Method, system, electronic device and storage medium for safe detection of container flow

Abstract

The application provides a container flow security detection method and system, an electronic device and a storage medium. A host computer is provided with a service container and a security service container. The method comprises: obtaining container flow received and sent by the service container; and redirecting the container flow to the security service container, so that the security service container can perform security detection on the container flow.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, in particular to a container traffic security detection method and system, an electronic device and a storage medium. BACKGROUND

[0002] With the continuous development of technology, application containerization has become a new trend. In the application containerization technology, one or more containers can be deployed on the host of the container, which can receive or send data externally, thereby forming container traffic. Network attack information may be carried in the container traffic, so it is crucial to detect the security of the container traffic. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a container traffic security detection method and system, an electronic device and a storage medium for detecting the security of the container traffic.

[0004] The first aspect of the embodiments of the present application provides a container traffic security detection method, a host is provided with a business container and a security service container, and the method comprises:

[0005] Obtaining the container traffic received and sent by the business container;

[0006] Redirecting the container traffic to the security service container for security detection of the container traffic by the security service container.

[0007] In an embodiment, when the container traffic passes the security detection, the method further comprises:

[0008] Sending the container traffic to the business container; or,

[0009] Sending the container traffic to a receiving end.

[0010] In an embodiment, the host is provided with a plurality of business containers, and the communication between each business container is isolated. The method further comprises:

[0011] Building a communication connection between the security service container and each business container through a virtual network device veth pair.

[0012] In an embodiment, the virtual network device veth pair comprises an in-eth0 network card, an eth0 network card, an ex-eth0 network card and a veth0 network card; and,

[0013] Building a communication connection between the security service container and each business container through a virtual network device veth pair, specifically comprising:

[0014] setting the in-eth0 network card and the ex-eth0 network card in the security service container; the in-eth0 network card and the ex-eth0 network card are connected in communication through a security service process running on the security service container;

[0015] setting the eth0 network card in each service container;

[0016] setting the veth0 network card in the virtual bridge of the host computer.

[0017] The second aspect of the embodiment of the present application provides a security detection method of container traffic, comprising:

[0018] obtaining container traffic, wherein the container traffic is container traffic transmitted and received by a service container and redirected to a security service container;

[0019] performing security detection on the container traffic.

[0020] In an embodiment, the method further comprises:

[0021] deploying the security service container on the host computer by using a docker-compose container orchestration tool.

[0022] In an embodiment, performing security detection on the container traffic specifically comprises: performing security detection on the container traffic by using a pre-set security rule.

[0023] The second aspect of the embodiment of the present application provides a security detection system of container traffic, comprising a centralized management platform and a host computer, wherein the host computer is provided with a service container and a security service container, and wherein:

[0024] the security service container runs a security service process, and the security service process is used for performing security detection on container traffic transmitted and received by the service container;

[0025] the centralized management platform is used for sending a control instruction to the security service process, and the control instruction is used for instructing to start or close security detection on container traffic of the service container.

[0026] The fourth aspect of the embodiment of the present application provides an electronic device, comprising:

[0027] a processor;

[0028] a memory for storing processor-executable instructions; wherein the processor is configured to execute the method of any one of the first aspect of the embodiment of the present application.

[0029] The fifth aspect of the embodiment of the present application provides a storage medium, which stores a computer program, and the computer program can be executed by a processor to complete the method in any one of the first aspect of the embodiment of the present application.

[0030] The method for detecting the container flow provided in the embodiment of the present application is used for the host computer provided with the service container and the security service container, the method comprises the following steps: obtaining the container flow received and sent by the service container, and then redirecting the container flow to the security service container, so that the security service container detects the container flow. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0032] Figure 1 The structural schematic diagram of the electronic device provided in an embodiment of the present application is shown in the figure.

[0033] Figure 2 The interaction schematic diagram of the electronic device and the terminal provided in an embodiment of the present application is shown in the figure.

[0034] Figure 3 The specific flow schematic diagram of the method for detecting the container flow provided in another embodiment of the present application is shown in the figure.

[0035] Figure 4 The structural schematic diagram of the host computer provided in another embodiment of the present application is shown in the figure.

[0036] Figure 5 The specific structural schematic diagram of the system for detecting the container flow provided in another embodiment of the present application is shown in the figure.

[0037] Figure 6 The specific structural schematic diagram of the device for detecting the container flow provided in an embodiment of the present application is shown in the figure.

[0038] Figure 7 The specific structural schematic diagram of the device for detecting the container flow provided in another embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0039] The technical solutions in the embodiments of the present application will be described in combination with the drawings in the embodiments of the present application. In the description of the present application, terms such as "first", "second", "third" and the like are only used for distinguishing description, and cannot be understood as indicating or implying relative importance or sequence.

[0040] As mentioned earlier, container traffic deployed on a host machine may carry network attack information, thus posing a security threat. Therefore, it is crucial to perform security inspection on container traffic.

[0041] Based on this, embodiments of this application provide a method, apparatus, electronic device, and storage medium for safe detection of container flow, which can be used to detect the safety of container flow. Figure 1 As shown, this embodiment provides an electronic device 1, which includes at least one processor 11 and a memory 12. Figure 1 Taking a processor as an example, the processor 11 and the memory 12 can be connected via a bus 10. The memory 12 stores instructions that can be executed by the processor 11. The instructions are executed by the processor 11 to enable the electronic device 1 to perform all or part of the process of the method in the following embodiments.

[0042] In practical applications, the electronic device 1 can be a mobile phone, laptop, desktop computer, or a large server or server cluster composed of them. For example, depending on the specific application scenario, in the process of security detection of container traffic, the electronic device 1 can be a server or server cluster used to detect container traffic. For instance, the server acts as a host machine and deploys security service containers to perform security detection on container traffic.

[0043] like Figure 2 As shown, the electronic device 1 can connect to one or more terminals 2, thereby enabling communication with the terminals 2. For example, before sending container traffic to the terminal 2, the electronic device 1 first performs a security check on the container traffic using the method provided in this application embodiment. If the container traffic passes the security check (at which point the container traffic is found to pose no security threat), it can send the container traffic to the terminal 2. Of course, if the container traffic fails the security check (at which point the container traffic is found to pose a security threat), it may not send the container traffic to the terminal 2. Alternatively, when the terminal 2 sends container traffic to the service container in the electronic device 1, after receiving the container traffic, the electronic device 1 first performs a security check on the container traffic using the method provided in this application embodiment. If the container traffic passes the security check, it can send the container traffic to the service container. Of course, if the container traffic fails the security check, it may not send the container traffic to the service container.

[0044] like Figure 3 The diagram illustrates a safe detection method for container flow provided in an embodiment of this application. This method can be implemented by... Figure 1 The method is executed by the electronic device 1 shown, for example, the electronic device acts as a host machine, and a business container and a security service container are set up on the host machine. The method includes the following steps:

[0045] Step S31: Obtain the container traffic transmitted and received by the service container.

[0046] The service container is arranged on the host machine. For example, the service container can be deployed on the host machine by using a docker-compose container orchestration tool, so that the service container is used to process the corresponding service.

[0047] In actual application, the service container can transmit and receive the container traffic. For example, the service container can send the container traffic to the outside (including other service containers on the host machine or service containers on other host machines), and can also receive the container traffic sent by other service containers on the host machine, and can also receive the container traffic sent by service containers on other host machines.

[0048] Therefore, in the step S31, the container traffic transmitted and received by the service container can be obtained, in particular, the container traffic can be obtained before the service container receives or sends the container traffic.

[0049] Step S32: Redirection of the container traffic to the security service container for security detection of the container traffic by the security service container.

[0050] As mentioned above, the security service container is arranged on the host machine, and the security service container can also be deployed on the host machine by using a docker-compose container orchestration tool. Therefore, after the host machine obtains the container traffic transmitted and received by the service container, the container traffic can be redirected to the security service container in the step S32, and the security service container can be used for security detection of the container traffic. Therefore, when the container traffic is redirected to the security service container, the security detection of the container traffic can be performed by the security service container. For example, the user can set security rules in advance, so that the security service container can perform security detection of the container traffic by using the pre-set security rules.

[0051] In addition, the host machine can use a redirection technology to redirect the container traffic to the security service container.

[0052] The security detection method of the container traffic provided by the embodiment of the present application is used. The service container and the security service container are arranged on the host machine. The method comprises the following steps: first, obtaining the container traffic transmitted and received by the service container; and then, redirecting the container traffic to the security service container, so that the security detection of the container traffic is performed by the security service container.

[0053] It needs to be further explained that in the case that multiple service containers are set on the host computer, in order to prevent one of the service containers from being attacked and affecting other service containers, the network isolation technology is usually used for communication isolation between the service containers, resulting in that direct data transmission between the service containers is difficult. For example, the service containers on the host computer are communicated by the network name space, so that each service container has an independent network protocol stack, and the resources of different network name spaces are invisible to each other, and the processes under any network name space cannot obtain the data under other network name spaces. At this time, the security service container and the service container are also communicated by the network name space. Thus, when any container (which can be a service container or a security service container) is attacked, the operation of other containers is not affected.

[0054] After the containers on the host computer are communicated, the security service container cannot directly obtain the container traffic transmitted and received by the service container, in this case, the container traffic security detection method provided by the application can also be used, for example, the host computer obtains the container traffic transmitted and received by the service container, and then redirects the container traffic to the security service container, so that the security service container performs security detection on the container traffic. In this way, the security service container and the service container can also perform security detection on the container traffic in the isolated case.

[0055] In order to realize the redirection of the container traffic to the security service container, the communication connection between the security service container and each service container can also be constructed through the virtual network device veth pair, so that after the communication connection is constructed through the virtual network device veth pair, the container traffic transmitted and received by the service container can be obtained and then redirected to the security service container.

[0056] It needs to be further explained that the specific method of constructing the connection through the virtual network device veth pair includes in-eth0, eth0, ex-eth0 and veth0 in actual application, wherein in-eth0 and eth0 are a pair of veth pair network cards, and ex-eth0 and veth0 are a pair of veth pair network cards. For example, Figure 4As shown, the in-eth0 network card and the ex-eth0 network card can be arranged in the security service container, the eth0 network card can be arranged in the service container, the veth0 network card can be arranged in the virtual bridge of the host computer, and the security service process runs on the security service container, so that the in-eth0 network card and the ex-eth0 network card can be connected in communication through the security service process running on the security service container. For example, the security service process can obtain container traffic from the in-eth0 network card and the ex-eth0 network card through the AF_XDP socket program, and can also send container traffic to the in-eth0 network card and the ex-eth0 network card through the AF_XDP socket program, so that the in-eth0 network card and the ex-eth0 network card are connected in communication through the AF_XDP socket program, and then the communication connection between the security service container and each service container is constructed.

[0057] In this way, for the container traffic sent by one service container (referred to as service container 1) to another service container (referred to as service container 2), the service container 1 and the service container 2 can be arranged in the same host computer or in different host computers. The container traffic is sent to the in-eth0 network card of the security service container through the eth0 network card of the service container 1, and then the security service process obtains the container traffic obtained by the in-eth0 network card through the AF_XDP socket program. The security service process further detects the security of the container traffic, and in the case of passing the security detection, the security service process sends the container traffic to the ex-eth0 network card through the AF_XDP socket program, and then the ex-eth0 network card sends the container traffic to the service container 2 through the veth0 network card on the virtual bridge.

[0058] In the process of receiving the service traffic in the service container 2, the veth0 network card on the virtual bridge sends the container traffic to the ex-eth0 network card of the security service container, at this time the security service process on the security service container obtains the container traffic through the AF_XDP socket program, and detects the security of the container traffic, and in the case of passing the security detection, the security service process sends the container traffic to the in-eth0 network card through the AF_XDP socket program, and then the in-eth0 network card sends the container traffic to the eth0 network card of the service container 2.

[0059] Therefore, for the specific manner of obtaining the container traffic transmitted and received by the service container in step S31, when the service container transmits the container traffic outward, the container traffic of the eth0 network card of the service container can be obtained. Correspondingly, step S32 can be transmitting the container traffic to the in-eth0 network card of the security service container. In this way, the security service process running on the security service container can obtain the container traffic on the in-eth0 network card through the AF_XDP socket program, and perform security detection on the container traffic. If the security detection is passed, the security service process can further transmit the container traffic to the ex-eth0 network card through the AF_XDP socket program, and then to the veth0 network card, so as to transmit the container traffic to the receiving end (which can be another service container on the host computer, or a service container on another host computer) through the veth0 network card. Of course, if the security detection is not passed, it means that there may be a security risk, and the security service process can discard the container traffic.

[0060] For example, when the service container receives the container traffic, step S31 can be obtaining the container traffic received by the veth0 network card. Correspondingly, step S32 can be transmitting the container traffic to the ex-eth0 network card of the security service container. In this way, the security service process running on the security service container can obtain the container traffic on the ex-eth0 network card through the AF_XDP socket program, and perform security detection on the container traffic. If the security detection is passed, the security service process can further transmit the container traffic to the in-eth0 network card through the AF_XDP socket program, so as to transmit the container traffic to the eth0 network card of the service container through the in-eth0 network card. Of course, if the security detection is not passed, it means that there may be a security risk, and the security service process can discard the container traffic.

[0061] Based on the same inventive concept as the security detection method provided in the above embodiments, the embodiments of the present application also provide a security detection system. As shown in Figure 5 Fig. 5 is a specific structural schematic diagram of a container traffic security detection system provided by the embodiments of the present application. The security detection system 50 includes a centralized management platform 51 and a host computer 52. The host computer 52 is provided with a service container 521 and a security service container 522. Of course, the number of host computers 52 can be one or more, and the number of service containers 521 provided on the host computer 52 can also be one or more.

[0062] In addition, the security service container 522 runs a security service process for performing security detection on the container traffic transmitted and received by the service container. The centralized management platform 51 sends a control instruction to the security service process, and the control instruction is used to instruct to start or stop the security detection on the container traffic of the service container 521.

[0063] Of course, the centralized management platform 51 can also provide a state display interface for displaying the states of the service containers 521 on the host computer 52 (the states are used to reflect that the security detection on the container traffic has been started or stopped).

[0064] For example, three service containers 521 are arranged on the host computer 52, and the centralized management platform 51 can send a control instruction to the security service process running on the security service container 522, so as to instruct to start or stop the security detection on the container traffic of each service container 521, and display the states of the service containers 521 on the state display interface.

[0065] For the security service process in the security service container 522, the security detection is performed on the container traffic transmitted and received by the service container (hereinafter referred to as a target service container). Specifically, first, the security service process can enter the network namespace of the target service container, scan and record the information of the eth0 network card of the target service container, including the ip address and mac address of the eth0 network card. The veth0 network card is arranged on the virtual bridge of the host computer, and thus the veth0 network card is a bridge for the communication between the service container 521 and other service containers and service containers on other host computers.

[0066] Then, the container identifier of the ex-eth0 network card of the security service container, the ip address and mac address of the ex-eth0 network card are changed. For example, if the container identifier of the security service container is 13f, and the opposite network card of the ex-eth0 network card of the security service container is the veth0 network card on the host computer. At this time, the network card name of the ex-eth0 network card can be changed, for example, the format of the network card name can be “ex-container identifier-eth0”, and thus the changed network card name is “ex-13f-eth0”, and the network namespace of the network card ex-13f-eth0 is modified to the network namespace of the security service container; then, the ip address of the network card ex-13f-eth0 is cleared and a mac address is randomly generated.

[0067] Then, the network card name of the in-eth0 network card in the security service container is changed, and the format of the network card name can be "in-container identifier-eth0", for example, if the container identifier of the security service container is 13f, the changed network card name is "in-13f-eth0", and the network namespace of the network card in-13f-eth0 is modified to the network namespace of the security service container, and finally the network namespace to which the other end network card (i.e. the eth0 network card of the target service container) belongs is set to the protected network card space.

[0068] After the above-mentioned setting is performed, the security service container includes the ex-13f-eth0 network card and the in-13f-eth0 network card, the target service container includes the eth0 network card, and the virtual network bridge of the host computer includes the veth0 network card, wherein the ex-13f-eth0 network card and the veth0 network card are a pair of virtual network cards, and the eth0 network card and the in-13f-eth0 network card are a pair of virtual network cards.

[0069] After the above-mentioned setting is performed, the security service process can call the socket() function of the AF_XDP socket program to create two AF_XDP type sockets, and record the correspondence of the two sockets, which will be used when the security service process sends the container traffic that needs to be released. Then the bind() system function is called to bind the two AF_XDP sockets created above to the XDP network hook points of the ex-13f-eth0 network card and the in-13f-eth0 network card, so that the security service process can receive and send container traffic on the ex-13f-eth0 network card and the in-13f-eth0 network card, such as the security service process can obtain the network traffic of the ex-13f-eth0 network card and the in-13f-eth0 network card, or send network traffic to the ex-13f-eth0 network card and the in-13f-eth0 network card.

[0070] When the target service container receives container traffic, the container traffic first passes through the veth0 network card to the XDP network hook point of the ex-13f-eth0 network card, and then the eBPF program of the XDP network hook point stores the container traffic in the RX RING; the security service process calls the recv() interface to obtain the container traffic from the RX RING through the AF_XDP socket, stores the AF_XDP socket in the private data of the container traffic descriptor, and then performs security detection on the container traffic according to the pre-set security rule (the pre-set security rule can be pre-set in the centralized management platform and delivered to the security service container), if the security detection is passed, the AF_XDP socket is extracted from the private data of the container traffic descriptor, the corresponding target AF_XDP socket is found in the AF_XDP socket corresponding table, and then the send() interface is called to store the sent container traffic in the TX RING of the target AF_XDP socket through the target AF_XDP socket, and then the eBPF program of the XDP network hook point on the in-13f-eth0 network card obtains the container traffic from the TX RING and sends the container traffic to the network protocol stack, and finally the container traffic reaches the eth0 network card of the target service container.

[0071] The security service process running on the security service container 522 can also report the result of security detection (passing or not passing the security detection) to the centralized management platform 51 after performing security detection on the container traffic transmitted and received by a certain service container 521.

[0072] It should be noted that after the centralized management platform 51 sends the control instruction to the security service process, the security service process can find whether the service container 521 indicated by the container identifier (such as the container name, number, etc.) carried in the control instruction exists on the host 52, if not, no processing can be performed; if yes, the following processing can be performed to start or close the security detection of the container traffic of the service container 521: first, the security protection process calls the close() function to close the two created AF_XDP sockets, after closing, the container traffic will not be sent to the security protection process any more; and the in-13f-eth0 network card and the eth0 network card in the target service container are destroyed.

[0073] Based on the same inventive concept as the container traffic security detection method provided in the embodiments of the present application, the embodiments of the present application also provide a container traffic security detection device. For the device embodiments, if there is any unclear part, the corresponding content of the method embodiments can be referred to. For example, Figure 6As shown in the specific structural diagram of the device 60, the device 60 can be applied to a host computer provided with a service container and a security service container, and the device 60 comprises: an acquisition unit 601 and a redirection unit 602, wherein:

[0074] The acquisition unit 601 is configured to acquire container traffic transmitted and received by the service container.

[0075] The redirection unit 602 is configured to redirect the container traffic to the security service container for security detection of the container traffic by the security service container.

[0076] With the device 60 provided by the embodiments of the present application, since the device 60 adopts the same inventive concept as the method for security detection of container traffic provided by the embodiments of the present application, the device 60 can also solve the technical problems on the premise that the method can solve the technical problems, which will not be described here.

[0077] In addition, in actual application, the technical effects achieved by combining the device 60 with specific hardware devices, cloud technology, etc. are also within the protection scope of the present application, such as arranging different units in the device 60 in different nodes in a distributed cluster in a distributed cluster manner to improve efficiency, etc.; or, arranging part of the units in the device 60 in the cloud to reduce cost, etc.

[0078] In actual application, in the case that the container traffic passes the security detection, the device 60 can further comprise:

[0079] A sending unit configured to send the container traffic to the service container; or, send the container traffic to a receiving end.

[0080] The host computer is provided with a plurality of service containers; and the communication between each service container is isolated; the device 60 can further comprise: a communication connection construction unit configured to construct a communication connection between the security service container and each service container through a virtual network device veth pair.

[0081] The virtual network device veth pair comprises an in-eth0 network card, an eth0 network card, an ex-eth0 network card and a veth0 network card; and,

[0082] The communication connection building unit can specifically include a communication connection building subunit configured to set the in-eth0 network card and the ex-eth0 network card in the security service container; the in-eth0 network card and the ex-eth0 network card are connected in communication through a security service process running on the security service container; the eth0 network card is set in each service container; and the veth0 network card is set in the virtual bridge of the host computer.

[0083] Based on the same inventive concept as the container traffic security detection method provided in the embodiments of the present application, the embodiments of the present application also provide a container traffic security detection device. For the device embodiments, if there is any unclear part, the corresponding content of the method embodiments can be referred to. As shown in Figure 6 Fig. 7 shows a specific structural schematic diagram of the device 70, which can be applied to a security service container on a host computer. The host computer is provided with a service container and a security service container. The device 70 includes a second acquisition unit 701 and a security detection unit 702, wherein:

[0084] The second acquisition unit 701 is configured to acquire container traffic, wherein the container traffic is container traffic transmitted and received by a service container and redirected to a security service container.

[0085] The security detection unit 702 is configured to perform security detection on the container traffic.

[0086] The device 70 can further include a container deployment unit configured to deploy the security service container on the host computer by using a docker-compose container orchestration tool.

[0087] The security detection unit 702 can further include a security detection subunit configured to perform security detection on the container traffic by using a pre-set security rule.

[0088] The embodiments of the present application also provide a storage medium storing a computer program, which can be executed by a processor to complete all or part of the processes of the methods in the embodiments of the present application. The storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc. The storage medium can also include a combination of the above-mentioned types of memories.

[0089] While embodiments of the application have been described in connection with the preferred embodiments of the various figures, those of ordinary skill in the art will appreciate that various modifications and changes can be made without departing from the spirit and scope of the application, and that such modifications and changes fall within the scope of the appended claims.

Claims

1. A method for safe detection of container flow rate, characterized in that, The host machine is configured with a business container and a security service container. The method includes: Obtain the container traffic sent and received by the service container; The container traffic is redirected to the security service container for security inspection of the container traffic via the security service container; The host machine is configured with multiple service containers; and communication between the various service containers is isolated; the method further includes: A communication connection is established between the security service container and each business container through a virtual network device veth pair; The virtual network device veth pair includes an in-eth0 network interface card (NIC), an eth0 NIC, an ex-eth0 NIC, and a veth0 NIC; and, Establishing communication connections between the security service container and each business container through a virtual network device (veth pair) specifically includes: The in-eth0 network interface card and the ex-eth0 network interface card are configured in the security service container; the in-eth0 network interface card and the ex-eth0 network interface card communicate with each other through the security service process running on the security service container; Configure the eth0 network interface card for each service container; Configure the veth0 network card in the virtual bridge of the host machine; The security service container runs a security service process. The security service process can obtain container traffic from the in-eth0 and ex-eth0 network interfaces through the AF_XDP socket program, and can also send container traffic to the in-eth0 and ex-eth0 network interfaces through the AF_XDP socket program. Thus, the in-eth0 and ex-eth0 network interfaces communicate with each other through the AF_XDP socket program, thereby establishing a communication connection between the security service container and various business containers. Among them, the in-eth0 network card and the eth0 network card are a pair of veth pair network cards, and the ex-eth0 network card and the veth0 network card are a pair of veth pair network cards.

2. The method according to claim 1, characterized in that, If the container flow passes the security check, the method further includes: Send the container traffic to the service container; or, Send the container traffic to the receiving end.

3. The method according to claim 1, characterized in that, The method further includes: The security service container is deployed on the host machine using the docker-compose container orchestration tool.

4. The method according to claim 1, characterized in that, The security detection of the container flow specifically includes: using pre-set security rules to perform security detection on the container flow.

5. A safety detection system for container flow, characterized in that, This includes a centralized management platform and a host machine, wherein the host machine is equipped with business containers and security service containers, wherein: The security service container runs a security service process, which is used to perform security checks on the container traffic sent and received by the business container. The centralized management platform is used to send control commands to the security service process, and the control commands are used to instruct the activation or deactivation of security detection of container traffic of the business container. The host machine is configured with multiple service containers; and communication between the various service containers is isolated. A communication connection is established between the security service container and each business container through a virtual network device veth pair; The virtual network device veth pair includes an in-eth0 network interface card (NIC), an eth0 NIC, an ex-eth0 NIC, and a veth0 NIC; and, Establishing communication connections between the security service container and each business container through a virtual network device (veth pair) specifically includes: The in-eth0 network interface card and the ex-eth0 network interface card are configured in the security service container; the in-eth0 network interface card and the ex-eth0 network interface card communicate with each other through the security service process running on the security service container; Configure the eth0 network interface card for each service container; Configure the veth0 network card in the virtual bridge of the host machine; The security service process can obtain container traffic from the in-eth0 and ex-eth0 network interfaces through the AF_XDP socket program, and can also send container traffic to the in-eth0 and ex-eth0 network interfaces through the AF_XDP socket program. Thus, the in-eth0 and ex-eth0 network interfaces communicate with each other through the AF_XDP socket program, thereby establishing a communication connection between the security service container and various business containers. Among them, the in-eth0 network card and the eth0 network card are a pair of veth pair network cards, and the ex-eth0 network card and the veth0 network card are a pair of veth pair network cards.

6. An electronic device, characterized in that, include: processor; Memory for storing processor-executable instructions; wherein the processor is configured to perform the method as described in any one of claims 1-4.

7. A storage medium, characterized in that, The storage medium stores a computer program that can be executed by a processor to perform the method described in any one of claims 1-4.

Images