A container environment security protection method, device, equipment and storage medium

Abstract

The present disclosure provides a method, apparatus, device and storage medium for the security protection of a container environment, the method comprising: generating multiple trusted network boundaries corresponding to the target container cluster according to the network access relationship between containers in the target container cluster, configuring container security protection policies for each trusted network boundary based on the trusted type of each trusted network boundary through the security policy device, and pushing the correspondence between each trusted network boundary and the container security protection policy to the risk detector, and performing security protection for each container within the trusted network boundary based on the container security protection policy corresponding to each trusted network boundary through the risk detector. It can be seen that the embodiments of the present disclosure can generate multiple trusted network boundaries based on the network access relationship between containers in the target container cluster and the network access rights supported by the containers, and realize differentiated security protection for containers in the target container cluster based on the trusted network boundaries.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing, and in particular to a container environment security protection method, device, equipment and storage medium. Background Art

[0002] With the rapid development of container technology, container security issues in container environments have received considerable attention, and risk detection in container environments is particularly important.

[0003] At present, there are few solutions for security protection of containers in a container environment. Therefore, how to achieve security protection of the container environment has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] In order to solve the above technical problems, the embodiments of the present disclosure provide a container environment security protection method.

[0005] In a first aspect, the present disclosure provides a container environment security protection method, the method comprising:

[0006] Generate multiple trusted network boundaries corresponding to the target container cluster according to the network access relationship between containers in the target container cluster; wherein different trusted network boundaries are respectively provided with different levels of trusted types, and the trusted types are determined based on the network access rights supported by the containers in the corresponding trusted network boundaries;

[0007] Based on the trust type of each trusted network boundary, the security policy device configures a container security protection policy for each trusted network boundary, and pushes the corresponding relationship between each trusted network boundary and the container security protection policy to the risk detector; wherein the security policy device maintains a plurality of container security protection policies of different security levels;

[0008] The risk detector is used to perform security protection for each container within the trusted network boundary based on the container security protection strategy corresponding to each trusted network boundary.

[0009] In an optional implementation, generating multiple trusted network boundaries corresponding to the target container cluster according to the network access relationship between containers in the target container cluster includes:

[0010] Receive network data collected by the container event collector, and construct a network access relationship topology map corresponding to the target container cluster according to the network data; nodes in the network access relationship topology map represent containers, and connection relationships between nodes represent access relationships between containers;

[0011] According to the network access permissions supported by the containers in the target container cluster, marking corresponding trusted types for the nodes in the network access relationship topology diagram;

[0012] According to the trust type of the nodes in the network access relationship topology diagram, the trusted network boundary is divided; the nodes within the same trusted network boundary have the same trust type.

[0013] In an optional implementation, the marking corresponding trusted types for nodes in the network access relationship topology diagram according to the network access permissions supported by the containers in the target container cluster includes:

[0014] A three-color marking algorithm is used to color-mark nodes in the network access relationship topology diagram based on the network access permissions supported by the containers in the target container cluster; different colors indicate different trusted types.

[0015] In an optional implementation, the security policy device maintains three security levels of container security protection policies, including a mandatory mode, a complete detection mode, and a normal detection mode; different modes are used to protect containers marked with different colors.

[0016] In an optional implementation manner, the method further includes:

[0017] When the risk detector detects a container security risk event, the trusted boundary learner is notified to dynamically adjust the trusted network boundary based on risk information of the container involved in the container security risk event.

[0018] In an optional implementation, the risk detector performs security protection for each container within the trusted network boundary based on the container security protection policy corresponding to each trusted network boundary, including:

[0019] Receiving, by the risk detector, system events collected by the container event collector, and determining a target container involved in the system event;

[0020] Query the policy rule cache list pushed by the security policy device, and select the container security protection policy corresponding to the target container;

[0021] The rule detection engine performs rule calculation on the system event to determine whether the system event has a security risk, and performs security protection on the target container based on the container security protection policy corresponding to the target container.

[0022] In an optional implementation manner, the method further includes:

[0023] Monitoring asset changes of the container orchestration system corresponding to the target container cluster through an asset probe; wherein the assets of the container orchestration system include containers in the target container cluster and network access rights of the containers;

[0024] When container assets in the target container cluster change, the trusted boundary learner is notified to dynamically adjust the trusted network boundary based on the asset change.

[0025] In a second aspect, the present disclosure provides a container environment safety protection device, the device comprising:

[0026] A boundary generation module, used to generate multiple trusted network boundaries corresponding to the target container cluster according to the network access relationship between containers in the target container cluster; wherein different trusted network boundaries are respectively provided with different levels of trusted types, and the trusted types are determined based on the network access rights supported by the containers in the corresponding trusted network boundaries;

[0027] A policy configuration module, configured to configure a container security protection policy for each trusted network boundary based on the trusted type of each trusted network boundary through a security policy device, and push the corresponding relationship between each trusted network boundary and the container security protection policy to the risk detector; wherein the security policy device maintains a plurality of container security protection policies of different security levels;

[0028] The security protection module is used to perform security protection for the containers within each trusted network boundary based on the container security protection strategy corresponding to each trusted network boundary through the risk detector.

[0029] In a third aspect, the present disclosure provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device implements the above method.

[0030] In a fourth aspect, the present disclosure provides a container environment security protection device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0031] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has at least the following advantages:

[0032] In the container environment security protection method provided by the embodiment of the present disclosure, multiple trusted network boundaries corresponding to the target container cluster are generated according to the network access relationship between containers in the target container cluster, wherein different trusted network boundaries are respectively provided with different levels of trusted types, and the trusted type is determined based on the network access rights supported by the container in the corresponding trusted network boundary, and the security policy device is used to configure the container security protection policy for each trusted network boundary based on the trusted type of each trusted network boundary, and the corresponding relationship between each trusted network boundary and the container security protection policy is pushed to the risk detector, wherein the security policy device maintains container security protection policies of multiple different security levels, and the risk detector is used to perform security protection for each container in the trusted network boundary based on the container security protection policy corresponding to each trusted network boundary. It can be seen that the embodiment of the present disclosure can generate multiple trusted network boundaries based on the network access relationship between containers in the target container cluster and the network access rights supported by the containers, and realize differentiated security protection for the containers in the target container cluster based on the trusted network boundaries. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0035] Figure 1 A flowchart of a container environment security protection method provided by an embodiment of the present disclosure;

[0036] Figure 2 A network access relationship topology diagram provided by an embodiment of the present disclosure;

[0037] Figure 3 A schematic diagram of a container environment security protection structure provided by an embodiment of the present disclosure;

[0038] Figure 4 A schematic diagram of the structure of a container environment safety protection device provided in an embodiment of the present disclosure;

[0039] Figure 5 A schematic diagram of the structure of a container environment safety protection device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0040] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0041] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0042] In order to achieve security protection of a container environment, the present disclosure provides a method for security protection of a container environment.

[0043] Specifically, according to the network access relationship between containers in the target container cluster, multiple trusted network boundaries corresponding to the target container cluster are generated, wherein different trusted network boundaries are respectively provided with different levels of trusted types, and the trusted types are determined based on the network access rights supported by the containers in the corresponding trusted network boundaries, and the security policy device is used to configure the container security protection policy for each trusted network boundary based on the trusted type of each trusted network boundary, and the corresponding relationship between each trusted network boundary and the container security protection policy is pushed to the risk detector, wherein the security policy device maintains container security protection policies of multiple different security levels, and the risk detector is used to perform security protection for the containers in each trusted network boundary based on the container security protection policy corresponding to each trusted network boundary. It can be seen that the embodiments of the present disclosure can generate multiple trusted network boundaries based on the network access relationship between containers in the target container cluster and the network access rights supported by the containers, and realize differentiated security protection for the containers in the target container cluster based on the trusted network boundaries.

[0044] Based on this, the present disclosure provides a container environment security protection method, referring to Figure 1 , is a flow chart of a container environment security protection method provided by an embodiment of the present disclosure, the method comprising:

[0045] S101: Generate multiple trusted network boundaries corresponding to the target container cluster according to the network access relationship between containers in the target container cluster.

[0046] Different trusted network boundaries are respectively provided with different levels of trusted types, and the trusted types are determined based on the network access permissions supported by the containers within the corresponding trusted network boundaries.

[0047] In the embodiment of the present disclosure, the target container cluster may be any container cluster. Specifically, the target container cluster may be one container cluster or multiple container clusters, which is not limited in any way in the embodiment of the present disclosure.

[0048] In the embodiment of the present disclosure, the network access rights supported by the container include the network access supported by the container outside the target container cluster and the network access supported by the container inside the target container cluster.

[0049] In an optional implementation, the network access permissions supported by the container may be determined based on the network attribute information of the container.

[0050] Among them, the network attribute information can be collected from the container asset orchestration system. In order to have a clearer understanding of the embodiments of the present disclosure, the embodiments of the present disclosure are described by taking the container asset orchestration system as the container orchestration engine Kubernetes as an example.

[0051] Specifically, Kubernetes, also known as K8s, is an open source container orchestration engine from Google that is used to orchestrate and manage containers in a target container cluster.

[0052] In the disclosed embodiment, the asset probe can communicate with the interface provided by the Kubernetes container asset orchestration system to automatically collect network attribute information of containers in the target container cluster corresponding to the Kubernetes container asset orchestration system.

[0053] Among them, container network attribute information includes ingress resource objects, service resource objects, etc.

[0054] Specifically, the ingress resource object is a resource object in the Kubernetes container asset orchestration system, which is used to achieve network access outside the target container cluster. For example, if container a has an ingress resource object, it indicates that the network access permission supported by container a is network access outside the target container cluster.

[0055] The service resource object is a resource object in the Kubernetes container asset orchestration system, which is used to implement network access within the target container cluster. For example, if container b has a service resource object, it indicates that the network access permission supported by container b is network access within the target container cluster.

[0056] In the disclosed embodiment, if the network access permissions supported by the containers within the trusted network boundary are network access outside the target container cluster, a higher level of trusted type is set for the trusted network boundary; if the network access permissions supported by the containers within the trusted network boundary are network access inside the target container cluster, a lower level of trusted type is set for the trusted network boundary.

[0057] In an optional implementation, network data collected by a container event collector is received, a network access relationship topology map corresponding to a target container cluster is constructed based on the network data, corresponding trusted types are marked for nodes in the network access relationship topology map based on the network access permissions supported by containers in the target container cluster, and trusted network boundaries are divided based on the trusted types of nodes in the network access relationship topology map.

[0058] Among them, the nodes in the network access relationship topology diagram represent containers, the connection relationship between nodes represents the access relationship between containers, and the nodes within the same trusted network boundary have the same trusted type.

[0059] In the disclosed embodiment, network data may be collected by a container event collector. Specifically, the container event collector may monitor the network data generated in the containers in the target container cluster by injecting compiled eBPF (extended Berkeley Packet Filter) code into the Linux kernel of the operating system, and then report the collected network data to the container event collector through the asynchronous communication mechanism netlink, thereby obtaining the network data of the containers in the target container cluster.

[0060] In the embodiment of the present disclosure, after obtaining the network data of the containers in the target container cluster, the network access relationship of each container in the target container cluster is determined based on the network data, thereby constructing a network access relationship topology map corresponding to the target container cluster based on the network access relationship of each container.

[0061] In the disclosed embodiment, after constructing the network access relationship topology map corresponding to the target container cluster, each node (container) in the network access relationship topology map is labeled with a trusted type according to the network access rights supported by the containers in the target container cluster, and the trusted network boundary is divided according to the trusted type labeled on each node (container).

[0062] refer to Figure 2 , is a network access relationship topology diagram provided by an embodiment of the present disclosure, such as Figure 2 As shown, the network access relationship between each container is displayed. Container A, container C, and container D can all be accessed by the external network (that is, the network access outside the target container cluster), so containers A, container C, and container D are marked as the first trusted type; container B can be accessed by container C (that is, the network access inside the target container cluster), so container B is marked as the second trusted type; container E is not accessed by the external network and other containers, so container E is marked as the third trusted type.

[0063] Among them, the level of the first trust type is higher than the second trust type, and the level of the second trust type is higher than the third trust type.

[0064] In an optional implementation, a three-color marking algorithm may be used to color-mark nodes in the network access relationship topology diagram based on the network access permissions supported by the containers in the target container cluster.

[0065] Among them, different colors indicate different trustworthy types.

[0066] Continue to refer Figure 2 ,Since Container A, Container C, and Container D all have network risks of being accessed through external networks, that is, Container A, Container C, and Container D belong to containers of the same risk level, the nodes corresponding to Container A, Container C, and Container D can all be marked as black.

[0067] Container B only has network risks that can be accessed through the external network. The node corresponding to container B can be marked in gray.

[0068] Container E has neither the network risk of being accessed through an external network nor the network risk of being accessed through other containers. The node corresponding to container B can be marked in white.

[0069] Among them, the black network risk level is higher than the gray, and the gray network risk level is higher than the white.

[0070] S102: Based on the trust type of each trusted network boundary, the security policy device configures a container security protection policy for each trusted network boundary, and pushes the corresponding relationship between each trusted network boundary and the container security protection policy to the risk detector.

[0071] Among them, the security policy device maintains container security protection policies with multiple different security levels.

[0072] In an optional implementation, the security policy device maintains three security levels of container security protection policies, including a mandatory mode, a complete detection mode, and a normal detection mode. Different modes are used to protect containers marked with different colors.

[0073] Among them, the security level of the forced mode is higher than that of the complete detection mode, which is higher than that of the normal detection mode.

[0074] In the embodiment of the present disclosure, for ease of understanding, description is given by taking an example where containers in the target container cluster include a first trusted type, a second trusted type, and a third trusted type.

[0075] The network risk level of the container corresponding to the first trusted type is higher than that of the container corresponding to the second trusted type, and the network risk level of the container corresponding to the second trusted type is higher than that of the container corresponding to the third trusted type.

[0076] Since the network risk level of the container corresponding to the first trusted type is higher than that of the container corresponding to the second trusted type, and the network risk level of the container corresponding to the second trusted type is higher than that of the container corresponding to the third trusted type, the container corresponding to the first trusted type can be configured with a higher container security protection strategy, the container corresponding to the second trusted type can be configured with a medium container security protection strategy, and the container corresponding to the third trusted type can be configured with a lower container security protection strategy, thereby achieving differentiated security protection for the containers in the target container cluster.

[0077] Specifically, the container corresponding to the first trusted type can be applied to the security protection policy of the mandatory mode, the container corresponding to the second trusted type can be applied to the security protection policy of the complete detection mode, and the container corresponding to the third trusted type can be applied to the security protection policy of the normal detection mode.

[0078] The security protection policy in mandatory mode corresponds to the overall risk detection policy for containers in the target container cluster.

[0079] The security protection strategy of the full detection mode corresponds to the partial risk detection strategy of the containers in the target container cluster.

[0080] The security protection strategy of the normal detection mode corresponds to a small number of risk detection strategies for containers in the target container cluster.

[0081] For example, if there are 100 security protection policies for containers in the target container cluster, all security protection policies can be applied to containers corresponding to the first trusted type, some security protection policies (such as 80 policies) can be applied to containers corresponding to the second trusted type, and a small number of security protection policies (such as 20 policies) can be applied to containers corresponding to the third trusted type, thereby configuring different security protection policies for containers corresponding to different trusted types.

[0082] For ease of understanding, continue to refer to Figure 2 Since the nodes corresponding to container A, container C, and container D are all marked in black, you can configure a mandatory security protection policy for container A, container C, and container D.

[0083] The node corresponding to container B is marked in gray, and you can configure a security protection policy in full detection mode for container B.

[0084] The node corresponding to container E is marked in white, and you can configure the security protection policy of the normal detection mode for container E.

[0085] In addition, in order to ensure the security of containers in the target container cluster, in an optional implementation, when the risk detector detects a container security risk event, the trusted boundary learner can be notified to dynamically adjust the trusted network boundary based on the risk information of the container involved in the container security risk event.

[0086] Among them, container security risk events refer to access to the target container cluster through illegal means. For example, container security risk events can be rebound shell alarms.

[0087] In an embodiment of the present disclosure, after the risk detector detects a container security risk event, the container where the container security risk event occurs (i.e., the target container) is determined, and the container that has a network relationship with the target container is determined in the network access relationship topology map, and the trusted network boundary of the target container and the container that has a network relationship with the target container is dynamically adjusted.

[0088] Continue with the above Figure 2 For example, if it is determined that a container security risk event has occurred in container E, since the trusted type identifier corresponding to container E is white, its corresponding network risk level is low. Therefore, when it is determined that a container security risk event has occurred in container E, the network risk level corresponding to container E is increased accordingly, and the trusted type identifier corresponding to container E can be changed to gray.

[0089] Similarly, if it is determined that a container security risk event has occurred in container B, since the trust type indicator corresponding to container B is gray, its corresponding network risk level is medium. Therefore, when it is determined that a container security risk event has occurred in container B, the network risk level corresponding to container B is increased accordingly, and the trust type indicator corresponding to container B can be changed to black.

[0090] If it is determined that a container security risk event has occurred in container A, since the trusted type icon corresponding to container A is black, its corresponding network risk level is already a high network risk level. Therefore, when it is determined that a container security risk event has occurred in container A, the container security risk event can be directly blocked to ensure the security of container A.

[0091] S103: Perform security protection for each container within the trusted network boundary based on the container security protection strategy corresponding to each trusted network boundary through the risk detector.

[0092] Among them, the risk detector is used to differentiate between different levels of security policies for regulatory calculation based on system events collected by the container event collector, and complete the security risk detection of the container.

[0093] In an optional implementation, system events collected by a container event collector are received through a risk detector, a target container involved in the system event is determined, a policy rule cache list pushed by a security policy device is queried, a container security protection policy corresponding to the target container is selected, and a rule detection engine is used to perform rule calculations on the system event to determine whether the system event poses a security risk, and security protection is performed on the target container based on the container security protection policy corresponding to the target container.

[0094] Among them, system events may include system call events, file read and write events, process execution events, network events, etc.

[0095] The policy rule cache list stores the correspondence between each trusted network boundary and the container security protection policy.

[0096] In the disclosed embodiment, if the rule detection engine performs rule calculation on the system event and determines that the system event has a security risk, a security alarm is generated.

[0097] In addition, in order to further ensure the security of the containers in the target container cluster, the embodiment of the present disclosure can also dynamically adjust the trusted network boundary. In an optional implementation, the asset probe monitors the asset changes of the container orchestration system corresponding to the target container cluster, and when the container assets in the target container cluster change, the trusted boundary learner is notified to dynamically adjust the trusted network boundary based on the asset changes.

[0098] Among them, the assets of the container orchestration system include the containers in the target container cluster and the network access permissions of the containers.

[0099] In the disclosed embodiment, when it is determined that the number of containers in the target container cluster has changed and / or the network access rights of the containers have changed, the trusted boundary learner is notified to dynamically adjust the trusted network boundary based on the asset change.

[0100] Specifically, the change in the number of containers in the target container cluster and the change in the network access permissions of the containers may be determined in a variety of ways.

[0101] In an optional implementation, it may be determined by dynamic monitoring whether the number of containers in the target container cluster has changed and whether the network access rights of the containers have changed.

[0102] In the disclosed embodiment, the asset probe can communicate with the interface provided by the Kubernetes container asset orchestration system to dynamically monitor whether the number of containers in the target container cluster has changed and whether the network access permissions of the containers have changed. After determining that the number of containers in the target container cluster has changed and the network access permissions of the containers have changed, the trusted boundary learner is notified to dynamically adjust the trusted network boundary based on the asset changes.

[0103] In another optional implementation, it is also possible to determine whether the number of containers in the target container cluster has changed and whether the network access rights of the containers have changed by means of full synchronization.

[0104] In the disclosed embodiment, the number of containers in a container cluster and the network access rights of the containers can be collected at a preset periodic frequency, and the collected number of containers in the container cluster and the network access rights of the containers can be compared with the number of containers in the container cluster and the network access rights of the containers that are pre-stored to determine whether the number of containers in the target container cluster has changed and whether the network access rights of the containers have changed. After determining that the number of containers in the target container cluster has changed and the network access rights of the containers have changed, the trusted boundary learner is notified to dynamically adjust the trusted network boundary based on asset changes.

[0105] It should be noted that after determining that the number of containers in the target container cluster has changed or the network access permissions of the containers have changed, the method for updating the containers in each trusted network boundary can refer to the above description.

[0106] In the container environment security protection method provided by the embodiment of the present disclosure, multiple trusted network boundaries corresponding to the target container cluster are generated according to the network access relationship between containers in the target container cluster, wherein different trusted network boundaries are respectively provided with different levels of trusted types, and the trusted type is determined based on the network access rights supported by the container in the corresponding trusted network boundary, and the security policy device is used to configure the container security protection policy for each trusted network boundary based on the trusted type of each trusted network boundary, and the corresponding relationship between each trusted network boundary and the container security protection policy is pushed to the risk detector, wherein the security policy device maintains container security protection policies of multiple different security levels, and the risk detector is used to perform security protection for each container in the trusted network boundary based on the container security protection policy corresponding to each trusted network boundary. It can be seen that the embodiment of the present disclosure can generate multiple trusted network boundaries based on the network access relationship between containers in the target container cluster and the network access rights supported by the containers, and realize differentiated security protection for the containers in the target container cluster based on the trusted network boundaries.

[0107] In order to further understand the container environment security protection method provided by the embodiment of the present disclosure, the embodiment of the present disclosure also provides a container environment security protection method.

[0108] The container environment security protection method provided by the embodiment of the present disclosure is applied to a container environment security protection system, such as Figure 3 As shown, Figure 3 A structural diagram of a container environment security protection provided in an embodiment of the present disclosure, the container environment security protection system 300 includes a Kubernetes container asset orchestration system, an asset probe, a container event collector, a risk detector, a security policy device, and a trusted boundary learner.

[0109] Specifically, the Kubernetes container asset orchestration system is used to orchestrate and manage containers in the target container cluster.

[0110] The asset probe is used to communicate with the interface provided by the Kubernetes container asset orchestration system to monitor asset changes in the container orchestration system corresponding to the target container cluster.

[0111] The container event collector is used to collect network events and system events of containers in the target container cluster.

[0112] The risk detector is used to differentiate and select different container security protection strategies based on the system events collected by the container event collector, and perform rule calculations to complete the security protection of the containers in the target container cluster.

[0113] The security policy controller is used to differentiate the use of different levels of container security protection policies for containers in the target container cluster based on the established trusted network boundaries.

[0114] The trusted boundary learner is used to perform risk assessment on containers in the target container cluster and build a network trusted boundary.

[0115] like Figure 3 As shown, the trusted boundary learner builds a network access relationship topology map corresponding to the target container cluster based on the network data in the network events collected by the container event collector, and labels the corresponding trusted types for the nodes in the network access relationship topology map based on the network data in the network events collected by the container event collector, and divides the trusted network boundary according to the trusted types of the nodes in the network access relationship topology map and sends the constructed trusted network boundary to the security policy maker.

[0116] After receiving the trusted network boundary constructed by the trusted boundary learner, the security policy device configures different container security protection policies for containers in different trusted network boundaries, and pushes the correspondence between each trusted network boundary and the container security protection policy to the risk detector.

[0117] After receiving the correspondence between each trusted network boundary and container security protection policy sent by the security policy device, the risk detector determines the target container involved in the system event based on the system event collected by the container event collector, queries the policy rule cache list pushed by the security policy device, selects the container security protection policy corresponding to the target container, and calculates the rules of the system event through the rule detection engine to determine whether the system event has a security risk. When it is determined that the system event has a security risk, an alarm is issued, so that the trusted boundary learner can rebuild the network trusted boundary.

[0118] Based on the above method embodiment, the present disclosure also provides a container environment safety protection device, referring to Figure 4 , is a schematic diagram of the structure of a container environment safety protection device provided by an embodiment of the present disclosure, the device comprising:

[0119] The boundary generation module 401 is used to generate multiple trusted network boundaries corresponding to the target container cluster according to the network access relationship between containers in the target container cluster; wherein different trusted network boundaries are respectively provided with different levels of trusted types, and the trusted types are determined based on the network access rights supported by the containers in the corresponding trusted network boundaries;

[0120] A policy configuration module 402 is used to configure a container security protection policy for each trusted network boundary based on the trusted type of each trusted network boundary through a security policy device, and push the corresponding relationship between each trusted network boundary and the container security protection policy to the risk detector; wherein the security policy device maintains a plurality of container security protection policies of different security levels;

[0121] The security protection module 403 is used to perform security protection for the containers within each trusted network boundary based on the container security protection policy corresponding to each trusted network boundary through the risk detector.

[0122] In an optional implementation, the boundary generation module includes:

[0123] A data receiving submodule is used to receive network data collected by a container event collector, and to construct a network access relationship topology map corresponding to the target container cluster according to the network data; nodes in the network access relationship topology map represent containers, and connection relationships between nodes represent access relationships between containers;

[0124] A node labeling submodule, used to label corresponding trusted types for nodes in the network access relationship topology diagram according to the network access permissions supported by the containers in the target container cluster;

[0125] The boundary division submodule is used to divide the trusted network boundary according to the trusted type of the nodes in the network access relationship topology diagram; the nodes within the same trusted network boundary have the same trusted type.

[0126] In an optional implementation manner, the node labeling submodule is specifically used for:

[0127] A three-color marking algorithm is used to color-mark nodes in the network access relationship topology diagram based on the network access permissions supported by the containers in the target container cluster; different colors indicate different trusted types.

[0128] In an optional implementation, the security policy device maintains three security levels of container security protection policies, including a mandatory mode, a complete detection mode, and a normal detection mode; different modes are used to protect containers marked with different colors.

[0129] In an optional implementation, the device further includes:

[0130] The first boundary adjustment module is used to notify the trusted boundary learner to dynamically adjust the trusted network boundary based on risk information of the container involved in the container security risk event when the risk detector detects the container security risk event.

[0131] In an optional implementation, the security protection module includes:

[0132] An event receiving submodule, configured to receive system events collected by the container event collector through the risk detector, and determine a target container involved in the system event;

[0133] A list query submodule, used to query the policy rule cache list pushed by the security policy device, and select a container security protection policy corresponding to the target container;

[0134] The rule calculation submodule is used to perform rule calculation on the system event through a rule detection engine, determine whether the system event has a security risk, and perform security protection on the target container based on the container security protection policy corresponding to the target container.

[0135] In an optional implementation, the device further includes:

[0136] An asset monitoring module, used to monitor asset changes of the container orchestration system corresponding to the target container cluster through an asset probe; wherein the assets of the container orchestration system include containers in the target container cluster and network access rights of the containers;

[0137] The second boundary adjustment module is used to notify the trusted boundary learner to dynamically adjust the trusted network boundary based on the asset change when the container assets in the target container cluster change.

[0138] In the container environment security protection device provided by the embodiment of the present disclosure, multiple trusted network boundaries corresponding to the target container cluster are generated according to the network access relationship between containers in the target container cluster, wherein different trusted network boundaries are respectively provided with different levels of trusted types, and the trusted type is determined based on the network access rights supported by the container in the corresponding trusted network boundary, and the security policy device is used to configure the container security protection policy for each trusted network boundary based on the trusted type of each trusted network boundary, and the corresponding relationship between each trusted network boundary and the container security protection policy is pushed to the risk detector, wherein the security policy device maintains container security protection policies of multiple different security levels, and the risk detector is used to perform security protection for each container in the trusted network boundary based on the container security protection policy corresponding to each trusted network boundary. It can be seen that the embodiment of the present disclosure can generate multiple trusted network boundaries based on the network access relationship between containers in the target container cluster and the network access rights supported by the containers, and realize differentiated security protection for the containers in the target container cluster based on the trusted network boundaries.

[0139] In addition to the above-mentioned method and apparatus, the embodiments of the present disclosure further provide a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device implements the container environment security protection method described in the embodiments of the present disclosure.

[0140] In addition, the present disclosure also provides a container environment safety protection device, see Figure 5 As shown, it may include:

[0141] Processor 501, memory 502, input device 503 and output device 504. The number of processors 501 in the container environment safety protection device can be one or more. Figure 5 In some embodiments of the present disclosure, the processor 501, the memory 502, the input device 503 and the output device 504 may be connected via a bus or other means, wherein: Figure 5 The example of connecting through bus is taken in the following.

[0142] The memory 502 can be used to store software programs and modules. The processor 501 executes various functional applications and data processing of the container environment safety protection device by running the software programs and modules stored in the memory 502. The memory 502 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, at least one application required for a function, etc. In addition, the memory 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. The input device 503 may be used to receive input digital or character information, and to generate signal input related to user settings and function control of the container environment safety protection device.

[0143] Specifically in this embodiment, the processor 501 will load the executable files corresponding to the processes of one or more applications into the memory 502 according to the following instructions, and the processor 501 will run the applications stored in the memory 502, thereby realizing the various functions of the above-mentioned container environment security protection device.

[0144] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0145] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A container environment security protection method, characterized in that: The method comprises: Generate multiple trusted network boundaries corresponding to the target container cluster according to the network access relationship between containers in the target container cluster; wherein different trusted network boundaries are respectively provided with different levels of trusted types, and the trusted types are determined based on the network access rights supported by the containers in the corresponding trusted network boundaries; Based on the trust type of each trusted network boundary, the security policy device configures a container security protection policy for each trusted network boundary, and pushes the corresponding relationship between each trusted network boundary and the container security protection policy to the risk detector; wherein the security policy device maintains a plurality of container security protection policies of different security levels; The risk detector is used to perform security protection for each container within the trusted network boundary based on the container security protection strategy corresponding to each trusted network boundary; The generating a plurality of trusted network boundaries corresponding to the target container cluster according to the network access relationship between containers in the target container cluster includes: Receive network data collected by the container event collector, and construct a network access relationship topology map corresponding to the target container cluster according to the network data; nodes in the network access relationship topology map represent containers, and connection relationships between nodes represent access relationships between containers; According to the network access permissions supported by the containers in the target container cluster, marking corresponding trusted types for the nodes in the network access relationship topology diagram; According to the trust type of the nodes in the network access relationship topology diagram, the trusted network boundary is divided; the nodes within the same trusted network boundary have the same trust type.

2. The method according to claim 1, characterized in that: The marking of corresponding trusted types for nodes in the network access relationship topology diagram according to the network access permissions supported by the containers in the target container cluster includes: A three-color marking algorithm is used to color-mark nodes in the network access relationship topology diagram based on the network access permissions supported by the containers in the target container cluster; different colors indicate different trusted types.

3. The method according to claim 2, characterized in that: The security policy device maintains three security levels of container security protection policies, including a mandatory mode, a complete detection mode, and a normal detection mode; different modes are used to protect containers marked with different colors.

4. The method according to claim 1, characterized in that: The method further comprises: When the risk detector detects a container security risk event, the trusted boundary learner is notified to dynamically adjust the trusted network boundary based on risk information of the container involved in the container security risk event.

5. The method according to claim 1, characterized in that: The risk detector performs security protection for each container within the trusted network boundary based on the container security protection strategy corresponding to each trusted network boundary, including: Receiving, by the risk detector, system events collected by the container event collector, and determining a target container involved in the system event; Query the policy rule cache list pushed by the security policy device, and select the container security protection policy corresponding to the target container; The rule detection engine performs rule calculation on the system event to determine whether the system event has a security risk, and performs security protection on the target container based on the container security protection policy corresponding to the target container.

6. The method according to claim 1, characterized in that The method further comprises: Monitoring asset changes of the container orchestration system corresponding to the target container cluster through an asset probe; wherein the assets of the container orchestration system include containers in the target container cluster and network access rights of the containers; When container assets in the target container cluster change, the trusted boundary learner is notified to dynamically adjust the trusted network boundary based on the asset change.

7. A container environment safety protection device, characterized in that: The device comprises: A boundary generation module, used to generate multiple trusted network boundaries corresponding to the target container cluster according to the network access relationship between containers in the target container cluster; wherein different trusted network boundaries are respectively provided with different levels of trusted types, and the trusted types are determined based on the network access rights supported by the containers in the corresponding trusted network boundaries; A policy configuration module, configured to configure a container security protection policy for each trusted network boundary based on the trusted type of each trusted network boundary through a security policy device, and push the corresponding relationship between each trusted network boundary and the container security protection policy to the risk detector; wherein the security policy device maintains a plurality of container security protection policies of different security levels; A security protection module, configured to perform security protection for each container within a trusted network boundary based on a container security protection policy corresponding to each trusted network boundary through the risk detector; The boundary generation module comprises: A data receiving submodule is used to receive network data collected by a container event collector, and to construct a network access relationship topology map corresponding to the target container cluster according to the network data; nodes in the network access relationship topology map represent containers, and connection relationships between nodes represent access relationships between containers; A node labeling submodule, used to label corresponding trusted types for nodes in the network access relationship topology diagram according to the network access permissions supported by the containers in the target container cluster; The boundary division submodule is used to divide the trusted network boundary according to the trusted type of the nodes in the network access relationship topology diagram; the nodes within the same trusted network boundary have the same trusted type.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device implements the method according to any one of claims 1 to 6.

9. A container environment safety protection device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

Images