Container website protection deployment method and device, equipment and storage medium

Abstract

The application discloses a container website protection deployment method and device, equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: a cluster server loads a preset target process image file, starts a target container corresponding to the target process image file, and generates a target process object of the target container, wherein the target container is configured with a target startup configuration file, and the target startup configuration file comprises an Internet protocol port of a policy server and at least one target policy code; the target process object sends a connection request to the policy server according to the Internet protocol port, wherein the connection request comprises the at least one target policy code; the policy server sends target protection policies corresponding to the at least one target policy code to the target process object in response to the connection request, wherein the policy server comprises at least one policy code and a protection policy corresponding to each policy code; and the target process object deploys the at least one target protection policy in a kernel of the cluster server.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and in particular relates to a container website protection deployment method, apparatus, device and storage medium. Background Technology

[0002] In a cloud-native environment, websites primarily run on clusters managed by Kubernetes (K8S), existing as containers. K8S provides unified orchestration for managing the start and stop of these containers. When a container dies or runs out of resources, K8S can restart a new container to take over the work of the original website container. Due to the open and interactive nature of websites, website tampering can lead to malicious content dissemination and virus propagation, thus requiring website security protection. However, K8S is not compatible with existing Docker container-based website anti-tampering software. If a container dies and K8S restarts a new container, the new container ID is randomly generated, causing the policy server to be unable to issue policies based on the container ID. Operations personnel need to regularly monitor the container's running status to manage restarted containers, which not only increases their workload significantly but also increases the risk of accidental container operations, potentially causing irreparable damage. Summary of the Invention

[0003] This application provides a container website protection deployment method, apparatus, device, and storage medium, which enables operation and maintenance personnel to avoid paying attention to the container's running status and to manage policies for restarting containers. This not only reduces the workload of operation and maintenance personnel but also reduces the risk of misoperation, thereby achieving security protection for the website.

[0004] In a first aspect, embodiments of this application provide a container website protection deployment method, applied to a cluster server, wherein the cluster server is connected to a policy server, and the method includes:

[0005] The cluster server loads a preset target process image file, starts the target container corresponding to the target process image file, and generates a target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol port of the policy server and at least one target policy code.

[0006] The target process object sends a connection request to the policy server according to the Internet protocol port. The connection request includes at least one target policy code, so that the policy server responds to the connection request and sends a target protection policy corresponding to the at least one target policy code to the target process object. The policy server includes at least one policy code and a protection policy corresponding to each policy code.

[0007] The target process object receives at least one target protection policy sent by the policy server;

[0008] The target process object deploys at least one of the target protection policies in the kernel of the cluster server.

[0009] Secondly, embodiments of this application provide a container website protection deployment method, applied to a policy server, wherein the policy server is connected to a cluster server, and the method includes:

[0010] The system receives a connection request sent by a target process object of a target container in the cluster server. The connection request includes at least one target policy code. The connection request involves the cluster server loading a preset target process image file, starting the target container corresponding to the target process image file, and generating a target process object for the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol (IP) port of the policy server and the at least one target policy code. The target process object sends a request to the policy server based on the IP port.

[0011] In response to the connection request, a target protection policy corresponding to the at least one target policy code is sent to the target process object. The policy server includes at least one policy code and a protection policy corresponding to each policy code, so that the target process object deploys at least one target protection policy in the kernel of the cluster server.

[0012] Thirdly, embodiments of this application provide a container website protection deployment device applied to a cluster server, wherein the cluster server is connected to a policy server, and the device includes:

[0013] The loading module is used to load a preset target process image file into the cluster server, start the target container corresponding to the target process image file, and generate a target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol port of the policy server and at least one target policy code.

[0014] A first sending module is configured to have the target process object send a connection request to the policy server according to the Internet Protocol port, the connection request including at least one target policy code, so that the policy server responds to the connection request and sends a target protection policy corresponding to the at least one target policy code to the target process object, the policy server including at least one policy code and protection policies corresponding to each policy code;

[0015] The first receiving module is used for the target process object to receive at least one target protection policy sent by the policy server;

[0016] The deployment module is used by the target process object to deploy at least one of the target protection policies in the kernel of the cluster server.

[0017] Fourthly, embodiments of this application provide a container website protection deployment device, applied to a policy server, wherein the policy server is connected to a cluster server, and the device includes:

[0018] The second receiving module is used to receive a connection request sent by a target process object of a target container in the cluster server. The connection request includes at least one target policy code. The connection request is for the cluster server to load a preset target process image file, start the target container corresponding to the target process image file, and generate a target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol port of the policy server and the at least one target policy code. The target process object sends a request to the policy server according to the Internet Protocol port.

[0019] The second sending module is used to send a target protection policy corresponding to the at least one target policy code to the target process object in response to the connection request. The policy server includes at least one policy code and a protection policy corresponding to each policy code, so that the target process object deploys at least one target protection policy in the kernel of the cluster server.

[0020] Fifthly, embodiments of this application provide an electronic device, the device including: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the container website protection deployment method as described above.

[0021] Sixthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the container website protection deployment method described in any of the above claims.

[0022] The container website protection deployment method, apparatus, device, and storage medium of this application embodiment are applied to a cluster server and a policy server. The cluster server loads a preset target process image file, starts the target container corresponding to the target process image file, and generates a target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol port of the policy server and at least one target policy code. The target process object sends a connection request to the policy server according to the Internet Protocol port. The connection request includes at least one target policy code. In response to the connection request, the policy server sends a target protection policy corresponding to at least one target policy code to the target process object. The policy server includes at least one policy code and the protection policy corresponding to each policy code. The target process object deploys at least one target protection policy in the kernel of the cluster server. Thus, in this application embodiment, after the target container starts, the policy server sends the target protection policy corresponding to at least one target policy code in the connection request to the target process object of the target container and deploys at least one target protection policy in the kernel of the cluster server. Operation and maintenance personnel do not need to pay attention to the container's running status or manage the policy for restarting the container, which not only reduces the workload of operation and maintenance personnel but also reduces the risk of misoperation, thereby achieving security protection for the website. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a framework diagram of the container website protection deployment system provided in the embodiments of this application;

[0025] Figure 2 This is a flowchart illustrating the container website protection deployment method provided in this application embodiment;

[0026] Figure 3 This is a system architecture diagram of an application scenario of the container website protection deployment method provided in this application embodiment;

[0027] Figure 4 This is a flowchart of the operation of the policy server security officer provided in the embodiments of this application;

[0028] Figure 5 This is a flowchart of the operation process for cluster server maintenance personnel provided in the embodiments of this application;

[0029] Figure 6 This is a diagram illustrating the working mechanism of process objects and cluster servers provided in the embodiments of this application;

[0030] Figure 7 This is a schematic diagram of the structure of a container website protection deployment device provided in an embodiment of this application;

[0031] Figure 8 This is a schematic diagram of another container website protection deployment device provided in an embodiment of this application;

[0032] Figure 9 This is a schematic diagram of the container website protection deployment device provided in the embodiments of this application. Detailed Implementation

[0033] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0034] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0035] In a cloud-native environment, websites primarily run on clusters managed by Kubernetes (K8S), existing as containers. K8S provides unified orchestration for managing the start and stop of these containers. When a container dies or runs out of resources, K8S can restart a new container to take over the work of the original website container. Due to the open and interactive nature of websites, website tampering can lead to malicious content dissemination and virus propagation, thus requiring website security protection. However, K8S is not compatible with existing Docker container-based website anti-tampering software. If a container dies and K8S restarts a new container, the new container ID is randomly generated, causing the policy server to be unable to issue policies based on the container ID. Operations personnel need to regularly monitor the container's running status to manage restarted containers, which not only increases their workload significantly but also increases the risk of accidental container operations, potentially causing irreparable damage.

[0036] To address the problems in the prior art, this application provides a container website protection deployment method, apparatus, device, and storage medium.

[0037] The container website protection deployment system provided in this application embodiment will be introduced below.

[0038] Figure 1 A framework diagram of a container website protection deployment system applicable to one embodiment of this application is shown.

[0039] like Figure 1 As shown, the container website protection deployment system 100 may include a cluster server 110 and a policy server 120. In this embodiment, the cluster server 110 can be connected to the policy server 120 via a local area network to form a client-server (C / S) structure. Of course, the connection method is not limited to a local area network and can also be other connection methods, which are not specifically limited here.

[0040] The aforementioned cluster server 110 can be a host cluster managed by Kubernetes (K8S). Through unified orchestration by K8S, the start and stop of containers can be managed. When a container dies or resources are insufficient, K8S can also restart a new container to take over the work of the original website container.

[0041] The aforementioned policy server 120 can be an anti-tampering server, and may include at least one protection policy. This protection policy can instruct the container's process object to protect files in the target folder. For example, the protection policy could be / www / html / *, with the permission "prohibit deletion." After the process object receives the protection policy from the server via the network, it injects the policy into the kernel. When a deletion operation is performed on the index.html file under / www / html / , the kernel's interception mechanism will be triggered, directly filtering out the operation. In this embodiment, the protection policy is not limited to this; it can be configured according to user needs, and no specific limitations are made here.

[0042] The container website protection deployment method provided in the embodiments of this application is described below.

[0043] Figure 2 A flowchart illustrating a container website protection deployment method according to an embodiment of this application is shown. Optionally, the method 200 of this application embodiment can be applied to the above... Figure 1 The container website protection deployment system shown.

[0044] like Figure 2 As shown, a container website protection deployment method may include the following steps S201 to S206.

[0045] S201. The cluster server loads the preset target process image file, starts the target container corresponding to the target process image file, and generates the target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet protocol port of the policy server and at least one target policy code.

[0046] S202. The cluster server target process object sends a connection request to the policy server according to the Internet Protocol port. The connection request includes at least one target policy code.

[0047] S203. The policy server receives a connection request sent by the target process object of the target container in the cluster server.

[0048] S204. In response to the connection request, the policy server sends the target protection policy corresponding to at least one target policy code to the target process object. The policy server includes at least one policy code and the protection policy corresponding to each policy code.

[0049] S205. Cluster server target process object receiving policy server sends at least one target protection policy;

[0050] S206. The target process object of the cluster server deploys at least one target protection policy in the kernel of the cluster server.

[0051] The container website protection deployment method of this application embodiment is applied to a cluster server and a policy server. The cluster server loads a preset target process image file, starts the target container corresponding to the target process image file, and generates a target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol port of the policy server and at least one target policy code. The target process object sends a connection request to the policy server according to the Internet Protocol port. The connection request includes at least one target policy code. In response to the connection request, the policy server sends the target protection policy corresponding to the at least one target policy code to the target process object. The policy server includes at least one policy code and the protection policy corresponding to each policy code. The target process object deploys at least one target protection policy in the kernel of the cluster server. Thus, in this application embodiment, after the target container starts, the policy server sends the target protection policy corresponding to at least one target policy code in the connection request to the target process object of the target container, and deploys at least one target protection policy in the kernel of the cluster server. The operation and maintenance personnel do not need to pay attention to the container running status, nor do they need to manage the policy for restarting the container. This not only reduces the workload of the operation and maintenance personnel, but also reduces the risk of misoperation, thereby achieving security protection for the website.

[0052] In S201, in a cloud-native environment, the website runs on a cluster of hosts managed by Kubernetes, existing as at least one container. Each container corresponds to a different function of the website. When one of the website's containers dies or lacks sufficient resources, Kubernetes can start a new container to take over the work of the original container.

[0053] The aforementioned target process image file can be the process image file of the target container, which is a new container started in the cluster server. Loading the process image file can start the corresponding container and generate the container's process object.

[0054] The aforementioned process object, for example, could be a website anti-tampering software agent, which can block tampering instructions upon monitoring them, thereby preventing the container from being tampered with.

[0055] The aforementioned startup configuration file includes the Internet Protocol port of the policy server and at least one target policy code. For example, it can be an AgentDeployment.yaml file, which includes client environment variables such as the policy server IP port and the ID of each policy code.

[0056] The aforementioned cluster server loads a preset target process image file, starts the target container corresponding to the target process image file, and generates the target process object of the target container. For example, the cluster server may respond to a loading request entered by the operation and maintenance personnel in the K8S management system, load a preset target process image file, start the target Docker container corresponding to the target process image file, and generate the target process object Agent of the target Docker container.

[0057] In S202, the connection request may include at least one target policy code, wherein the target policy code is a policy code configured in the target startup configuration file.

[0058] The aforementioned cluster server target process object sends a connection request to the policy server based on the Internet Protocol port. For example, the cluster server target process object may send a connection request to the policy server based on the local area network and the Internet Protocol port.

[0059] In S203, the policy server receives a connection request sent by the target process object of the target container in the cluster server. For example, the policy server may receive the connection request sent by the target process object of the target container in the cluster server based on the local area network.

[0060] In S204, the aforementioned policy server may include at least one policy code and corresponding protection policies for each policy code. Specifically, the policy server may include at least one policy template and a policy ID (i.e., policy code) for each policy template. Each policy template is bound to a corresponding protection policy. The protection policy indicates the target file or target folder in the container that needs to be protected. For example, if the target folder is / www / html / *, the protection policy will protect all files under the / www / html / folder. This application is not limited to this; users can add various protection policies according to specific circumstances, and no specific limitations are made here.

[0061] In response to a connection request, the policy server sends the target protection policy corresponding to at least one target policy code to the target process object. For example, the policy server may send the target protection policy corresponding to at least one target policy code to the target process object based on the local area network in response to the connection request.

[0062] In S205, the cluster server target process object receives at least one target protection policy sent by the policy server. For example, the cluster server target process object may receive at least one target protection policy sent by the policy server based on the local area network.

[0063] In some embodiments, to improve the security of information interaction between the policy server and the process object, the connection request may further include a connection key, and S204 may specifically include:

[0064] In response to a connection request, the policy server establishes a connection with the target process object if the connection key meets the preset rules.

[0065] Send the target protection policy corresponding to at least one target policy code to the target process object;

[0066] Specifically, S205 mentioned above may include:

[0067] When the connection key meets the preset rules, the cluster server establishes a connection between the target process object and the policy server.

[0068] The target process object receives at least one target protection policy sent by the policy server.

[0069] The connection key mentioned above can be used by the policy server to verify whether a connection request is legitimate.

[0070] The aforementioned preset rules, for example, can be common symmetric key algorithms, asymmetric key algorithms, and digest algorithms. This application is not limited to these and can also use other verification methods, which are not specifically limited here.

[0071] In some embodiments, the above method may further include:

[0072] When a connection request is received, the policy server discards the connection request and generates an alarm message if the connection key does not meet the preset rules.

[0073] The above alarm information can be used to alert users that the policy server has an illegal connection request.

[0074] In this embodiment, a connection between the policy server and the target process object is established only when the connection key meets the preset rules, and the target protection policy corresponding to at least one target policy code is sent to the target process object, thereby improving the security of information interaction between the policy server and the process object.

[0075] In S206, the aforementioned cluster server target process object deploys at least one target protection policy in the kernel of the cluster server. This can be done by the cluster server target process object directly deploying at least one target protection policy in the kernel of the cluster server, or by the target process object deploying a target process kernel module in the kernel of the cluster server and inputting at least one target protection policy into the target process kernel module. The target process kernel module is used to intercept and alert on the first behavior. The target process object deploys a target process user module in the target container. The target process user module is used to filter the second behavior.

[0076] In some embodiments, the target process object may specifically include a target process kernel module and a target process user module;

[0077] Specifically, S206 mentioned above may include:

[0078] The target process object deploys the target process kernel module in the kernel of the cluster server and inputs at least one target protection policy into the target process kernel module. The target process kernel module is used to intercept and alert on the first behavior.

[0079] The target process object deploys the target process user module in the target container, and the target process user module is used to filter the second behavior.

[0080] The first action mentioned above, for example, can be an action such as adding, deleting, modifying or querying website files within the container. The first action in this application is not limited to this, and can also be an action set according to user needs, which is not specifically limited here.

[0081] The aforementioned second action can be a specific operation on the container website file, such as rm, touch, vim, cp, etc. The second action in this application is not limited to this, and can also be actions set according to user needs, which are not specifically limited here.

[0082] The first and second actions mentioned above may be the same or different.

[0083] In this embodiment, by deploying the target process kernel module on the cluster server kernel to intercept and alert on the first behavior, and deploying the target process user module in the target container to filter the second behavior, the target process user module can filter the second behavior, reducing the burden of kernel interception and thus improving the stability of the cluster server operating system. On the other hand, if the target process user module is closed or bypassed, the target process kernel module deployed on the cluster server kernel can still intercept and alert on the first behavior, thereby improving the reliability of the cluster server operating system.

[0084] As one implementation of this application, to improve the flexibility of container website protection, before S203 above, it may also include:

[0085] The policy server obtains at least one protection policy, which is used to protect the target behavior of target files in the container.

[0086] The policy server encodes at least one protection policy to obtain the policy code for each protection policy;

[0087] The policy server sends each policy code to the cluster server.

[0088] The above protection strategy can be used to protect target files in a container from target behaviors. For example, the target file can be a file containing index.html under / www / html / *, and the target behavior can be CRUD operations such as adding, deleting, modifying, and / or querying.

[0089] The policy server obtains at least one protection policy. For example, the user can input the protection policy in a policy template preset by the policy server, and only one protection policy can be input in a policy template.

[0090] The above strategy encoding can be a string composed of characters such as letters, numbers, or symbols, used to represent the unique identification code of each protection strategy.

[0091] In this embodiment, at least one protection policy and a policy code for each protection policy are set in the policy server. The protection policy can be set according to different user needs, thus improving the flexibility of container website protection.

[0092] As another implementation of this application, in order to reduce the workload of maintenance personnel and decrease their error rate, the following may be included before S201:

[0093] The cluster server obtains the process objects of each container;

[0094] The cluster server receives the policy codes sent by the policy server;

[0095] The cluster server builds process image files for each container based on the process objects of each container;

[0096] The cluster server configures startup configuration files for each container. The startup configuration files include the Internet Protocol port of the policy server and at least one policy code.

[0097] The aforementioned cluster server constructs process image files for each container based on the process objects of each container. For example, the process objects of each container can be combined with the base image file to obtain the process image files for each container.

[0098] In a cloud-native environment, each container of a website corresponds to a different function of the website, so the protection strategies for each container will also be different. Therefore, it is necessary to configure the corresponding startup configuration file for each container.

[0099] The aforementioned Internet Protocol (IP) port is the IP port of the policy server, used to establish a connection between the process object and the policy server.

[0100] The cluster server configures startup configuration files for each container. For example, this can be done in response to the operations and maintenance personnel's writing operations in the K8S management system.

[0101] In this embodiment, since each container of the website corresponds to a different function of the website, it is necessary to configure a startup configuration file for each container so that when a container restarts or drifts, the process object of the container can send at least one policy code to the policy server according to the Internet protocol port in the startup configuration file, so that the policy server can download the corresponding policy to the container, thereby reducing the workload of operation and maintenance personnel and reducing the risk of operation and maintenance personnel making mistakes.

[0102] To facilitate understanding of the container website protection deployment method in this application embodiment, the actual application process of this container website protection deployment method is described as follows:

[0103] This application provides a container website protection deployment method, specifically implemented on a host cluster and policy server managed by Kubernetes (K8S). The K8S management system (hereinafter referred to as "KEM") is mainly responsible for the orchestration of Docker containers and the maintenance of container files (Dockerfiles). KEM is maintained by host operations personnel (hereinafter referred to as "operations personnel"). The specific technical solution is as follows:

[0104] In this embodiment, the host cluster and policy server are composed of a client / server architecture, such as... Figure 3 As shown, the policy server is maintained by security operations personnel (hereinafter referred to as "security officers"), who are responsible for logging into the server to edit policies, monitor logs, and maintain system configurations. The Agent (i.e., the process object mentioned above) is maintained by host operations personnel (hereinafter referred to as "operations personnel"), who are responsible for building Docker images, configuring Dockerfiles, and using KEM.

[0105] The specific operating procedure is as follows:

[0106] Step 1: As Figure 4 As shown, the security officer configures the server on the management page.

[0107] (1) The security officer logs into the server management page to create a policy template and generate a policy ID.

[0108] (2) The security officer binds the protection policy to the policy template. The policy is the target file in the container that needs to be protected. For example, / www / html / *, this policy will protect all target files under the / www / html / folder. The security officer can add various policies according to specific circumstances, and the policies are combined into a union.

[0109] (3) The security officer delivers the policy ID and Agent client software to the operations and maintenance personnel.

[0110] Step Two: As Figure 5 As shown, the operations and maintenance personnel build the Agent software together with the base image to generate the Agent image file (i.e., the process image file mentioned above).

[0111] The operations and maintenance personnel build the Agent client software together with the base image using the following commands:

[0112] Dockerfile:

[0113] #Use FrontBCLinux as the base image

[0114] FROMFrontBCLinux

[0115] #Set working directory

[0116] WORKDIR / app

[0117] # Copy the TieJuan software to the working directory

[0118] COPYTieJuan / app

[0119] #Run TieJuan software

[0120] CMD[". / TieJuan"]

[0121] Build command:

[0122] dockerbuild-tTieJuan:latest

[0123] Step 3: The operations and maintenance personnel enable variables in the KEM Agent configuration image file.

[0124] (1) Operation and maintenance personnel log in to KEM, write the AgentDeployment.yaml file (i.e. the above startup configuration file), and add client environment variables, such as server IP port and related policy ID.

[0125] (2) Operation and maintenance personnel load the Agent image file through KEM, start the Docker container and generate the Agent.

[0126] Step Four: As Figure 6 As shown, the Docker container actively connects to the server based on the server IP and port specified in the AgentDeployment.yaml file, and the Agent sends the policy ID to the server. Upon receiving the Docker container's connection request, the server checks if the key is valid. If it is, the server adds the Docker container to the policy template based on the policy ID and distributes the corresponding policy to the Agent. If the connection is invalid, an alert is issued and the connection is dropped.

[0127] (1) After the Docker container starts, the Agent attempts to connect to the server based on the server IP and port specified in the yaml file and sends the policy ID that was just configured to the server.

[0128] (2) After receiving a connection request (including key and policy ID) from a Docker container, the server determines its validity, adds the valid connection to the policy template corresponding to the policy ID, and simultaneously sends the policy corresponding to the policy template to the Agent. Invalid connections are discarded directly, and an alarm is generated.

[0129] (3) After receiving the policy, the Agent injects the Agent kernel module into the kernel and synchronizes the policy to the kernel module. Simultaneously, the Agent deploys the user module using LD_PRELOAD technology. At this point, the server, Agent kernel module, and Agent user module are deployed, the policy is enabled, and the Agent kernel module and Agent user module await triggering by an abnormal event.

[0130] Step 5: After receiving the policy, the Agent injects the Agent kernel module into the kernel and synchronizes the policy to the kernel. The Agent kernel module is mainly responsible for intercepting alerts for actions such as adding, deleting, modifying, and querying website files within the container, and notifying the Agent to issue alerts. At the same time, the Agent deploys the Agent user module in the container to intercept and filter specific operations on container website files, such as rm, touch, vim, cp, etc.

[0131] (1) For example, when a hacker initiates website tampering, such as modifying the / www / html / index.html file using the mv command, the Agent user module will preload the newmv.so module specified by LD_PRELOAD and synchronize the target / www / html / index.html modified by the mv command to newmv.so. The function of newmv.so is to determine whether it is a protected target in the policy before actually executing the mv command. If the protected target is found to be / www / html / *, which contains the index.html file, the operation will be terminated immediately, and an alarm will be generated synchronously and sent to the server.

[0132] (2) If the user module is shut down or bypassed by a hacker, the operation of mv will bypass the above-mentioned LD_PRELOAD technology to realize the function (user module), and directly send the target modified by the mv command to the kernel system call rename function. The mv command is hooked by intercepting the rename function. The rename function has two parameters oldpath and newpath. It determines whether newpath is a protected target in the policy. If the protected target is found to be / www / html / *, which contains the index.html file, an alarm is immediately generated and sent to the Agent. The Agent sends the alarm information to the server.

[0133] Step Six: When a container in the cluster restarts (KEM restarts the container or the container migrates, etc.), KEM will reload the AgentDeployment.yaml configuration file, and the Agent will repeat the process in Step Four. Through the process in Step Four, the container Agent will inherit the protection policy corresponding to the policy ID, preventing security personnel and operations personnel from performing unnecessary configuration operations due to container startup or migration.

[0134] In this embodiment, the Agent is built in a container, and the Agent container startup parameters are configured via Dockerfile. This allows the Agent container to inherit policies with corresponding policy IDs throughout its multiple lifecycles. This approach solves the problem of incompatibility between containers and policies during container startup and migration, reduces the workload of security and operations personnel, and achieves the website security protection goal of website systems using Docker containerization solutions in cloud-native environments.

[0135] Furthermore, this embodiment utilizes Linux kernel interception technology to send alerts for website page file tampering using kernel modules, rather than using kernel interception technology for actual blocking, thus improving system reliability. It also utilizes LD_PRELOAD technology to use user modules for intercepting and preventing hacker tampering of website page files, enhancing the feasibility and stability of website anti-tampering. Finally, by leveraging Dockerfile containerization technology through KEM, the container can automatically download protection policies from the server during startup and migration, eliminating the need for manual intervention from security personnel and operations staff. This improves the automation and intelligence of website anti-tampering functions, significantly enhancing their robustness.

[0136] Based on the model simulation and deduction display method provided in the above embodiments, this application also provides a specific implementation of a model simulation and deduction display device. It is understood that the relevant descriptions in the following device embodiments can be referred to the foregoing method embodiments, and for the sake of brevity, will not be repeated. Please refer to the following embodiments.

[0137] Please see Figure 7 This application provides a container website protection deployment device 700, which is applied to a cluster server and connected to a policy server. The device 700 may include: a loading module 701, a first sending module 702, a first receiving module 703, and a deployment module 704.

[0138] The loading module 701 is used to load a preset target process image file into the cluster server, start the target container corresponding to the target process image file, and generate the target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet protocol port of the policy server and at least one target policy code.

[0139] The first sending module 702 is used to send a connection request from the target process object to the policy server according to the Internet Protocol port. The connection request includes at least one target policy code, so that the policy server responds to the connection request and sends the target protection policy corresponding to the at least one target policy code to the target process object. The policy server includes at least one policy code and the protection policy corresponding to each policy code.

[0140] The first receiving module 703 is used to receive at least one target protection policy sent by the policy server from the target process object.

[0141] Deployment module 704 is used by the target process object to deploy at least one target protection policy in the kernel of the cluster server.

[0142] The container website protection deployment device of this application embodiment is applied to a cluster server and a policy server. The cluster server loads a preset target process image file, starts the target container corresponding to the target process image file, and generates a target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol port of the policy server and at least one target policy code. The target process object sends a connection request to the policy server according to the Internet Protocol port. The connection request includes at least one target policy code. In response to the connection request, the policy server sends the target protection policy corresponding to the at least one target policy code to the target process object. The policy server includes at least one policy code and the protection policy corresponding to each policy code. The target process object deploys at least one target protection policy in the kernel of the cluster server. Thus, in this application embodiment, after the target container starts, the policy server sends the target protection policy corresponding to at least one target policy code in the connection request to the target process object of the target container, and deploys at least one target protection policy in the kernel of the cluster server. The operation and maintenance personnel do not need to pay attention to the container's running status, nor do they need to manage the policy for restarting the container. This not only reduces the workload of the operation and maintenance personnel, but also reduces the risk of misoperation, thereby achieving security protection for the website.

[0143] As another implementation of this application, in order to reduce the workload of maintenance personnel and decrease their error rate, the aforementioned device 700 may further include:

[0144] The first acquisition module is used by the cluster server to obtain the process objects of each container;

[0145] The third receiving module is used to receive the policy codes sent by the policy server;

[0146] The build module is used to build process image files for each container based on the process objects of each container;

[0147] The configuration module is used to configure the startup configuration file for each container. The startup configuration file includes the Internet Protocol port of the policy server and at least one policy code.

[0148] In some embodiments, to improve the security of information interaction between the policy server and the process object, the connection request may also include a connection key;

[0149] The aforementioned first receiving module 703 may specifically include:

[0150] The second connection unit is used to establish a connection between the target process object and the policy server when the connection key meets the preset rules.

[0151] The receiving unit is used to receive at least one target protection policy sent by the policy server from the target process object.

[0152] In some embodiments, the target process object may include a target process kernel module and a target process user module; the deployment module 704 may specifically include:

[0153] The first deployment unit is used to deploy the target process kernel module on the kernel of the cluster server and input at least one target protection policy into the target process kernel module. The target process kernel module is used to intercept and alarm the first behavior.

[0154] The second deployment unit is used to deploy the target process user module in the target container, and the target process user module is used to filter the second behavior.

[0155] Please see Figure 8 This application provides a container website protection deployment device 800, which is applied to a policy server and connected to a cluster server. The device 800 may include a second receiving module 801 and a second sending module 802.

[0156] The second receiving module 801 is used to receive a connection request sent by a target process object of a target container in a cluster server. The connection request includes at least one target policy code. The connection request is for the cluster server to load a preset target process image file, start the target container corresponding to the target process image file, and generate a target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol port of the policy server and at least one target policy code. The target process object sends a request to the policy server according to the Internet Protocol port.

[0157] The second sending module 802 is used to send a target protection policy corresponding to at least one target policy code to the target process object in response to a connection request. The policy server includes at least one policy code and a protection policy corresponding to each policy code, so that the target process object can deploy at least one target protection policy in the kernel of the cluster server.

[0158] The container website protection deployment device of this application embodiment is applied to a cluster server and a policy server. The cluster server loads a preset target process image file, starts the target container corresponding to the target process image file, and generates a target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol port of the policy server and at least one target policy code. The target process object sends a connection request to the policy server according to the Internet Protocol port. The connection request includes at least one target policy code. In response to the connection request, the policy server sends the target protection policy corresponding to the at least one target policy code to the target process object. The policy server includes at least one policy code and the protection policy corresponding to each policy code. The target process object deploys at least one target protection policy in the kernel of the cluster server. Thus, in this application embodiment, after the target container starts, the policy server sends the target protection policy corresponding to at least one target policy code in the connection request to the target process object of the target container, and deploys at least one target protection policy in the kernel of the cluster server. The operation and maintenance personnel do not need to pay attention to the container's running status, nor do they need to manage the policy for restarting the container. This not only reduces the workload of the operation and maintenance personnel, but also reduces the risk of misoperation, thereby achieving security protection for the website.

[0159] As one implementation of this application, to improve the flexibility of container website protection, the aforementioned device 800 may further include:

[0160] The second acquisition module is used to acquire at least one protection policy, which is used to protect the target file in the container from target behavior.

[0161] The encoding module is used to encode at least one protection policy to obtain the policy code for each protection policy;

[0162] The third sending module is used to send the policy codes to the cluster server.

[0163] In some embodiments, to improve the security of information interaction between the policy server and the process object, the connection request may further include a connection key; the second sending module 802 may specifically include:

[0164] The first establishment unit is used to establish a connection with the target process object in response to a connection request, provided that the connection key meets the preset rules.

[0165] The sending unit is used to send the target protection policy corresponding to at least one target policy encoding to the target process object.

[0166] Figure 9 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0167] An electronic device may include a processor 901 and a memory 902 storing computer program instructions.

[0168] Specifically, the processor 901 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0169] Memory 902 may include mass storage for data or instructions. For example, and not limitingly, memory 902 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 902 may include removable or non-removable (or fixed) media. Where appropriate, memory 902 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 902 is non-volatile solid-state memory.

[0170] In a particular embodiment, memory 902 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Thus, generally, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0171] The processor 901 reads and executes computer program instructions stored in the memory 902 to implement any of the container website protection deployment methods in the above embodiments.

[0172] In one example, the electronic device may also include a communication interface 903 and a bus 910. Wherein, as... Figure 9 As shown, the processor 901, memory 902, and communication interface 903 are connected through bus 910 and complete communication with each other.

[0173] The communication interface 903 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0174] Bus 910 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 910 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0175] The electronic device can execute the container website protection deployment method in the embodiments of this application, thereby achieving a combination of Figure 2 , 7 and Figure 8 The container website protection deployment method and apparatus are described.

[0176] Furthermore, in conjunction with the container website protection deployment method in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the container website protection deployment methods in the above embodiments.

[0177] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0178] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0179] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0180] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0181] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for deploying container website protection, characterized in that, Applied to a cluster server, wherein the cluster server is connected to a policy server, the method includes: The cluster server loads a preset target process image file, starts the target container corresponding to the target process image file, and generates a target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol port of the policy server and at least one target policy code. The target process object sends a connection request to the policy server according to the Internet protocol port. The connection request includes at least one target policy code, so that the policy server responds to the connection request and sends a target protection policy corresponding to the at least one target policy code to the target process object. The policy server includes at least one policy code and a protection policy corresponding to each policy code. The protection policy is used to protect the target file in the target container from target behavior. The connection request also includes a connection key; If the connection key meets the preset rules, the target process object establishes a connection with the policy server; The target process object receives at least one target protection policy sent by the policy server. The policy code is a string composed of characters such as letters, numbers, or symbols, used to represent the unique identification code of each protection policy. The target process object deploys at least one of the target protection policies in the kernel of the cluster server, wherein the target process object includes a target process kernel module and a target process user module; The target process object deploys at least one of the target protection policies in the kernel of the cluster server, including: The target process object deploys the target process kernel module in the kernel of the cluster server and inputs at least one of the target protection policies into the target process kernel module. The target process kernel module is used to intercept and alert on the first behavior. The target process object deploys the target process user module in the target container, and the target process user module is used to filter the second behavior.

2. The method of claim 1, wherein, Before the cluster server loads the preset target process image file, starts the target container corresponding to the target process image file, and generates the target process object of the target container, the process further includes: The cluster server obtains the process objects of each container; Receive the policy codes sent by the policy server; Based on the process objects of each container, construct the process image file of each container; Configure a startup configuration file for each of the containers, the startup configuration file including the Internet Protocol port of the policy server and at least one of the policy codes.

3. A method for a container website protection deployment, the method comprising: Applied to a policy server, which is connected to a cluster server, the method includes: The system receives a connection request sent by a target process object of a target container in the cluster server. The connection request includes at least one target policy code. The connection request involves the cluster server loading a preset target process image file, starting the target container corresponding to the target process image file, and generating a target process object for the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol (IP) port of the policy server and the at least one target policy code. The policy code is a string composed of letters, numbers, or symbols, used to uniquely identify each protection policy. The target process object sends a request to the policy server based on the IP port. The connection request also includes a connection key. In response to the connection request, if the connection key satisfies preset rules, a connection is established with the target process object. A target protection policy corresponding to the at least one target policy code is sent to the target process object. The policy server includes at least one policy code and corresponding protection policies for each policy code. The protection policies are used to protect target files in the target container from target behavior, so that the target process object deploys at least one target protection policy in the kernel of the cluster server.

4. The method of claim 3, wherein, Before receiving the connection request sent by the target process object of the target container in the cluster server, the method further includes: Obtain at least one protection strategy; Encode the at least one protection strategy to obtain the strategy code for each protection strategy; Each of the aforementioned strategies is encoded and sent to the cluster server.

5. A container website protection deployment apparatus characterized by comprising: The device is applied to a cluster server, which is connected to a policy server, and includes: The loading module is used to load a preset target process image file into the cluster server, start the target container corresponding to the target process image file, and generate a target process object of the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol port of the policy server and at least one target policy code. The first sending module is used for the target process object to send a connection request to the policy server according to the Internet Protocol port. The connection request includes at least one target policy code, so that the policy server responds to the connection request and sends a target protection policy corresponding to the at least one target policy code to the target process object. The policy server includes at least one policy code and protection policies corresponding to each policy code. The connection request also includes a connection key. The first receiving module is configured to, when the connection key satisfies a preset rule, establish a connection between the target process object and the policy server; the target process object receives at least one target protection policy sent by the policy server; A deployment module is used for the target process object to deploy at least one of the target protection policies in the kernel of the cluster server, wherein the target process object includes a target process kernel module and a target process user module; The deployment module is further configured to have the target process object deploy the target process kernel module in the kernel of the cluster server and input at least one of the target protection policies into the target process kernel module, wherein the target process kernel module is used to intercept and alert on the first behavior; and the target process object to deploy the target process user module in the target container, wherein the target process user module is used to filter the second behavior.

6. A container website protection deployment apparatus characterized by comprising: The device is applied to a policy server, which is connected to a cluster server, and includes: The second receiving module is used to receive a connection request sent by a target process object of a target container in the cluster server. The connection request includes at least one target policy code. The connection request involves the cluster server loading a preset target process image file, starting the target container corresponding to the target process image file, and generating a target process object for the target container. The target container is configured with a target startup configuration file, which includes the Internet Protocol (IP) port of the policy server and the at least one target policy code. The target process object sends a request to the policy server based on the IP port. The connection request also includes a connection key. The second sending module is used to respond to the connection request and, if the connection key meets the preset rules, establish a connection with the target process object; and send the target protection policy corresponding to the at least one target policy code to the target process object. The policy server includes at least one policy code and protection policies corresponding to each policy code, so that the target process object deploys at least one target protection policy in the kernel of the cluster server.

7. An electronic device, comprising: The device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the container website protection deployment method as described in any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the container website protection deployment method as described in any one of claims 1-4.

Images