information will detect a large number of temporary script processes that do not have network ports and do not require detection. Traditional methods also lack caching mechanisms for component characteristics and weak password characteristics, resulting in significant waste of detection resources.

[0003] To address the above problems, this invention provides a method and system for detecting weak passwords in containerized application services. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for detecting weak passwords in containerized application services. By collecting kernel netlink socket information corresponding to different container network spaces, the system filters out container application software to be monitored for real-time weak password monitoring. By constructing a correlation between container network socket information and process information, as well as collecting asset information, the system can dynamically and specifically monitor weak password issues during container runtime, solving the problem of undetectable issues due to container network isolation. Furthermore, based on weak passwords and the technical characteristics of various components, the system creates an efficient caching mechanism to improve detection efficiency and reduce false negatives and false negatives.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for detecting weak passwords in containerized application services, the method comprising:

[0006] Step S100: Obtain the container netlinksocket information in the kernel based on the container's network space namespace ID, and obtain the container's network port information;

[0007] Step S200: Associate container network port and process information, obtain all processes of the container and match them according to the network port information of the container, and obtain the network IP address of the container corresponding to the host machine;

[0008] Step S300: Container application service identification and asset collection. Based on the above information, collect the corresponding configuration, asset file information and container program dynamic information.

[0009] Step S400, Detect weak passwords for container application services;

[0010] Step S500: Cache weak password detection information for container application services. Cache the information after weak password detection for container application services.

[0011] Step S600: The scan summary module summarizes and displays the scan results of each container, highlighting the weak password security issues of all containers on the machine.

[0012] As a preferred embodiment of the present invention, the detailed steps of step S100 are as follows: obtain all container IDs of the container, and obtain the required network port information from the kernel net link socket according to the container network space ID, wherein the network port information is used to open the listening port information, including IP and port, network protocol tcp or udp, user ID number, and inode number corresponding to the socket.

[0013] As a preferred embodiment of the present invention, the detailed steps of step S200 are as follows: associating container network ports and process information, obtaining all processes of the container, matching the inode number of the process's open fd with the obtained kernel network information, enriching the corresponding process running parameters and process name for each socket information, and obtaining the network IP address corresponding to the container.

[0014] As a preferred embodiment of the present invention, the detailed steps of step S300 are as follows: identify the corresponding software application type based on the process name and running parameters of each socket information, collect the corresponding configuration and asset file information based on the technical characteristics of the container service, and collect the startup command and mounted file information of the corresponding container.

[0015] As a preferred embodiment of the present invention, there are two monitoring methods for step S400, the details of which are as follows:

[0016] One method is local password key matching, which uses the obtained application service asset information to extract the corresponding user account and key password information for different service types. Through the password key encryption algorithm mechanism of each service component, the weak passwords generated by the weak password dictionary and weak password generation algorithm are generated by key verification through the corresponding encryption mechanism. Finally, the key verification value of the weak password dictionary is compared with the password verification value corresponding to the user account obtained from the container service asset. If a match is found, the corresponding weak password information is identified.

[0017] Another detection method is to use the corresponding client API to detect based on the identified container application service technical characteristics. This involves establishing a connection using the container network IP and port relative to the container, and using a weak password dictionary for login. If the connection is successfully established, the corresponding weak password problem is detected.

[0018] As a preferred embodiment of the present invention, the details of step S500 are as follows:

[0019] The socket information, corresponding process service asset information, and weak password detection results of container process services collected by the above modules are stored in the cache. For some components whose encryption mechanisms do not have random salt values, the rainbow table of key verification values ​​generated by their weak password dictionaries also needs to be cached. Through the data of the cache module, the incremental updates of socket information are compared in real time to monitor newly emerging weak password issues in container services. During detection, the cached detection results are prioritized. If the username and key of the container component process account have not changed, the result cache is directly reused. If the username and account have changed, some services without random salt encryption mechanisms can quickly match by querying the rainbow table. For the result cache of container process service components detected through the client API, some components that require restarting the process service after changing the account password will check whether the process startup time and process identifier in the cache have changed to determine whether they need to be re-detected. Furthermore, the change of weak password dictionary is also included in the cache expiration judgment in the caching mechanism.

[0020] A weak password detection system for containerized application services, the system being used to execute the above method, the system comprising:

[0021] Information acquisition module, the information acquisition module is used to acquire container net link socket information in the kernel;

[0022] An association extension module is used to perform association and enrichment of container network port and process information;

[0023] A service and asset collection module, which includes application service identification and asset collection.

[0024] A password detection module, which is used to perform weak password detection for container application services;

[0025] The detection information caching module is used to cache weak password detection information for container application services.

[0026] Compared with the prior art, the beneficial effects of the present invention are:

[0027] 1. By building container network and process information through kernel net lin nk sockets, it can accurately filter and identify weak password detection targets and detection methods, and can detect weak password security issues that dynamically change during container process runtime in real time, reducing false negatives and false positives.

[0028] 2. By using a weak password caching mechanism, a weak password rainbow table is used to cache the authentication encryption mechanism of some components without salted random values, even when the password of the container application service has not been modified. This reduces redundant detection and computing power waste. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention.

[0030] Figure 1 This is a flowchart of the method of the present invention;

[0031] Figure 2 This is an overall flowchart of the present invention;

[0032] Figure 3 This is a flowchart illustrating the kernel information acquisition, construction, association, expansion, container identification, and collection process of this invention.

[0033] Figure 4 The weak password detection process for container application services of this invention - overall flowchart;

[0034] Figure 5 The specific process for weak password detection in container application services according to the present invention Figure 1 ;

[0035] Figure 6 The specific process for weak password detection in container application services according to the present invention Figure 2 ;

[0036] Figure 7 The flowchart of the caching mechanism of this invention - detection trigger and cache refresh;

[0037] Figure 8 This is a flowchart of the caching mechanism of the present invention - weak password cache query and save process;

[0038] Figure 9 The flowchart of the caching mechanism of this invention - dictionary refresh cache update mechanism. Detailed Implementation

[0039] To make the technical problems to be solved, the technical solutions, and the beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention.

[0040] Please see Figures 1-9 This invention provides a method for detecting weak passwords in application services within a container, the method comprising:

[0041] Step S100 obtains the container netlink socket information in the kernel based on the container's network space namespace ID, and obtains the container's network port information. The detailed steps of step S100 are as follows: obtain all container IDs of the container, and obtain the required network port information from the kernel netlink socket based on the container's network space ID. The network port information is used to open the listening port, including IP and port, network protocol TCP or UDP, user ID number, and the inode number corresponding to the socket.

[0042] Step S200: Container network port and process information association and enrichment module: Obtain all processes of the container and match them according to the network port information of the container, and obtain the network IP address of the container corresponding to the host machine. The detailed steps of step S200 are as follows: Container network port and process information association and enrichment module: Obtain all processes of the container, match the inode number of the open fd of the process with the obtained kernel network information, enrich the corresponding process running parameters and process name of each socket information, and obtain the network IP address corresponding to the container.

[0043] Step S300 Container application service identification and asset collection: Based on the above information, collect corresponding configuration and asset file information. The detailed steps of step S300 are as follows: Identify the corresponding software application type based on the process name and running parameters of each socket information; collect the corresponding configuration and asset file information based on the technical characteristics of the container service; and collect the corresponding container's startup command and mounted file information.

[0044] Step S400: Weak password detection for container application services. There are two monitoring methods for step S400, as detailed below:

[0045] One method is local password key matching, which uses the obtained application service asset information to extract the corresponding user account and key password information for different service types. Through the password key encryption algorithm mechanism of each service component, the weak passwords generated by the weak password dictionary and weak password generation algorithm are generated by key verification through the corresponding encryption mechanism. Finally, the key verification value of the weak password dictionary is compared with the password verification value corresponding to the user account obtained from the container service asset. If a match is found, the corresponding weak password information is identified.

[0046] Another detection method is to use the corresponding client API to detect based on the identified container application service technical characteristics. This involves establishing a connection by using the container network IP and port relative to the container, and using a weak password dictionary to log in. If the connection is successfully established, the corresponding weak password problem is detected.

[0047] Step S500: Cache of weak password detection information for container application services. The information obtained after weak password detection for container application services is cached. The details of step S500 are as follows:

[0048] The socket information, corresponding process service asset information, and weak password detection results of container process services collected by the above modules are stored in the cache. For some components whose encryption mechanisms do not have random salt values, the rainbow table of key verification values ​​generated by their weak password dictionaries also needs to be cached. Through the data of the cache module, the incremental updates of socket information are compared in real time to monitor newly emerging weak password issues in container services. During detection, the cached detection results are prioritized. If the username and key of the container component process account have not changed, the result cache is directly reused. If the username and account have changed, some services without random salt encryption mechanisms can be quickly matched by querying the rainbow table. For the result cache of container process service components detected through the client API, some components that require restarting the process service after changing the account password will check whether the process startup time and process identifier in the cache have changed to determine whether they need to be re-detected. Furthermore, the change of weak password dictionary is also included in the cache expiration judgment in the caching mechanism.

[0049] Step S600, the scan summary module, summarizes and displays the scan results of each container, highlighting the weak password security issues of all containers on the machine.

[0050] In summary, the overall process of the method described in this invention is as follows: Figure 2The host machine mentioned below refers to the container described in this invention: First, through a caching mechanism, the net link socket information is refreshed periodically. Then, the corresponding container network socket information in the kernel net link socket is obtained. Then, the information is enriched and extended. Next, container service identification and filtering, asset configuration collection, and external mounting information collection are performed. Then, the detection summary results are output through the caching mechanism, or weak password logic detection is performed, that is, detection is performed through the service client API interface connection method and the local password key matching method. After the detection, the results are output.

[0051] A weak password detection system for containerized application services, the system comprising:

[0052] Information acquisition module, the information acquisition module is used to acquire container net link socket information in the kernel;

[0053] An association extension module is used to perform association and enrichment of container network port and process information;

[0054] A service and asset collection module, which includes application service identification and asset collection.

[0055] A password detection module, which is used to perform weak password detection for container application services;

[0056] The detection information caching module is used to cache weak password detection information for container application services.

[0057] For further details, please refer to Figure 3 , Figure 3 The flowchart for kernel information acquisition, construction, association extension, container identification, and collection in this invention is as follows: First, a caching mechanism is used to periodically refresh net folder socket information. Next, all containers and their container identifiers (IDs) are obtained, followed by the net network space ID of each container. Then, the corresponding container network socket information in the kernel net folder socket is obtained based on the net space ID. Next, by querying the inode of the file handle (fd) opened by the container process and the inode number of the socket information, the association between container network port and process information is constructed. Then, the container socket information is expanded and enriched, including the container host IP address, corresponding process running parameters, process name, etc. Next, the container application type corresponding to the socket information is identified. Then, the corresponding configuration and asset information is collected according to the service application technology characteristics. Container startup commands and external mounted file information are collected. Finally, the information is classified and saved to the cache module.

[0058] For further details, please refer to Figure 4 , Figure 4 The following is an overall flowchart of the container application service weak password detection process of the present invention. The weak password detection process of the present invention is as follows: First, query the cache to confirm whether monitoring needs to be triggered. If so, the cache is valid, the cached result is used and displayed, otherwise the cache is invalid. Select the corresponding weak password detection method according to the component characteristics, namely local password key weak password detection and host service client API weak password detection. Select one of them for detection, then update the cache and output the result.

[0059] For further details, please refer to Figure 5 , Figure 5 This is a flowchart illustrating the weak password detection process for container application services according to the present invention. For the local password key weak password detection flowchart, it includes parsing the mounted configuration file information and container startup parameter configuration file assets. Next, it extracts the corresponding user account and key password information for different service types. Then, it checks whether the weak password check value matches the password key information of the container component. If they match, a weak password is detected, and the process exits. For the initial weak password dictionary, after extracting the corresponding user account and key password information for different service types, the username is added to the generation factors of the weak password generation algorithm, and a weak password dictionary is generated using the weak password dictionary generation algorithm. Then, the password key encryption algorithm mechanism corresponding to the container service component calculates the weak password key check value to determine whether the weak password check value matches the password key information of the container component.

[0060] For further details, please refer to Figure 6 , Figure 6 The specific process for weak password detection in container application services according to the present invention Figure 2 For weak password detection of host service client API, first obtain the container network IP and port of the container service relative to the host machine, then use the corresponding client API to detect and establish a connection, and then traverse the final dictionary of weak passwords and user connection attempts until a connection is successfully established, thus detecting the weak password.

[0061] For further details, please refer to Figure 7 , Figure 7The flowchart of the caching mechanism of this invention - detection trigger and cache refresh process is as follows: First, the caching mechanism periodically triggers a comparison to see if the net link socket information of each container has changed. If it has changed, a detection is triggered and the corresponding cache is queried according to the component characteristics. It is determined whether the password component uses the password key detection method to check if the password key exists in the cache. If it does, no detection is needed and the cache is used. If not, it is further determined whether there is a random salt value encryption algorithm mechanism component. If it does, no detection is needed. If not, a detection is triggered. It is determined whether the weak password detection of the host service client API and the password change after service restart have taken effect. If not, a detection is triggered. If it has taken effect, the cache is queried to confirm whether the component has been updated by the container application service process startup time. If not, it has not been updated and the cache is valid. Otherwise, a detection is triggered.

[0062] For further details, please refer to Figure 8 , Figure 8 The caching mechanism of this invention—weak password cache query and storage diagram—has the following process: First, obtain the component user and key, as well as other necessary information. Then, query the weak password matching result database, and then determine whether the data can be found. If it is found, determine whether the data update is newer than the dictionary update time. If it is newer, the test result is fed back; otherwise, the dictionary refresh cache update stage is entered. If no weak password matching result is found, further query the rainbow table database, and then filter the type to query the ordinary dictionary rainbow table and the same username rainbow table, and determine whether both are empty. If data can be found in both cases, that is, neither is empty, then check whether the data query time is newer than the dictionary update time. If it is newer, use the rainbow table to perform matching and record the matching result in the weak password matching result database; otherwise, the dictionary refresh cache update stage is entered. If the filter type queries both the regular dictionary rainbow table and the same username rainbow table fail to return data, then it checks if a general weak password rainbow table is found. If not, it reads the general weak password table from the weak password database, generates weak passwords for username prefixes and suffixes, and uses the username as the password, then generates a rainbow table and records it in the rainbow table database. Next, the rainbow table is matched, and the matching results are recorded in the weak password matching result database. If a general weak password rainbow table is found, it checks if the query time is newer than the dictionary update time. If so, it reads the weak password database, generates a rainbow table for username prefixes and suffixes, and records it in the rainbow table database. Next, the rainbow table is matched, and the matching results are recorded in the weak password matching result database. If the query time is not newer than the dictionary update time, it proceeds to the dictionary refresh cache update stage.

[0063] For further details, please refer to Figure 9 , Figure 9The following is a diagram of the dictionary refresh cache update mechanism, which is a caching mechanism. The process begins with the dictionary refresh cache update step. First, the dictionary type and the query result time A are obtained. Then, the data in the weak password table for that type that is newer than A are traversed. Next, it is determined whether the data type is 0 and newly added. If so, a key is generated, saved to the rainbow table database, and the update time of all data of that type is refreshed to the current time. If it is a user-related weak password, the time of all user-related data is refreshed. Otherwise, the weak password key is deleted from the rainbow table database, and the time of that type is updated.

[0064] In summary, this invention can incrementally update container socket network information based on cached information to monitor weak password security issues in container runtime services. It primarily obtains corresponding net lin nk socket information from the kernel based on the network space ID within different containers, thereby constructing the association between container network ports and process information and enriching and expanding other necessary information. Based on the aforementioned information fingerprint, it identifies the software application type corresponding to each socket information within the container and collects asset configuration information and external dynamic information based on the technical characteristics of the software.

[0065] Weak password detection is performed using both local key verification value matching and client API network connection establishment. Targeted and efficient caching is implemented based on the technical characteristics of different application service types to reduce the performance overhead of repeated detection. This enables monitoring of weak password security vulnerabilities dynamically modified during container runtime, and achieves precise detection granularity through the correlation of socket information and process information, as well as asset fingerprinting. The caching mechanism, designed specifically for the technical characteristics of application services and weak passwords, significantly improves detection efficiency and reduces performance consumption.

[0066] By acquiring and distinguishing the net network space ID of the container, the corresponding net link socket information is obtained from the kernel to construct the container's real-time weak password detection target. By adding data collection, the target can be accurately filtered and targeted for detection, enabling real-time weak password security monitoring.

[0067] By combining the characteristics of weak password technology and various application features to create an efficient caching mechanism, the weak password rainbow table of the authentication encryption mechanism algorithm without salted random values ​​is cached, account passwords are cached, process startup time status is cached, and a weak password dictionary change refresh process is added to the cache, which greatly improves detection efficiency.

[0068] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0069] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for detecting weak passwords in containerized application services, characterized in that, The method includes: Step S100: Obtain the container netlink socket information in the kernel based on the container's network space NameSpaceID, and obtain the container's network port information; Step S200: Associate container network port and process information, obtain all processes of the container and match them according to the network information of the container's netlink socket information, and obtain the network IP address of the container corresponding to the host machine; Step S300: Container application service identification and asset collection. Based on the above information, collect the corresponding configuration, asset file information and container program dynamic information. Step S400, Detect weak passwords for container application services; Step S500: Cache weak password detection information for container application services. Cache the information after weak password detection for container application services. Step S600: The scan summary module summarizes and displays the scan results of each container, highlighting the weak password security issues of all containers on the machine. The details of step S500 are as follows: The socket information, socket corresponding process service asset information, and container process service weak password detection results collected by the above modules are stored in the cache. For some components whose encryption mechanism does not have a random salt value, the key verification value rainbow table generated by its weak password dictionary also needs to be cached. The data from the caching module is used to compare the incremental updates of socket information in real time, monitor newly emerging weak password issues in container services in real time, and prioritize matching the detection result cache during detection. If the username and key of the container component process account have not changed, the result cache is directly reused. If the username and account have changed, some services without random salt encryption mechanism can be quickly matched by querying the rainbow table. For the result caching of container process service components that are detected through the client API, some components that require restarting the process service after changing the account password will determine whether a re-detection is needed by querying whether the process startup time and process identifier in the cache have changed. Furthermore, changes in the weak password dictionary are also included in the cache expiration judgment in the caching mechanism.

2. The method for detecting weak passwords for application services within a container according to claim 1, characterized in that, The detailed steps of step S100 are as follows: Obtain all container IDs of the container, and obtain the required network port information from the kernel netlinksocket according to the container network space ID. The network port information is used to open the listening port, including IP and port, network protocol TCP or UDP, user ID number, and inode number corresponding to the socket.

3. The method for detecting weak passwords for in-container application services according to claim 2, characterized in that, The detailed steps of step S200 are as follows: Associating container network ports with process information, obtaining all processes of the container, matching the inode number of the open fd of the process with the obtained kernel network information, enriching the corresponding process running parameters and process name of each socket information, and obtaining the network IP address corresponding to the container.

4. The method for detecting weak passwords for application services within a container according to claim 3, characterized in that, The detailed steps of step S300 are as follows: Identify the corresponding software application type based on the process name and running parameters of each socket information, collect the corresponding configuration and asset file information based on the technical characteristics of the container service, and collect the startup command and mounted file information of the corresponding container.

5. The method for detecting weak passwords for in-container application services according to claim 4, characterized in that, There are two monitoring methods for step S400, the details of which are as follows: One method is local password key matching, which is used to extract the corresponding user account and key password information for different service types based on the obtained application service asset information. By using the password key encryption algorithm mechanism of each service component, the weak password dictionary and the weak password generated by the weak password generation algorithm are used to generate key verification values ​​through the corresponding encryption mechanism; Finally, the key verification value of the weak password dictionary is compared with the password verification value of the user account obtained from the container service assets. If a match is found, the corresponding weak password information is identified. Another detection method is to use the corresponding client API for detection based on the identified technical characteristics of the container application service; A connection is established by using the container network IP and port relative to the container, and a weak password dictionary is used for login. If the connection is successful, the corresponding weak password problem is detected.

6. A weak password detection system for application services within a container, characterized in that, The system is used to perform the method according to any one of claims 1-5, the system comprising: Information acquisition module, the information acquisition module is used to acquire container netlink socket information in the kernel; An association extension module is used to perform association and enrichment of container network port and process information; A service and asset collection module, which includes application service identification and asset collection. A password detection module, which is used to perform weak password detection for container application services; The detection information caching module is used to cache weak password detection information for container application services.

Images