Network access control method and apparatus, electronic device, and storage medium

Abstract

The present disclosure provides a network access control method and device, electronic equipment and storage medium, and relates to the technical field of cloud. The network access control method comprises the following steps: applied to a worker, receiving a security access control policy sent by a controller, wherein the security access control policy takes a pod as the minimum access control unit; analyzing the security access control policy to obtain a first pod to which the security access control policy is applied; and sending the security access control policy to the first pod. Applied to a controller, obtaining a security access control policy taking a pod as an access control unit; and sending the security access control policy to a worker. The network access control method and device of the present disclosure can be finely controlled to improve the security level of the cluster.

Description

Technical Field

[0001] This disclosure relates to the field of cloud technology, and in particular to a network access control method and apparatus, electronic device and storage medium. Background Technology

[0002] In the field of cloud technology, cluster management computer entities (Kubernetes, k8s) are powerful but also very complex container platforms. A k8s cluster often runs thousands of services, with different business lines deployed within the cluster. Different business attributes have different requirements for information security control, and for security protection reasons, access to sensitive data of each business line needs to be strictly restricted.

[0003] Currently, to implement secure access restrictions, access restrictions are generally set through machine IP addresses. However, in the cloud-native field, the smallest unit of service operation is the pod, and these pods are deployed on a batch of machines. There is no clear machine division between services. Therefore, the current machine IP address-based access control method is imprecise, resulting in a lack of security for cluster data. Summary of the Invention

[0004] To overcome the shortcomings of the prior art, this disclosure provides a network access control method, apparatus, electronic device, and storage medium.

[0005] According to a first aspect of the present disclosure, a network access control method is provided, applied to a worker node, the method comprising:

[0006] Receive a security access control policy sent by the controller node, wherein the security access control policy uses the pod as the smallest access control unit;

[0007] Parse the security access control policy to obtain the first pod that applies the security access control policy;

[0008] Send the security access control policy to the first pod.

[0009] In some embodiments of this disclosure, the security access control policy is a control policy input through a human-computer interaction interface, including the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs.

[0010] In some embodiments of this disclosure, parsing the security access control policy to obtain the first pod to which the security access control policy is applied includes:

[0011] The security access control policy is parsed, and the first pod to which the security access control policy is applied is obtained based on the namespace information in the security access control policy and the identifier information of the pod.

[0012] In some embodiments of this disclosure, sending the security access control policy to the first pod includes:

[0013] Obtain information about all second pods deployed on the worker node;

[0014] Query the information of all the second pods to determine the first pod to which the security access control policy is applied;

[0015] If it is determined that the security access control policy is in the second pod, then the security access control policy is sent to the first pod.

[0016] In some embodiments of this disclosure, obtaining information about all second pods deployed on the current node includes:

[0017] Get real-time information about all second pods deployed on the current node;

[0018] Alternatively, information about all second pods deployed on the current node can be obtained by polling at predetermined intervals.

[0019] In some embodiments of this disclosure, the security access control policy issued by the receiving control node (Controller) includes:

[0020] Receive the security access control policy sent by the Controller via the Hypertext Transfer Protocol (HTTP);

[0021] Alternatively, it may receive the security access control policy sent by the Controller via shared storage;

[0022] Alternatively, it may receive the security access control policy sent by the Controller via message queue communication.

[0023] According to a second aspect of the present disclosure, a network access control method is applied to a controller node, comprising:

[0024] Obtain the security access control policy with the pod as the access control unit;

[0025] Send the security access control policy to the worker node.

[0026] In some embodiments of this disclosure, obtaining the security access control policy with the pod as the access control unit includes:

[0027] Receives the control policy input through the human-computer interaction interface, the identification information of the first pod to which the security access control policy is applied, and the namespace information to which the pod belongs;

[0028] The security access control policy is generated based on the control policy, the identification information of the first pod to which the security access control policy is applied, and the namespace information to which the pod belongs. The security access control policy includes the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs.

[0029] In some embodiments of this disclosure, sending the security access control policy to the worker node includes:

[0030] The security access control policy is sent to the worker node via the Hypertext Transfer Protocol (HTTP).

[0031] Alternatively, the security access control policy can be sent to the worker node via shared storage;

[0032] Alternatively, the security access control policy can be sent to the worker node via message queue communication.

[0033] According to a third aspect of the present disclosure, a network access control device is applied to a worker node, comprising:

[0034] The receiving unit is used to receive the security access control policy sent by the controller node, wherein the security access control policy takes the pod as the smallest access control unit;

[0035] The parsing unit is used to parse the security access control policy to obtain the first pod that applies the security access control policy;

[0036] The sending unit is used to send the security access control policy to the first pod.

[0037] According to a fourth aspect of the present disclosure, a network access control device is applied to a control node (Controller), comprising:

[0038] The acquisition unit is used to acquire the security access control policy that uses the pod as the access control unit.

[0039] The sending unit is used to send the security access control policy to the worker node.

[0040] According to a fifth aspect of the present disclosure, a network access control system includes:

[0041] The controller node as described in any of the second aspects above, and at least one worker node, each worker having an agent deployed on it, the agent being able to perform the method as described in any of the first aspects above.

[0042] According to a sixth aspect of the present disclosure, an electronic device is provided, comprising:

[0043] At least one processor; and

[0044] A memory that is communicatively connected to at least one processor; wherein,

[0045] The memory stores instructions that can be executed by at least one processor, such that the instructions are executed by at least one processor to enable the at least one processor to perform the method described in the first aspect above.

[0046] According to a seventh aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are used to cause a computer to perform the method described in the first aspect above.

[0047] According to an eighth aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method described in the first aspect above.

[0048] The network access control method, apparatus, and electronic device disclosed herein are applied to worker nodes. They receive security access control policies sent by controller nodes, where each security access control policy uses a pod as the smallest access control unit. The method parses the security access control policy to obtain the first pod to which the policy applies, and then sends the security access control policy to the first pod. Specifically, the controller node obtains the security access control policy using pods as access control units and sends it to the worker nodes. This invention ultimately obtains a security access control policy using pods as the smallest access control unit, realizing a method for fine-grained network policy control within a cluster, strengthening cluster network security management and control, and improving the cluster's security level.

[0049] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0050] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0051] Figure 1 A flowchart illustrating a network access control method provided in an embodiment of this disclosure;

[0052] Figure 2 This is a schematic flowchart of a network access control method provided in an embodiment of the present disclosure;

[0053] Figure 3 A flowchart illustrating a network access control method provided in an embodiment of this disclosure;

[0054] Figure 4 This is a schematic diagram of another network access control process provided in an embodiment of this disclosure;

[0055] Figure 5 A block diagram of a network access control device provided in an embodiment of this disclosure;

[0056] Figure 6 A block diagram of a network access control device provided in an embodiment of this disclosure;

[0057] Figure 7 A block diagram of a network access control device provided in an embodiment of this disclosure;

[0058] Figure 8 A block diagram of a network access control device provided in an embodiment of this disclosure;

[0059] Figure 9 This is a schematic block diagram of an electronic device 400 provided in an embodiment of the present disclosure; Detailed Implementation

[0060] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0061] The network access control method, apparatus, electronic device, and storage medium of this disclosure are described below with reference to the accompanying drawings.

[0062] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this disclosure. Rather, they are merely apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0063] In the field of cloud technology, cluster management computer entities (Kubernetes, k8s) are powerful but also very complex container platforms. A k8s cluster often runs thousands of services, with different business lines deployed within the cluster. Different business attributes have different requirements for information security control, and for security protection reasons, access to sensitive data of each business line needs to be strictly restricted.

[0064] Currently, to implement secure access restrictions, access restrictions are generally set through machine IP addresses. However, in the cloud-native field, the smallest unit of service operation is the pod, and these pods are deployed on a batch of machines. There is no clear machine division between services. Therefore, the current machine IP address-based access control method is imprecise, resulting in a lack of security for cluster data.

[0065] It should be noted that the Kubernetes cluster disclosed herein includes multiple worker nodes and at least one master node, as well as a controller node. This controller can be located on either a worker or a master node; specifically, the embodiments disclosed herein do not impose any limitations on this. An agent is deployed on each worker node as a Daemonset. A Daemonset is a deployment method for pods in Kubernetes, similar to a daemon process, running one pod on each specified node. The agent can obtain all pods deployed on the worker nodes, receive security access control policies issued by the controller, and distribute these policies to the corresponding pods, achieving fine-grained management on a pod-by-pod basis.

[0066] To solve the above problems, such as Figure 1 As shown, Figure 1 This is a flowchart illustrating a network access control method provided in an embodiment of the present disclosure. The method is applied to a worker node and includes:

[0067] Step 101: Receive the security access control policy sent by the controller node, wherein the security access control policy uses the pod as the smallest access control unit.

[0068] In this embodiment of the present disclosure, it should be noted that the security access control policy sent by the receiving control node (Controller) is the security access control policy sent by the receiving controller through existing communication methods. The security access control policy is the main strategy for network security prevention and protection, with the pod as the smallest access control unit. The pod is the smallest unit for setting security access permissions.

[0069] In addition, it should be noted that the security access control policy can be automatically generated or entered through a human-computer interaction interface. Specifically, the embodiments disclosed herein do not impose any restrictions on this.

[0070] Step 102: Parse the security access control policy to obtain the first pod that applies the security access control policy.

[0071] In this embodiment of the present disclosure, it should be noted that parsing the security access control policy means interpreting the content contained in the security access control policy. The security access control policy includes security access time, access frequency, access method, as well as all the pods involved and the access spaces to which these pods belong. It may also include other content. The specific embodiments of the present disclosure do not limit this.

[0072] Additionally, it should be noted that obtaining the first pod applying the security access control policy involves parsing the security access control policy to obtain the first pod applying the policy. The security access control policy includes the identifier information of the pod applying the policy and the namespace information to which the pod belongs. This namespace contains pods, and each namespace has a unique identifier. However, the identifiers of pods within each namespace are not unique and may be duplicated. For example, the pods included in namespace 1 may be numbered sequentially as 1, 2, 3, etc.; the pods included in namespace 2 may also be numbered sequentially as 1, 2, 3, etc. Therefore, to uniquely identify a pod's identifier, both the namespace identifier and the pod identifier are needed. Thus, in this embodiment, after determining that the pod information applying the security access control policy has been obtained, it is also necessary to determine the namespace information of that pod to uniquely identify the first pod applying the security access control policy.

[0073] The aforementioned pod identifier information can be one or more; the aforementioned namespace information can be one or more. Regardless of whether it is one or more, each pod has a corresponding namespace, and the specific embodiments of this disclosure do not limit this.

[0074] Step 103: Send the security access control policy to the first pod.

[0075] It should be noted that the security access control policy described in this disclosure adopts an existing method of sending information to the pod. Specifically, this disclosure does not limit the implementation of this method.

[0076] This invention provides a network access control method and apparatus that can effectively improve the security level of a cluster. Specifically, such as... Figure 2 As shown, Figure 2 This is a flowchart illustrating a network access control method provided in an embodiment of the present disclosure. The method is applied to a controller node and includes:

[0077] Step 201: Obtain the security access control policy with the pod as the access control unit.

[0078] In the embodiments provided in this disclosure, the security access control policy is the main strategy for network security prevention and protection, with the pod as the smallest access control unit. The pod is the smallest unit for setting security access permissions. The security access control policy includes the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs. This namespace contains pods, and each namespace has a unique identifier; however, the identifiers of pods within each namespace are not unique and may be duplicated.

[0079] The aforementioned pod identifier information can be one or more; the aforementioned namespace information can be one or more. Regardless of whether it is one or more, each pod has a corresponding namespace, and the specific embodiments of this disclosure do not limit this.

[0080] Additionally, it should be noted that when obtaining a security access control policy with a pod as the access control unit, one can receive an input security access control policy, a full access control policy issued by the server, or a security access control policy generated according to pre-set rules. Specific embodiments of this disclosure do not limit this.

[0081] Step 202: Send the security access control policy to the worker node.

[0082] In the embodiments of this disclosure, the security access control policy is sent to the worker node by means of sending the security access control policy to the worker node through an existing communication method. Specifically, the embodiments of this disclosure do not limit this.

[0083] The embodiments of this disclosure provide a network access control method, apparatus, and electronic device applied to worker nodes. These nodes receive a security access control policy sent by a controller node, where the security access control policy uses pods as the smallest access control unit. The method parses the security access control policy to obtain the first pod to which the policy applies, and then sends the security access control policy to the first pod. Specifically, the controller node obtains the security access control policy using pods as the access control unit and sends it to the worker nodes. This invention ultimately obtains a security access control policy using pods as the smallest access control unit, realizing a method for fine-grained network policy control within a cluster, strengthening cluster network security management and improving the cluster's security level.

[0084] In some embodiments of this disclosure, the security access control policy is a control policy input through a human-computer interaction interface, including the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs. This security access control policy can be automatically generated or input through a human-computer interaction interface; specific embodiments of this disclosure do not limit this.

[0085] In some embodiments of this disclosure, parsing the security access control policy, obtaining the first pod to which the security access control policy applies based on the namespace information in the security access control policy and the pod's identification information, and sending the security access control policy to the first pod can be done, but is not limited to, the following methods: Figure 3 As shown, it includes:

[0086] Step 301: Obtain information on all second pods laid out on the worker node.

[0087] In some embodiments of this disclosure, obtaining information about all second pods deployed on the current node can be done in real time, or it can be done by polling at predetermined intervals. Specifically, the embodiments of this disclosure do not impose limitations on this approach.

[0088] Step 302: Query the information of all the second pods to determine the first pod to which the security access control policy is applied is in the information of all the second pods.

[0089] In some embodiments of this disclosure, firstly, all second pod information that can be queried on the worker is obtained, and then it is determined whether the first pod of the security access control policy is in the information of the second pod based on all the second pod information deployed on the worker node.

[0090] Step 303: If it is determined that the security access control policy is in the second pod, then send the security access control policy to the first pod.

[0091] In some embodiments of this disclosure, if it is determined that the security access control policy is in the second pod, the security access control policy can be sent to the first pod using existing communication methods. Specifically, the embodiments of this disclosure do not limit this.

[0092] Furthermore, in the following embodiments of this disclosure, the worker node receives the security access control policy issued by the controller node, which can be displayed in, but is not limited to, the following manner, including:

[0093] The first method involves receiving the security access control policy sent by the Controller via the Hypertext Transfer Protocol (HTTP), a simple request-response protocol. HTTP is a commonly used technology that allows for priority selection during transmission, but does not impose specific restrictions.

[0094] The second method involves receiving the security access control policy sent by the Controller via shared storage. This shared storage method allows the security access control policy to be stored in a temporary or fixed storage location, the storage path to be distributed to the sharing party, or accessed from a predetermined storage space according to an agreement. Other methods may also be used; specifically, the embodiments disclosed herein do not impose limitations on this.

[0095] The third method involves receiving the security access control policy sent by the Controller via message queue communication. Here, using a message queue means that the security access control policy employs a first-in, first-out (FIFO) mechanism. For specific details, please refer to existing descriptions of message queues; this disclosure does not impose specific limitations on this approach.

[0096] In some embodiments of this disclosure, when the Controller obtains the security access control policy with the pod as the access control unit, it can adopt, but is not limited to, the following methods: Figure 4 As shown, the method includes:

[0097] Step 401: Receive the control policy, the identifier information of the first pod to which the security access control policy is applied, and the namespace information of the pod as input through the human-computer interaction interface.

[0098] In this embodiment of the disclosure, when the Controller receives the security access control policy, the identifier information of the first pod to which the security access control policy is applied, and the namespace information to which the pod belongs, it can accept the input security access control policy or the security policy issued by the server. Specific embodiments of this disclosure do not limit this.

[0099] Among these, access control policies are the primary strategy for network security prevention and protection, with the pod serving as the smallest access control unit. The pod is the smallest unit for setting security access permissions.

[0100] Step 402: Generate the security access control policy based on the control policy, the identification information of the first pod to which the security access control policy is applied, and the namespace information to which the pod belongs. The security access control policy includes the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs.

[0101] To obtain the first pod that applies the security access control policy, the process involves parsing the security access control policy to identify the first pod that applies the policy. After determining that the pod information for applying the security access control policy has been obtained, it is also necessary to determine the namespace information of that pod in order to uniquely identify the first pod that applies the security access control policy.

[0102] Furthermore, in the following embodiments of this disclosure, the Controller may send the security access control policy to the worker in, but is not limited to, the following manner, including:

[0103] The first method involves sending the security access control policy to the worker via the Hypertext Transfer Protocol (HTTP). HTTP is a commonly used technology that allows for priority selection during transmission, but it doesn't impose specific restrictions.

[0104] In this method, the Hypertext Transfer Protocol (HTTP) is an application layer protocol that serves as a communication protocol between the client and the server. It is a way to send the security access control policy to the worker nodes.

[0105] The second method involves sending the security access control policy to the worker via shared storage. This shared storage method allows the security access control policy to be stored in a temporary or fixed storage location. The storage path can be distributed to the sharing participants, or it can be retrieved from a predetermined storage space according to an agreement. Other methods may also be used; specifically, the embodiments disclosed herein do not impose limitations on this approach.

[0106] The third method involves sending the security access control policy to the worker via message queue communication. Using a message queue employs a first-in, first-out (FIFO) mechanism for the security access control policy. For specific details, please refer to existing descriptions of message queues; this disclosure does not impose specific limitations on this approach.

[0107] Message queues are used to store messages until they are sent to consumers. They are both the container and the final destination for messages. A message can be placed into one or more queues. Messages remain in the queue, waiting for consumers to connect and retrieve them. The primary purpose of queues is to provide routing and ensure message delivery.

[0108] The main characteristic of message queues is asynchronous processing, with the primary purpose of reducing request response time and decoupling. Therefore, their main use case is placing time-consuming operations that don't require immediate (synchronous) returns as messages into message queues. Furthermore, because message queues are used, as long as the message format remains unchanged, the sender and receiver don't need to communicate with each other or be affected by each other—that is, decoupling. This is the significance of message middleware.

[0109] The embodiments of this disclosure provide a network access control method, apparatus, and electronic device applied to worker nodes. These nodes receive a security access control policy sent by a controller node, where the security access control policy uses pods as the smallest access control unit. The method parses the security access control policy to obtain the first pod to which the policy applies, and then sends the security access control policy to the first pod. Specifically, the controller node obtains the security access control policy using pods as the access control unit and sends it to the worker nodes. This invention ultimately obtains a security access control policy using pods as the smallest access control unit, realizing a method for fine-grained network policy control within a cluster, strengthening cluster network security management and improving the cluster's security level.

[0110] Corresponding to the network access control method described above, this invention also proposes a schematic diagram of the composition structure of a network access control device. Since the device embodiments of this invention correspond to the method embodiments described above, details not disclosed in the device embodiments can be referred to in the method embodiments described above, and will not be repeated here.

[0111] Figure 5 This is a block diagram of a network access control device provided in an embodiment of the present disclosure, applied to a worker node, such as... Figure 5 As shown, the device includes:

[0112] The receiving unit 501 is used to receive the security access control policy sent by the Controller, wherein the security access control policy takes the pod as the smallest access control unit.

[0113] The parsing unit 502 is used to parse the security access control policy to obtain the first pod that applies the security access control policy.

[0114] The sending unit 503 is used to send the security access control policy to the first pod.

[0115] In some embodiments of this disclosure, the security access control policy is a control policy input through a human-computer interaction interface, including the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs.

[0116] In some embodiments of this disclosure, parsing the security access control policy to obtain the first pod applying the security access control policy includes: the parsing unit 502 is specifically used for:

[0117] The security access control policy is parsed, and the first pod to which the security access control policy is applied is obtained based on the namespace information in the security access control policy and the identifier information of the pod.

[0118] In some embodiments of this disclosure, such as Figure 6 As shown, the parsing unit 502 includes:

[0119] The acquisition module 5021 is used to acquire information about all the second pods laid out on the worker node;

[0120] Query module 5022 is used to query the information of all the second pods to determine the first pod that applies the security access control policy in the information of all the second pods;

[0121] The sending module 5023 is used to send the security access control policy to the first pod if it is determined that the policy is in the second pod.

[0122] In some embodiments of this disclosure, the acquisition module 5021 is used for:

[0123] Get real-time information about all second pods deployed on the current node;

[0124] Alternatively, information about all second pods deployed on the current node can be obtained by polling at predetermined intervals.

[0125] In some embodiments of this disclosure, the transmitting unit 503 includes:

[0126] The first method involves receiving the security access control policy sent by the Controller via the Hypertext Transfer Protocol (HTTP).

[0127] The second method involves receiving the security access control policy sent by the Controller via shared storage.

[0128] The third method involves receiving the security access control policy sent by the Controller via message queue communication.

[0129] In the above embodiments, the worker may send the security access control policy to the worker in a manner that is not limited to the above methods, and the specific embodiments of this disclosure do not limit this.

[0130] A block diagram of a network access control device provided in the disclosed embodiments is applied to a controller, such as... Figure 7 As shown, the device includes:

[0131] The acquisition unit 601 is used to acquire the security access control policy with the pod as the access control unit.

[0132] The sending unit 602 is used to send the security access control policy to the worker.

[0133] In some embodiments of this disclosure, such as Figure 8 As shown, the acquisition unit 601 includes:

[0134] The receiving module 6011 is used to receive the control policy, the identification information of the first pod to which the security access control policy is applied, and the namespace information to which the pod belongs, which are input through the human-computer interaction interface.

[0135] The generation module 6012 is used to generate the security access control policy based on the control policy, the identification information of the first pod to which the security access control policy is applied, and the namespace information to which the pod belongs. The security access control policy includes the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs.

[0136] In some embodiments of this disclosure, the transmitting unit 602 includes:

[0137] The first method involves sending the security access control policy to the worker node via the Hypertext Transfer Protocol (HTTP).

[0138] The second method involves sending the security access control policy to the worker node via shared storage.

[0139] The third method involves sending the security access control policy to the worker node via message queue communication.

[0140] In the above embodiments, the Controller may send the security access control policy to the worker in a manner that is not limited to the above methods, and the specific embodiments of this disclosure do not limit this.

[0141] The embodiments of this disclosure provide a network access control method, apparatus, and electronic device applied to worker nodes. These nodes receive a security access control policy sent by a controller node, where the security access control policy uses pods as the smallest access control unit. The method parses the security access control policy to obtain the first pod to which the policy applies, and then sends the security access control policy to the first pod. Specifically, the controller node obtains the security access control policy using pods as the access control unit and sends it to the worker nodes. This invention ultimately obtains a security access control policy using pods as the smallest access control unit, realizing a method for fine-grained network policy control within a cluster, strengthening cluster network security management and improving the cluster's security level.

[0142] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0143] Figure 9A schematic block diagram of an example electronic device 400 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0144] like Figure 9 As shown, device 400 includes a computing unit 401, which can perform various appropriate actions and processes based on a computer program stored in ROM (Read-Only Memory) 402 or a computer program loaded from storage unit 408 into RAM (Random Access Memory) 403. RAM 403 may also store various programs and data required for the operation of device 400. The computing unit 401, ROM 402, and RAM 403 are interconnected via bus 404. I / O (Input / Output) interface 405 is also connected to bus 404.

[0145] Multiple components in device 400 are connected to I / O interface 405, including: input unit 406, such as keyboard, mouse, etc.; output unit 407, such as various types of monitors, speakers, etc.; storage unit 408, such as disk, optical disk, etc.; and communication unit 409, such as network card, modem, wireless transceiver, etc. Communication unit 409 allows device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0146] The computing unit 401 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, CPUs (Central Processing Units), GPUs (Graphics Processing Units), various special-purpose AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, DSPs (Digital Signal Processors), and any suitable processor, controller, microcontroller, etc. The computing unit 401 performs the various methods and processes described above, such as the child safety seat insertion detection method. For example, in some embodiments, the child safety seat insertion detection method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by the computing unit 401, one or more steps of the methods described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to perform the aforementioned safety seat insertion detection method by any other suitable means (e.g., by means of firmware).

[0147] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application-Specific Standard Products), SOCs (System-on-Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0148] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0149] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, EPROM (Electrically Programmable Read-Only Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0150] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0151] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include LANs (Local Area Networks), WANs (Wide Area Networks), the Internet, and blockchain networks.

[0152] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service ecosystem, addressing the shortcomings of traditional physical hosts and VPS (Virtual Private Server, or simply "VPS") services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0153] It's important to note that artificial intelligence (AI) is the study of enabling computers to simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). It encompasses both hardware and software technologies. AI hardware technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily include computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graph technologies.

[0154] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0155] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A network access control method, characterized in that, Applied to worker nodes, including: Receives a security access control policy sent by the controller node, wherein the security access control policy uses the pod as the smallest access control unit; including: Receive the security access control policy sent by the Controller via Hypertext Transfer Protocol (HTTP); or receive the security access control policy sent by the Controller via shared storage; or receive the security access control policy sent by the Controller via message queue communication. Parse the security access control policy to obtain the first pod that applies the security access control policy; Send the security access control policy to the first pod; The security access control policy is a control policy input through a human-computer interaction interface, including the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs. The step of parsing the security access control policy to obtain the first pod that applies the security access control policy includes: The security access control policy is parsed, and the first pod to which the security access control policy is applied is obtained based on the namespace information in the security access control policy and the identifier information of the pod.

2. The method according to claim 1, characterized in that, Sending the security access control policy to the first pod includes: Obtain information about all second pods deployed on the worker node; Query the information of all the second pods to determine the first pod to which the security access control policy is applied; If it is determined that the security access control policy is in the second pod, then the security access control policy is sent to the first pod.

3. The method according to claim 2, characterized in that, The process of obtaining information about all second pods deployed on the current node includes: Get real-time information about all second pods deployed on the current node; Alternatively, information about all second pods deployed on the current node can be obtained by polling at predetermined intervals.

4. A network access control method, characterized in that, Applied to the controller node, including: Obtain a security access control policy with pod as the access control unit; wherein, the security access control policy is a control policy input through a human-computer interaction interface, including the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs; The system receives control policies input through a human-computer interaction interface, identification information of the first pod to which the security access control policy is applied, and namespace information of the pod. The security access control policy is generated based on the control policy, the identifier information of the first pod to which the security access control policy is applied, and the namespace information to which the pod belongs. The security access control policy is sent to the worker node; wherein, the security access control policy is sent to the worker node via the Hypertext Transfer Protocol (HTTP); or via shared storage; or via message queue communication.

5. A network access control device, characterized in that, Applied to worker nodes, including: A receiving unit is configured to receive a security access control policy sent by the controller node, wherein the security access control policy uses the pod as the smallest access control unit; including: Receive the security access control policy sent by the Controller via Hypertext Transfer Protocol (HTTP); or receive the security access control policy sent by the Controller via shared storage; or receive the security access control policy sent by the Controller via message queue communication. The parsing unit is used to parse the security access control policy to obtain the first pod that applies the security access control policy; A sending unit is used to send the security access control policy to the first pod; The security access control policy is a control policy input through a human-computer interaction interface, including the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs. The step of parsing the security access control policy to obtain the first pod that applies the security access control policy includes: The security access control policy is parsed, and the first pod to which the security access control policy is applied is obtained based on the namespace information in the security access control policy and the identifier information of the pod.

6. A network access control device, characterized in that, The controller node includes: The acquisition unit is used to acquire a security access control policy with a pod as the access control unit; wherein the security access control policy is a control policy input through a human-computer interaction interface, including the identification information of the pod to which the security access control policy is applied and the namespace information to which the pod belongs; The system receives control policies input through a human-computer interaction interface, identification information of the first pod to which the security access control policy is applied, and namespace information of the pod. The security access control policy is generated based on the control policy, the identifier information of the first pod to which the security access control policy is applied, and the namespace information to which the pod belongs. The sending unit is used to send the security access control policy to the worker node; wherein, the security access control policy is sent to the worker node via the Hypertext Transfer Protocol (HTTP); or via shared storage; or via message queue communication.

7. A network access control system, characterized in that, include: The controller node as described in claim 4, and at least one worker node, wherein an agent is deployed on each worker node, the agent being capable of performing the method as described in any one of claims 1-3.

8. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-3 or the method of claim 4.

9. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-3 or the method according to claim 4.

10. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-3 or the method according to claim 4.

Images