Network traffic detection and control method and system based on CNI network plugin

Abstract

The application discloses a network flow detection and management method and system based on a CNI network plug-in. The method comprises the following steps: modifying a default transmission path of to-be-detected flow of a service container; sending the to-be-detected flow to a detection container pre-deployed by the CNI network plug-in based on the modified transmission path; the service container is a protected container of the detection container; performing legitimacy detection on the to-be-detected flow by the detection container, intercepting illegal flow and sending legal flow to the service container; and the service container continues to process the legal flow. The detection container realizes flow detection and flow management for east-west flow, legal flow is returned to the service container from the detection container, and illegal flow is intercepted by the detection container and is not sent back to the service container, so that the original service system is not affected.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and system for network traffic detection and control based on a CNI network plugin. Background Technology

[0002] With the development of network technology, containers are increasingly being used to support the rapid deployment of business operations. However, malicious or attack traffic within containers can lead to hacking or data hijacking. Therefore, the detection and control of traffic within container clusters is of paramount importance.

[0003] In related technologies, traffic detection and control require the construction of corresponding security systems or a certain degree of modification to the business systems during the construction of the business systems. Summary of the Invention

[0004] To address the aforementioned issues, this application provides a method and system for network traffic detection and control based on a CNI network plugin, which eliminates the need for building a security system or improving the business system.

[0005] The embodiments of this application disclose the following technical solutions:

[0006] In a first aspect, embodiments of this application provide a method for network traffic detection and control based on a CNI network plugin. The method is implemented using a CNI network plugin and includes:

[0007] Modify the default transmission path of the traffic to be detected in the business container;

[0008] Based on the modified transmission path, the traffic to be detected is sent to the detection container pre-deployed by the CNI network plugin; the service container is the protected container of the detection container.

[0009] The detection container performs legality checks on the traffic to be detected, intercepts illegal traffic, and sends legitimate traffic to the service container.

[0010] The legitimate traffic is then processed by the service container.

[0011] Optionally, modifying the default transmission path of the traffic to be detected for the service container includes:

[0012] The traffic initiated by the service container is taken as the traffic to be detected. The route is modified for the traffic initiated by the service container so that the traffic is sent to the detection container through the modified route.

[0013] Sending legitimate traffic to the service container through the detection container includes:

[0014] The detection container sets a policy route for the service container and sends the legitimate traffic back to the service container through the policy route.

[0015] The further processing of the legitimate traffic by the service container includes:

[0016] The legitimate traffic is forwarded to the business network by the business container through the original route before modification.

[0017] Optionally, modifying the default transmission path of the traffic to be detected for the service container includes:

[0018] Traffic sent from the business network to the business container is taken as the traffic to be detected. For the traffic sent from the business network to the business container, the destination address is converted to the IP of the virtual interface of the detection container.

[0019] Sending legitimate traffic to the service container through the detection container includes:

[0020] The detection container converts the destination address of the legitimate traffic into the IP address of the network interface of the service container, and sends the legitimate traffic to the service container.

[0021] Optionally, the CNI network plugin deploys the detection container, including:

[0022] The CNI network plugin responds to the user's selection of the container deployment method by determining the target deployment method from single-machine deployment and cluster deployment methods;

[0023] If the target deployment method is a single-machine deployment method, then the detection container is deployed on the physical node where the service container is located, and the detection container is used to protect each service container on the physical node;

[0024] If the target deployment method is a cluster deployment method, then a detection container cluster is deployed, and the connected business containers are protected by the detection container cluster; the detection container cluster includes multiple detection containers.

[0025] Optionally, the target deployment method is a single-machine deployment method, and the method further includes:

[0026] A pair of interconnected veth virtual network interface cards are created for the service container and the detection container, wherein the first veth virtual network interface card is set on the service container as the virtual interface of the service container, and the second veth virtual network interface card is set on the detection container as the virtual interface of the detection container.

[0027] Add a first DNAT strategy to the business container and a second DNAT strategy to the detection container;

[0028] The first DNAT policy is a destination address translation policy for network interface IP addresses of the service network and the service container as destination addresses; the second DNAT policy is a destination address translation policy for IP addresses of the first veth virtual network interface and the second veth virtual network interface as destination addresses.

[0029] Optionally, the target deployment method is a cluster deployment method, and the method further includes:

[0030] The CNI network plugin establishes a tunnel between the service container and the cluster service with the detection container cluster.

[0031] The traffic flowing through the tunnel is encapsulated in UDP packets.

[0032] For traffic originating from the business container, the cluster service sends the traffic to the detection container within the detection container cluster based on a load balancing strategy.

[0033] Optionally, the method further includes:

[0034] The detection container listens for the L3miss event;

[0035] If an L3miss event is detected, set the corresponding MAC address for the IP of the service container at the other end of the tunnel;

[0036] Sending legitimate traffic to the service container through the detection container includes:

[0037] Traffic is sent to the MAC address through the detection container;

[0038] The traffic is encapsulated into UDP packets, and based on the mapping between MAC addresses and the IP addresses of the service containers, the UDP packets are sent to the IP addresses of the service containers.

[0039] Optionally, the method further includes:

[0040] Set a timeout limit for the service container;

[0041] If the time interval between the detection container receiving the latest traffic sent by the service container exceeds the timeout limit, the settings information for the service container will be cleared on the detection container.

[0042] Optionally, the detection container uses proxy technology; the method further includes:

[0043] In the detection container, an fwmark tag value is added to the traffic sent by the service container based on the IP address of the service container;

[0044] The fwmark tag value is synchronized to the session between the detection container and the service container so that the transparent agent running in the detection container can obtain the fwmark tag value;

[0045] The transparent proxy program writes the fwmark value into a new session created with the server;

[0046] Sending legitimate traffic to the service container through the detection container includes:

[0047] The transparent proxy program routes according to the fwmark flag value matching strategy and sends legitimate traffic to the service container through the detection container.

[0048] Optionally, it also includes:

[0049] When the destination address of the session received by the transparent proxy is the IP of the virtual interface of the detection container, the destination address for connecting to the server is converted to the IP of the network interface of the business container.

[0050] Secondly, embodiments of this application provide a network traffic detection and control system based on a CNI network plugin, comprising: a service container and a detection container; the service container is a protected container of the detection container; the detection container is pre-deployed by the CNI network plugin;

[0051] The service container is used to modify the default transmission path of the traffic to be detected; based on the modified transmission path, the traffic to be detected is sent to the detection container.

[0052] The detection container is used to perform legality detection on the traffic to be detected, intercept illegal traffic, and send legal traffic to the service container;

[0053] The service container is also used to continue processing the legitimate traffic.

[0054] Optionally, the service container is specifically used for:

[0055] The traffic initiated by the service container is taken as the traffic to be detected. The route is modified for the traffic initiated by the service container so that the traffic is sent to the detection container through the modified route.

[0056] The detection container sets a policy route for the service container and sends the legitimate traffic back to the service container through the policy route.

[0057] The legitimate traffic is forwarded to the business network by the business container through the original route before modification.

[0058] Optionally, the service container is specifically used for:

[0059] Traffic sent from the business network to the business container is taken as the traffic to be detected. For the traffic sent from the business network to the business container, the destination address is converted to the IP of the virtual interface of the detection container.

[0060] The detection container converts the destination address of the legitimate traffic into the IP address of the network interface of the service container, and sends the legitimate traffic to the service container.

[0061] Optionally, the CNI network plugin is specifically used for:

[0062] In response to the user's selection of the detection container deployment method, the target deployment method is determined from the single-machine deployment method and the cluster deployment method;

[0063] If the target deployment method is a single-machine deployment method, then the detection container is deployed on the physical node where the service container is located, and the detection container is used to protect each service container on the physical node;

[0064] If the target deployment method is a cluster deployment method, then a detection container cluster is deployed, and the connected business containers are protected by the detection container cluster; the detection container cluster includes multiple detection containers.

[0065] Optionally, the CNI network plugin is also used for:

[0066] A pair of interconnected veth virtual network interface cards are created for the service container and the detection container, wherein the first veth virtual network interface card is set on the service container as the virtual interface of the service container, and the second veth virtual network interface card is set on the detection container as the virtual interface of the detection container.

[0067] Add a first DNAT strategy to the business container and a second DNAT strategy to the detection container;

[0068] The first DNAT policy is a destination address translation policy for network interface IP addresses of the service network and the service container as destination addresses; the second DNAT policy is a destination address translation policy for IP addresses of the first veth virtual network interface and the second veth virtual network interface as destination addresses.

[0069] Optionally, the CNI network plugin is also used for:

[0070] Establish a tunnel between the business container and the cluster service of the detection container cluster;

[0071] The traffic flowing through the tunnel is encapsulated in UDP packets.

[0072] For traffic originating from the business container, the cluster service sends the traffic to the detection container within the detection container cluster based on a load balancing strategy.

[0073] Optionally, the detection container is further used for:

[0074] Listen for the L3miss event;

[0075] If an L3miss event is detected, set the corresponding MAC address for the IP of the service container at the other end of the tunnel;

[0076] The CNI network plugin sends traffic to the MAC address through the detection container;

[0077] The traffic is encapsulated into UDP packets, and based on the mapping between MAC addresses and the IP addresses of the service containers, the UDP packets are sent to the IP addresses of the service containers.

[0078] Optionally, the CNI network plugin is also used for:

[0079] Set a timeout limit for the service container;

[0080] If the time interval between the detection container receiving the latest traffic sent by the service container exceeds the timeout limit, the settings information for the service container will be cleared on the detection container.

[0081] The CNI network plugin is also used for:

[0082] In the detection container, an fwmark tag value is added to the traffic sent by the service container based on the IP address of the service container;

[0083] The fwmark tag value is synchronized to the session between the detection container and the service container so that the transparent agent running in the detection container can obtain the fwmark tag value;

[0084] The transparent proxy program writes the fwmark value into a new session created with the server;

[0085] The transparent proxy program routes according to the fwmark flag value matching strategy and sends legitimate traffic to the service container through the detection container.

[0086] The CNI network plugin is also used for:

[0087] When the destination address of the session received by the transparent proxy is the IP of the virtual interface of the detection container, the destination address for connecting to the server is converted to the IP of the network interface of the business container.

[0088] Compared with the prior art, this application has the following beneficial effects:

[0089] This application provides a network traffic detection and control method and system based on a CNI network plugin. First, the default transmission path of the traffic to be detected in the service container is modified. Second, based on the modified transmission path, the traffic to be detected is sent to a detection container pre-deployed in the CNI network plugin; the service container is the protected container of the detection container. Then, the detection container performs legality checks on the traffic to be detected, intercepting illegal traffic and sending legitimate traffic to the service container. Finally, the service container continues to process the legitimate traffic. This application deploys a detection container through a CNI network plugin and modifies the default transmission path of the traffic through the detection container, enabling legitimate traffic to return from the detection container to the service container, while illegal traffic is intercepted by the detection container and not sent back to the service container. This does not affect the original business system, thus eliminating the need to build a security system or modify the business system. Attached Figure Description

[0090] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0091] Figure 1 A flowchart illustrating a network traffic detection and control method based on a CNI network plugin, provided as an embodiment of this application;

[0092] Figure 2 This is a schematic diagram illustrating a single-machine deployment method for a detection container provided in an embodiment of this application;

[0093] Figure 3 This is a schematic diagram illustrating a cluster deployment method for detection containers provided in an embodiment of this application;

[0094] Figure 4 This application provides a schematic diagram of the traffic transmission path corresponding to a single-machine deployment method for a detection container;

[0095] Figure 5This application provides a schematic diagram of the traffic transmission path corresponding to a container cluster deployment method.

[0096] Figure 6 A flowchart illustrating another network traffic detection and control method based on a CNI network plugin provided in this application embodiment;

[0097] Figure 7 A flowchart illustrating yet another network traffic detection and control method based on a CNI network plugin provided in this application embodiment;

[0098] Figure 8 This is a schematic diagram illustrating how an agent program sends data to a business container, as provided in an embodiment of this application.

[0099] Figure 9 A schematic diagram illustrating a proxy program receiving data sent by a service container, provided as an embodiment of this application;

[0100] Figure 10 This is a schematic diagram of a network traffic detection and control system based on a CNI network plugin, provided as an embodiment of this application. Detailed Implementation

[0101] Kubernetes (K8S) is a portable, scalable, open-source platform for managing containerized applications, workloads, and services, facilitating declarative configuration and automation.

[0102] A Pod is the smallest deployable computing unit created and managed in Kubernetes. A Pod consists of one or more containers.

[0103] Containers are a lighter virtualization technology than virtual machines, used to provide a portable and reusable way to package, distribute, and run applications.

[0104] CNI (Container Network Interface) is a Cloud Native Computing Foundation project that includes feature descriptions and libraries for programming Linux container networking, as well as a range of network plugins.

[0105] As described earlier, related technologies directly send north-south traffic to a security gateway for inspection. For east-west traffic, the access logic is modified (e.g., when the order service in the cluster sends a username request to the user service, the access address of the username request is changed to the address of the security gateway), and then the modified east-west traffic is sent to the security gateway for inspection. To achieve traffic control through a security gateway, a corresponding security system needs to be built during the construction of the business system, or the business system needs to be significantly modified.

[0106] To address the aforementioned technical problems, this application provides a network traffic detection and control method and system based on a CNI network plugin. The default transmission path of the traffic to be detected in the service container is modified; based on the modified transmission path, the traffic to be detected is sent to a detection container pre-deployed in the CNI network plugin; the service container is the protected container of the detection container; the detection container performs legality checks on the traffic to be detected, intercepting illegal traffic and sending legitimate traffic to the service container; the service container then further processes the legitimate traffic.

[0107] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0108] When Kubernetes adopts the CNI model as its container networking specification, it possesses the prerequisites for network takeover. In addition, CNI provides a pluggable solution that allocates network resources when a container is created and releases those resources when the container is destroyed.

[0109] Based on the advantages of CNI (Content Provider Interface), such as its flexibility, lightweight nature, ease of implementation, and ability to isolate container technology from physical network technology, this application provides a method for network traffic detection and control based on a CNI network plugin. The corresponding flowchart is shown below. Figure 1 .

[0110] All steps involved in the embodiments of this application are executed in the CNI network plugin. By adding chain plugins on the basis of the original plugin (that is, adding new configurations on the basis of inheriting the original configurations, and the configuration information in the original plugins can be queried in the added chain plugins), the detection and control of east-west and north-south traffic are supported.

[0111] like Figure 1 As shown, the method includes:

[0112] S101: Modify the default transmission path for the traffic to be detected in the business container.

[0113] The traffic to be detected can be traffic initiated by the service container to the outside world, or traffic sent from the service network to the service container. It should be noted that the traffic to be detected in this embodiment can be network traffic, including but not limited to service traffic; that is, all traffic can be considered as traffic to be detected, improving the comprehensiveness of traffic detection and thus enhancing the system's vulnerability defense capabilities.

[0114] In one alternative implementation, when the traffic to be detected is traffic initiated by the business container, the route is modified for the traffic initiated by the business container so that the traffic is sent to the detection container through the modified route.

[0115] In another alternative implementation, when the traffic to be detected is traffic sent from the business network to the business container, the destination address of the traffic sent from the business network to the business container is converted to the IP address of the virtual interface of the detection container.

[0116] By modifying the default transmission path of the traffic to be detected in the service container, the traffic can reach a designated location or device through the modified transmission path for detection. In this embodiment, the detection is performed using a pre-deployed detection container.

[0117] S102: Based on the modified transmission path, the traffic to be detected is sent to the detection container pre-deployed by the CNI network plugin; the service container is the protected container of the detection container.

[0118] As mentioned in S101 above, there are two types of traffic to be detected: one is traffic initiated by the business container to the outside world, and the other is traffic sent from the business network to the business container.

[0119] In one optional implementation, when the traffic to be detected is traffic initiated by the business container, sending the traffic to be detected to the detection container pre-deployed by the CNI network plugin specifically includes: the detection container setting policy routing for the business container and sending the legitimate traffic back to the business container through policy routing.

[0120] In another optional implementation, when the traffic to be detected is traffic sent from the business network to the business container, sending the traffic to be detected to the detection container pre-deployed by the CNI network plugin specifically includes: the detection container converting the destination address of the legitimate traffic into the IP address of the network interface of the business container, and sending the legitimate traffic to the business container.

[0121] Sending the traffic to be detected to the detection container through the modified transmission path can identify abnormal traffic such as malicious and attack traffic, thereby improving data security and preventing hacking or data hijacking.

[0122] In addition, embodiments of this application provide the following two target deployment methods for the detection container:

[0123] (1) Standalone deployment method

[0124] If the target deployment method for the detection container is a standalone deployment, the detection container is deployed on the physical node where the service containers reside. The detection container is used to protect each service container on the physical node. The service containers and the detection container are connected through a pair of veth virtual network interface cards (VNICs). The first VNIC is set on the service container as its virtual interface, and the second VNIC is set on the detection container as its virtual interface. For ease of understanding, this application provides a schematic diagram of a standalone deployment of the detection container, as shown below. Figure 2 As shown.

[0125] Figure 2 This is an example of deploying a detection container on a Kubernetes node. Figure 2 In this system, the detection container is connected to business containers 1, 2, and 3 via the veth virtual network interface. By deploying the detection container, Pod creation and destruction events can be monitored, and policy routing can be dynamically configured for each business container. Destination Network Address Translation (DNAT) policies can be set for the detection container so that traffic that has been detected can be returned to the business container through the veth virtual network interface at the time of sending.

[0126] In addition, a first DNAT policy can be added to the service container, and a second DNAT policy can be added to the detection container. The first DNAT policy is a destination address translation policy for network interface IPs of the service container that come from the service network and are used as destination addresses. The second DNAT policy is a destination address translation policy for network interface IPs of the first veth virtual network interface that come from the second veth virtual network interface that are used as destination addresses.

[0127] (2) Cluster deployment method

[0128] If the target deployment method for the detection containers is a cluster deployment, then a detection container cluster is deployed, which protects the connected service containers; the detection container cluster includes multiple detection containers. For ease of understanding, this application provides a schematic diagram of a cluster deployment of detection containers, as shown below. Figure 3 As shown.

[0129] exist Figure 3 In this process, the CNI network plugin establishes a tunnel (vxlan) between the business container and the cluster service of the detection container cluster. The traffic flowing through the tunnel is encapsulated in UDP packets. For traffic from the business container, the cluster service sends the traffic to the detection container within the detection container cluster based on a load balancing strategy.

[0130] In summary, for single-machine deployment, the detection container and the business container are both on the same physical machine, and data packets are sent between the two containers on the same physical machine, resulting in a shorter process and faster forwarding. For cluster deployment, the detection container and the business container are not on the same physical machine; they are separate and do not compete for resources.

[0131] It should be noted that the two deployment methods for the detection containers mentioned above can be selected or switched according to the user's actual needs.

[0132] S103: The detection container performs legality checks on the traffic to be detected, intercepts illegal traffic, and sends legitimate traffic to the business container.

[0133] S104: The business container continues to process legitimate traffic.

[0134] Based on S101-S104 and two deployment methods for detection containers, embodiments of this application provide a traffic transmission path diagram corresponding to a single-machine deployment method for detection containers and a traffic transmission path diagram corresponding to a cluster deployment method for detection containers, as shown below. Figure 4 and Figure 5 As shown.

[0135] exist Figure 4 and Figure 5 In this system, the default transmission path of the traffic to be inspected is modified via a CNI network plugin. This allows the traffic to be sent to the inspection container for inspection via a veth port or a VXLAN tunnel. Legitimate traffic is returned from the inspection container to the business container, while illegitimate traffic is intercepted by the inspection container and not sent back to the business container. Applications inside and outside the business container are unaware of the existence of the inspection container and it does not affect the original business system. Therefore, there is no need to build a security system or modify the business system.

[0136] When the container is deployed in a cluster, this application provides another method for network traffic detection and control based on the CNI network plugin, the corresponding flowchart of which can be found in [link to flowchart]. Figure 6 .

[0137] like Figure 6 As shown, the method includes:

[0138] S601: Modify the default transmission path for the traffic to be detected in the business container.

[0139] S602: Based on the modified transmission path, the traffic to be detected is sent to the detection container pre-deployed by the CNI network plugin; the service container is the protected container of the detection container.

[0140] S603: Listen for L3miss events in the detection container; if an L3miss event is detected, set the corresponding MAC address for the IP of the service container at the other end of the tunnel.

[0141] The L3miss event is a notification event sent if the MAC address corresponding to the required IP cannot be found.

[0142] S604: The detection container performs legality checks on the traffic to be detected, and sends legitimate traffic to the MAC address through the detection container; the legitimate traffic is encapsulated into UDP packets, and the UDP packets are sent to the IP address of the business container based on the mapping relationship between the MAC address and the IP address of the business container.

[0143] S605: The business container continues to handle legitimate traffic.

[0144] Optionally, the method further includes: setting a timeout limit for the service container; if the time interval between the detection container receiving the latest traffic sent by the service container exceeds the timeout limit, then clearing the setting information for the service container on the detection container. By deleting the setting information in the service container corresponding to the timeout limit, it is beneficial to distribute the traffic load of the service container to the detection container cluster for detection in a more balanced manner.

[0145] It should be understood that traditional security gateways are based on the network protocol stack within the operating system, typically the Linux TCP / IP protocol stack, and the operating system itself cannot be containerized. However, cloud-based security gateway products are deployed as virtual machines, meaning they can only be deployed outside the Kubernetes (K8S) system. This solution's "cluster deployment method" utilizes a VXLAN tunnel to connect to the Linux TCP / IP protocol stack within containers, enabling the application of most security gateway-based detection technologies. The outer protocol of VXLAN is a UDP tunnel, and a UDP service is created through K8S, achieving distributed deployment of security detection. Simultaneously, the detection container cluster deployed using this cluster deployment method is integrated into the K8S system, eliminating the performance bottleneck of a single machine.

[0146] The traffic transmission modes of the business container and the detection container include packet mode and stream mode. Packet mode is for processing and forwarding a single network data packet, with corresponding network technology routing and forwarding. Stream mode is for processing and forwarding a session (data stream), with corresponding network technology being a proxy. The main difference between the two is the presence or absence of a "transport layer or higher proxy". For stream mode, a proxy program can be used in the detection container, which then conducts sessions with both the client and the server. The aforementioned embodiments are applicable to application scenarios where the traffic transmission mode of the business container and the detection container is packet mode. When intervention at the network transport layer to application layer protocol is required, such as enabling SSL Inspection to detect and control encrypted traffic, transparent proxy technology needs to be used in the detection container, which is then called stream mode. To address this, this application provides another network traffic detection and control method based on a CNI network plugin, the corresponding flowchart of which can be found in [link to flowchart]. Figure 7 .

[0147] like Figure 7 As shown, the method includes:

[0148] S701: Modify the default transmission path for the traffic to be detected in the business container.

[0149] S702: Based on the modified transmission path, the traffic to be detected is sent to the detection container pre-deployed by the CNI network plugin; the service container is the protected container of the detection container.

[0150] S703: In the detection container, add an fwmark tag value to the traffic sent by the service container based on the IP of the service container; synchronize the fwmark tag value to the session between the detection container and the service container so that the transparent proxy running in the detection container can obtain the fwmark tag value; the transparent proxy writes the fwmark tag value into a new session created with the server.

[0151] The fwmark (firewallmark) flag is a feature of an iptables policy (a command-line program used to manage Linux firewalls). It can be used to mark filtered packets for quick subsequent lookup or processing based on the flag.

[0152] S704: The detection container performs legality checks on the traffic to be detected. The transparent proxy program matches the policy routing based on the fwmark mark value and sends the legal traffic to the business container through the detection container.

[0153] S703 and S704 are steps that occur within the detection container, where the following steps are performed:

[0154] 1. When the actual destination IP is the IP of the business container, this application embodiment provides a schematic diagram of a proxy program sending data to the business container, such as... Figure 8 As shown.

[0155] ① Configure iptables policies based on the IP of the business container, add fwmark values ​​to the traffic and synchronize the fwmark values ​​to the socket for subsequent policy routing.

[0156] ② Redirect traffic that requires deep inspection to the proxy program.

[0157] ③ The proxy program obtains the actual destination IP and port of the request based on the socket, as well as the fwmark value in the socket, and establishes a server session with the actual destination IP (server IP).

[0158] ④ The proxy program initiates a session with the server IP and writes the fwmark value to the newly established socket.

[0159] ⑤ Based on the fwmark flag value, the matching strategy routing is used, and the agent sends the data to be sent to the server to the business container.

[0160] 2. When the destination address of the session received by the transparent proxy is the IP address of the virtual interface of the detection container (i.e., the traffic is sent by the business container through DNAT), this application embodiment provides a schematic diagram of the proxy receiving data sent by the business container, as shown below. Figure 9 As shown.

[0161] ①DNAT translates the destination address connected to the server into the IP address of the network interface of the business container.

[0162] ② Redirect traffic that requires deep inspection to the proxy program.

[0163] ③ Locate the IP address of the business container.

[0164] ④ Establish a server session with the business container IP.

[0165] S705: The business container continues to handle legitimate traffic.

[0166] By modifying the routing settings of the business container through a CNI plugin, data from the business container is routed to the detection container. The detection container sets different fwmark values ​​based on the business container's IP address and synchronizes these fwmark values ​​to the session. This allows the transparent proxy program running in the detection container to obtain the fwmark values, which are then written into a new session established with the server. The detection container then uses these fwmark values ​​for policy routing, ensuring that legitimate traffic is returned to the business container after detection. Other network packets that do not need to enter the transparent proxy program are also set according to the fwmark values ​​in the session and returned to the business container. The business container then continues to process the returned packets using its original routing. This ensures that the proxy detection program does not participate in the underlying network of the business system, achieving transparent deployment while enabling deep proxy-level detection and control.

[0167] In addition, this application also provides a network traffic detection and control system based on a CNI network plugin, the structural diagram of which is shown below. Figure 10 As shown.

[0168] like Figure 10 As shown, the system includes: a service container 1001 and a detection container 1002; the service container 1001 is a protected container of the detection container 1002; the detection container 1001 is pre-deployed by the CNI network plugin.

[0169] Business container 1001 is used to modify the default transmission path of the traffic to be detected; based on the modified transmission path, the traffic to be detected is sent to detection container 1002;

[0170] The detection container 1002 is used to perform legality checks on the traffic to be detected, intercept illegal traffic, and send legal traffic to the business container 1001;

[0171] Business container 1001 is also used to continue processing legitimate traffic.

[0172] Optionally, business container 1001 is specifically used for:

[0173] The traffic initiated by business container 1001 is taken as the traffic to be detected. For the traffic initiated by business container 1001, the route is modified so that the traffic is sent to detection container 1002 through the modified route.

[0174] The detection container 1002 sets up policy routing for the business container 1001 and sends legitimate traffic back to the business container 1001 through policy routing;

[0175] The business container 1001 forwards legitimate traffic to the business network via the original route before modification.

[0176] Optionally, business container 1001 is specifically used for:

[0177] Traffic sent from the business network to business container 1001 is taken as traffic to be detected. For traffic sent from the business network to business container 1001, the destination address is translated into the IP of the virtual interface of the detection container 1002.

[0178] The detection container 1002 translates the destination address of legitimate traffic into the IP address of the network interface of the service container 1001 and sends the legitimate traffic to the service container.

[0179] Optionally, the CNI network plugin is specifically used for:

[0180] In response to the user's selection of the deployment method for the detection container 1002, the target deployment method is determined from the single-machine deployment method and the cluster deployment method;

[0181] If the target deployment method is a single-machine deployment method, then the detection container 1002 will be deployed on the physical node where the business container is located. The detection container 1002 is used to protect each business container 1001 on the physical node.

[0182] If the target deployment method is a cluster deployment method, then a detection container cluster is deployed, and the business container 1001 connected by the detection container cluster is protected; the detection container cluster includes multiple detection containers 1002.

[0183] Optionally, the CNI network plugin is also used for:

[0184] Create a pair of interconnected veth virtual network interface cards for service container 1001 and detection container 1002, wherein the first veth virtual network interface card is set on service container 1001 as a virtual interface of service container 1001, and the second veth virtual network interface card is set on detection container 1002 as a virtual interface of detection container 1002.

[0185] Add the first DNAT policy to business container 1001 and add the second DNAT policy to detection container 1002;

[0186] The first DNAT policy is a destination address translation policy for network interface IP addresses from the business network and with the business container 1001 as the destination address; the second DNAT policy is a destination address translation policy for network interface IP addresses from the first veth virtual network interface and with the second veth virtual network interface as the destination address.

[0187] Optionally, the CNI network plugin is also used for:

[0188] Establish a tunnel between business container 1001 and the cluster service of the detection container cluster;

[0189] The traffic flowing through the tunnel is encapsulated in UDP packets.

[0190] For traffic originating from business container 1001, the cluster service sends the traffic to detection container 1002 within the detection container cluster based on a load balancing strategy.

[0191] Optionally, the detection container 1002 is also used for:

[0192] Listen for the L3miss event;

[0193] If an L3miss event is detected, set the corresponding MAC address for the IP of service container 1001 at the other end of the tunnel;

[0194] The CNI network plugin detects traffic being sent to the MAC address by container 1002.

[0195] The traffic is encapsulated into UDP packets, and the UDP packets are sent to the IP address of business container 1001 based on the mapping between MAC address and IP address.

[0196] Optionally, the CNI network plugin is also used for:

[0197] Set a timeout limit for business container 1001;

[0198] If the time interval between the detection container 1002 receiving the latest traffic sent by the service container 1001 exceeds the timeout limit, the setting information for the service container 1001 will be cleared on the detection container.

[0199] The CNI network plugin is also used for:

[0200] In the detection container 1002, the fwmark value is added to the traffic sent by the service container 1001 based on the IP address of the service container 1001.

[0201] The fwmark tag value is synchronized to the session between the detection container 1002 and the business container so that the transparent agent running in the detection container 1002 can obtain the fwmark tag value.

[0202] The transparent proxy writes the fwmark value into a new session created with the server;

[0203] The transparent proxy program matches the policy routing based on the fwmark flag value and sends legitimate traffic to the business container 1001 by detecting container 1002.

[0204] The CNI network plugin is also used for:

[0205] When the destination address of the session received by the transparent proxy is the IP of the virtual interface of the detection container 1002, the destination address for connecting to the server is translated to the IP of the network interface of the business container 1001.

[0206] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The system embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate. The components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0207] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for network traffic detection and control based on a CNI network plugin, characterized in that, The method is implemented through a CNI network plugin, and the method includes: Modify the default transmission path of the traffic to be detected in the business container; Based on the modified transmission path, the traffic to be detected is sent to the detection container pre-deployed by the CNI network plugin; the service container is the protected container of the detection container. The detection container performs legality checks on the traffic to be detected, intercepts illegal traffic, and sends legitimate traffic to the service container. The legitimate traffic is then processed by the service container. The CNI network plugin deploys the detection container, including: The CNI network plugin responds to the user's selection of the container deployment method by determining the target deployment method from single-machine deployment and cluster deployment methods; If the target deployment method is a single-machine deployment method, then the detection container is deployed on the physical node where the service container is located, and the detection container is used to protect each service container on the physical node; If the target deployment method is a cluster deployment method, then a detection container cluster is deployed, and the connected business containers are protected by the detection container cluster; the detection container cluster includes multiple detection containers.

2. The method according to claim 1, characterized in that, Modifying the default transmission path of the traffic to be detected for the service container includes: The traffic initiated by the service container is taken as the traffic to be detected. The route is modified for the traffic initiated by the service container so that the traffic is sent to the detection container through the modified route. Sending legitimate traffic to the service container through the detection container includes: The detection container sets a policy route for the service container and sends the legitimate traffic back to the service container through the policy route. The further processing of the legitimate traffic by the service container includes: The legitimate traffic is forwarded to the business network by the business container through the original route before modification.

3. The method according to claim 1, characterized in that, Modifying the default transmission path of the traffic to be detected for the service container includes: Traffic sent from the business network to the business container is taken as the traffic to be detected. For the traffic sent from the business network to the business container, the destination address is converted to the IP of the virtual interface of the detection container. Sending legitimate traffic to the service container through the detection container includes: The detection container converts the destination address of the legitimate traffic to the IP address of the network interface of the service container and sends the legitimate traffic to the service container.

4. The method according to claim 1, characterized in that, The target deployment method is a single-machine deployment method, and the method further includes: A pair of interconnected veth virtual network interface cards are created for the service container and the detection container, wherein the first veth virtual network interface card is set on the service container as the virtual interface of the service container, and the second veth virtual network interface card is set on the detection container as the virtual interface of the detection container. Add a first DNAT strategy to the business container and a second DNAT strategy to the detection container; The first DNAT policy is a destination address translation policy for network interface IP addresses of the service container that are from the service network and whose destination addresses are the network interface IP addresses of the service container; the second DNAT policy is a destination address translation policy for network interface IP addresses of the first veth virtual network interface and whose destination addresses are the second veth virtual network interface.

5. The method according to claim 1, characterized in that, The target deployment method is a cluster deployment method, and the method further includes: The CNI network plugin establishes a tunnel between the service container and the cluster service with the detection container cluster. The traffic flowing through the tunnel is encapsulated in UDP packets. For traffic originating from the business container, the cluster service sends the traffic to the detection container within the detection container cluster based on a load balancing strategy.

6. The method according to claim 5, characterized in that, Also includes: The detection container listens for the L3miss event; If an L3miss event is detected, set the corresponding MAC address for the IP of the service container at the other end of the tunnel; Sending legitimate traffic to the service container through the detection container includes: Traffic is sent to the MAC address through the detection container; The traffic is encapsulated into UDP packets, and based on the mapping between MAC addresses and the IP addresses of the service containers, the UDP packets are sent to the IP addresses of the service containers.

7. The method according to claim 6, characterized in that, Also includes: Set a timeout limit for the service container; If the time interval between the detection container receiving the latest traffic sent by the service container exceeds the timeout limit, then the settings information for the service container are cleared on the detection container.

8. The method according to claim 1, characterized in that, The detection container uses proxy technology; the method further includes: In the detection container, an fwmark tag value is added to the traffic sent by the service container based on the IP address of the service container; The fwmark tag value is synchronized to the session between the detection container and the service container so that the transparent agent running in the detection container can obtain the fwmark tag value; The transparent proxy program writes the fwmark value into a new session created with the server; Sending legitimate traffic to the service container through the detection container includes: The transparent proxy program routes according to the fwmark flag value matching strategy and sends legitimate traffic to the service container through the detection container.

9. The method according to claim 8, characterized in that, Also includes: When the destination address of the session received by the transparent proxy is the IP of the virtual interface of the detection container, the destination address for connecting to the server is converted to the IP of the network interface of the business container.

10. A network traffic detection and control system based on a CNI network plugin, characterized in that, include: Business containers and detection containers; The service container is the protected container of the detection container; The detection container is pre-deployed by the CNI network plugin; The service container is used to modify the default transmission path of the traffic to be detected; based on the modified transmission path, the traffic to be detected is sent to the detection container. The detection container is used to perform legality detection on the traffic to be detected, intercept illegal traffic, and send legal traffic to the service container; The service container is also used to continue processing the legitimate traffic; The CNI network plugin is specifically used for: In response to the user's selection of the detection container deployment method, a target deployment method is determined from single-machine deployment and cluster deployment. If the target deployment method is single-machine deployment, the detection container is deployed on the physical node where the service container is located, and the detection container is used to protect each service container on the physical node. If the target deployment method is cluster deployment, a detection container cluster is deployed, and the detection container cluster protects the connected service containers. The detection container cluster includes multiple detection containers.

Images