Application file tamper-proofing method, device, equipment and storage medium in container environment

Abstract

The present application discloses an application file tamper-proofing method, device, equipment and storage medium in a container environment, and relates to the technical field of file tamper-proofing, including: after installing a management center and a synchronization node, creating a protection application object, adding a synchronization node and configuring a monitoring directory by logging into a management platform to obtain an application ID; the monitoring directory is an application file directory corresponding to the current application; building a target Docker image based on the application ID; in the process of creating a container based on the target Docker image, automatically obtaining target information including the application ID from the current container environment variable through the target monitoring node; configuring the monitoring node by using the query result obtained by performing an application query based on the received target information through the management center; starting protection through the target monitoring node using the node configuration information issued by the management center, and performing file backup. It can effectively improve the user experience.

Description

Technical Field

[0001] The present invention relates to the technical field of file tamper-proofing, and in particular to a method, device, equipment and storage medium for file tamper-proofing in a container environment. Background Art

[0002] The containerized application model has the characteristics of lightweight deployment, portability, high resource utilization and isolation, and cross-platform. It can help users build applications more quickly without considering environmental differences. This has led many users to migrate applications into containers for operation. However, containers do not provide file tampering prevention capabilities, which means that attackers can still tamper with applications through vulnerabilities in applications, and the use of containers increases the complexity of the environment, bringing some new security issues to users. In addition, due to the emergence of containers, the publishing mode of application websites has also changed. Many applications no longer update certain files, but directly destroy and rebuild the container. Traditional tampering prevention methods can no longer support this scenario.

[0003] The existing anti-tampering method runs on a virtual machine or physical machine. By installing an agent, the application files to be protected are backed up to other machines, and then the application files are monitored by the agent. When tampering occurs, the files are restored from the backup files. If the user wants to publish the application, the file needs to be published to the backup end, and then the backup end node synchronizes the file to the WEB server (WORLD WIDE WEB server, also known as the website server). As a result, this model has the following limitations when used in a container environment: 1) When the container is destroyed and created frequently, the protection agent needs to be installed frequently; 2) The IP address (Internet Protocol Address) in the container will change every time the container is created, and the management center can no longer use the previous container IP address to manage the agent. The published files cannot be synchronized to the WEB node through the backup end node; 3) The network environment in which the container runs is complex, and there is a network mapping between the nodes, so they cannot communicate directly; 4) If the application publishing method changes, it is not just the update of a single file, but the destruction and reconstruction of the entire container. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and storage medium for preventing application files from being tampered with in a container environment. On the one hand, the deployment scheme for the scenario where containers are frequently destroyed and rebuilt can automatically obtain the previous related protection configuration information after the container is rebuilt, and complete the backup of application files and the activation of monitoring protection functions without manual intervention; on the other hand, it can effectively prevent attackers from spreading malicious information by tampering with the file content of the application website, thereby effectively improving the user experience. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a method for preventing application files from being tampered with in a container environment, comprising:

[0006] After installing the corresponding management center and synchronization node, log in to the corresponding management platform to create a protection application object, add a synchronization node, and configure the monitoring directory to obtain the application ID corresponding to the target protection application; wherein the monitoring directory is the application file directory corresponding to the current application;

[0007] Build a Docker image based on the application ID to obtain a corresponding target Docker image;

[0008] In the process of creating a container based on the target Docker image, the corresponding target information including the application ID is automatically obtained from the current container environment variable through the corresponding target monitoring node;

[0009] When the target information reported by the monitoring center is received through the management center, a corresponding monitoring node configuration operation is performed using a query result obtained by performing an application query based on the target information to obtain corresponding node configuration information;

[0010] The target monitoring node uses the corresponding node configuration information sent by the management center to start corresponding protection measures and perform file backup.

[0011] Optionally, after installing the corresponding management center and synchronization node, the protection application object creation, synchronization node addition and monitoring directory configuration are performed by logging into the corresponding management platform, including:

[0012] After installing the corresponding management center and synchronization node and fixing the corresponding IP address, obtain the corresponding monitoring directory;

[0013] Log in to the corresponding management platform through the IP address information of the management center, create corresponding protection application objects, configure the monitoring directory, and add corresponding synchronization nodes based on the IP address information of the synchronization node.

[0014] Optionally, after obtaining the application ID corresponding to the target protection application, the method further includes:

[0015] A target table for representing the corresponding relationship between the application ID and the monitoring directory is generated, and the target table is saved locally.

[0016] Optionally, the building of a Docker image based on the application ID to obtain a corresponding target Docker image includes:

[0017] A Docker image is constructed based on the application ID, and the IP address information and port information corresponding to the management center to obtain a corresponding target Docker image.

[0018] Optionally, automatically acquiring corresponding target information including the application ID from the current container environment variable through the corresponding target monitoring node includes:

[0019] Information is automatically obtained from the current container environment variables through the corresponding target monitoring node to obtain the IP address information and port information corresponding to the management center, as well as the application ID as the target information and the local IP address information of the current container, so as to request the management center to establish a connection based on the IP address information and port information corresponding to the management center, and report the target information.

[0020] Optionally, when the target information reported by the monitoring center is received through the management center, a query result obtained by performing an application query based on the target information is used to perform a corresponding monitoring node configuration operation to obtain corresponding node configuration information, including:

[0021] When the target information reported by the monitoring center is received through the management center, the directory information corresponding to the application ID, the target monitoring node information under the current application and the policy information are queried using the target information to obtain the corresponding query result;

[0022] When the query result indicates that there is no monitoring node under the current application or all corresponding monitoring nodes are online, the host ID information is directly assigned to the target monitoring node, and the target monitoring node is assigned to the current application, so that the corresponding application configuration information is used as the corresponding node configuration information; wherein the node configuration information includes the corresponding host ID information, target monitoring directory, monitoring strategy, and backup end IP address information;

[0023] When the query result indicates that there is an offline monitoring node under the current application, the corresponding offline node replacement is performed, and the host ID information of the replaced target offline monitoring node is assigned to the target monitoring node, so that the configuration information corresponding to the target offline monitoring node is used as the corresponding node configuration information.

[0024] Optionally, starting corresponding protection measures by using the target monitoring node with the corresponding node configuration information issued by the management center and performing file backup includes:

[0025] The target monitoring directory is monitored by the target monitoring node using the corresponding node configuration information issued by the management center, and corresponding monitoring policy configuration operations are performed;

[0026] For the application files under the corresponding target monitoring directory, files are backed up to the corresponding backup end based on the backup end IP address information in the node configuration information, so that when file tampering is detected, the file can be replaced by requesting the corresponding backup file in the backup end.

[0027] In a second aspect, the present application provides an application file tamper-proof device in a container environment, comprising:

[0028] The application ID acquisition module is used to create a protection application object, add a synchronization node, and configure a monitoring directory by logging into the corresponding management platform after installing the corresponding management center and synchronization node, so as to obtain the application ID corresponding to the target protection application; wherein the monitoring directory is the application file directory corresponding to the current application;

[0029] An image building module, used to build a Docker image based on the application ID to obtain a corresponding target Docker image;

[0030] An information acquisition module, used to automatically acquire corresponding target information including the application ID from the current container environment variable through the corresponding target monitoring node during the process of creating a container based on the target Docker image;

[0031] A node configuration module, configured to, when receiving the target information reported by the monitoring center through the management center, perform a corresponding monitoring node configuration operation using a query result obtained by performing an application query based on the target information to obtain corresponding node configuration information;

[0032] The protection startup module is used to start corresponding protection measures through the target monitoring node using the corresponding node configuration information issued by the management center, and perform file backup.

[0033] In a third aspect, the present application provides an electronic device, including:

[0034] Memory, used to store computer programs;

[0035] The processor is used to execute the computer program to implement the steps of the aforementioned method for preventing application files from being tampered with in a container environment.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the steps of the aforementioned method for preventing application files from being tampered with in a container environment.

[0037] It can be seen that in this application, after installing the corresponding management center and synchronization node, by logging in to the corresponding management platform, the protection application object is created, the synchronization node is added, and the monitoring directory is configured to obtain the application ID corresponding to the target protection application; wherein the monitoring directory is the application file directory corresponding to the current application; based on the application ID, a Docker image is built to obtain the corresponding target Docker image; in the process of creating a container based on the target Docker image, the corresponding target information containing the application ID is automatically obtained from the current container environment variable through the corresponding target monitoring node; when the target information reported by the monitoring center is received through the management center, the query result obtained by the application query based on the target information is used to perform the corresponding monitoring node configuration operation to obtain the corresponding node configuration information; the corresponding protection measures are started by the target monitoring node using the corresponding node configuration information issued by the management center, and the file is backed up. That is, in this application, before building the Docker image of the tamper-proof target monitoring node, it is necessary to perform directory binding and other operations on the management platform to generate the corresponding application ID. Later, when creating a container using the Docker image, the node configuration information corresponding to the target monitoring node is obtained by collecting information such as the application ID, so that protection can be automatically enabled based on the node configuration information. In this way, on the one hand, the deployment solution for the scenario where the container is frequently destroyed and rebuilt can automatically obtain the previous related protection configuration information after the container is rebuilt, and complete the backup of the application files and the activation of the monitoring protection function without manual intervention; on the other hand, it can effectively prevent attackers from spreading malicious information by tampering with the file content of the application website, thereby effectively improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0039] Figure 1 A flow chart of a method for preventing application files from being tampered with in a container environment provided by this application;

[0040] Figure 2 A schematic diagram of a script fragment for creating a Docker image provided in this application;

[0041] Figure 3 A specific flow chart of the application file tamper-proof method provided in this application;

[0042] Figure 4 A schematic diagram of the structure of an application file anti-tampering device in a container environment provided by this application;

[0043] Figure 5 A structural diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] The existing anti-tampering method runs on a virtual machine or physical machine. By installing an agent, the application files to be protected are backed up to other machines, and then the application files are monitored by the agent. When tampering occurs, the files are restored from the backup files. If the user wants to publish the application, the file needs to be published to the backup end, and then the backup end node synchronizes the file to the WEB server. As a result, this mode has the following limitations when used in a container environment: 1) When the container is destroyed and created frequently, the protection agent needs to be installed frequently; 2) The IP address in the container will change every time the container is created, and the management center can no longer use the previous container IP address to manage with the agent. The published files cannot be synchronized to the WEB node through the backup end node; 3) The network environment in which the container runs is complex, and there is a network mapping between the nodes, so they cannot communicate directly; 4) If the application publishing method changes, it is not just the update of a single file, but the destruction and reconstruction of the entire container. To this end, the present application provides an anti-tampering solution for application files in a container environment. On the one hand, the deployment solution for scenarios where containers are frequently destroyed and rebuilt can automatically obtain the previous relevant protection configuration information after the container is rebuilt, and complete the backup of application files and the activation of monitoring protection functions without manual intervention; on the other hand, it can effectively prevent attackers from spreading malicious information by tampering with the file content of the application website, thereby effectively improving the user experience.

[0046] See also Figure 1 As shown, an embodiment of the present invention discloses a method for preventing application files from being tampered with in a container environment, including:

[0047] Step S11, after installing the corresponding management center and synchronization node, log in to the corresponding management platform to create a protection application object, add a synchronization node, and configure a monitoring directory to obtain an application ID corresponding to the target protection application; wherein the monitoring directory is the application file directory corresponding to the current application.

[0048] Specifically, in this embodiment, after installing the corresponding management center and synchronization node, the corresponding management platform is logged in to create protection application objects, add synchronization nodes, and configure the monitoring directory, including: after installing the corresponding management center and synchronization node, and fixing the corresponding IP address, obtain the corresponding monitoring directory; log in to the corresponding management platform through the IP address information of the management center (also known as MC, deployed on a separate server, responsible for managing monitoring agents and synchronization agents), create corresponding protection application objects, configure the monitoring directory, and add corresponding synchronization nodes based on the IP address information of the synchronization center (also known as SA, deployed on a separate server, responsible for backing up and synchronizing application files). In this process, a unique application ID will be obtained, and the directory that needs to be protected and various protection strategies can be queried through this ID.

[0049] In addition, in this embodiment, after obtaining the application ID corresponding to the target protection application, it also includes: generating a target table for representing the corresponding relationship between the application ID and the monitoring directory, and saving the target table locally.

[0050] Step S12: Build a Docker image based on the application ID to obtain a corresponding target Docker image.

[0051] Specifically, in this embodiment, after obtaining the application ID (Identity document, identity information), the application ID can be used to create a Docker image. As shown in the figure, taking the Dockerfile template as an example, it is only necessary to modify the value of INFORGUARDAPPID in the figure to the application ID; the value of the INFORGUARDMCIP address is modified to the IP address of the management center; the value of INFORGUARDMCPORT is modified to the port bound to the management center. After the modification, the script file can be used to create a Docker image for customer use. In addition, it should be understood that the constructed image comes with an anti-tampering monitoring agent, which will start automatically with the creation of the container and support k8s (i.e., Kubernetes) orchestration. That is, the Docker image is constructed based on the application ID to obtain the corresponding target Docker image, including: the Docker image is constructed based on the application ID, and the IP address information and port information corresponding to the management center to obtain the corresponding target Docker image. In this way, by filling in the application ID when making the image, the binding of the Docker image and the monitoring directory to be protected is realized.

[0052] Step S13: In the process of creating a container based on the target Docker image, the corresponding target information including the application ID is automatically obtained from the current container environment variable through the corresponding target monitoring node.

[0053] Specific, combined Figure 3 As shown, in this embodiment, when the target Docker image is used to build a container, the built-in monitoring node (i.e. Figure 2 The MA) process in the management center will also be started, that is, the corresponding target monitoring node automatically obtains the corresponding target information containing the application ID from the current container environment variable through the corresponding target monitoring node, including: automatically obtaining information from the current container environment variable through the corresponding target monitoring node to obtain the IP address information and port information corresponding to the management center, as well as the application ID as the target information and the local IP address information of the current container, so as to request the management center to establish a connection based on the IP address information and port information corresponding to the management center, and report the target information. Among them, it can be understood that when making a Docker image, the target monitoring node will be imported into the image together, and when the operation of building a container based on the Docker image is started, the target monitoring node will also be started, and then the application ID and other information of the container will be obtained.

[0054] Step S14: When the target information reported by the monitoring center is received through the management center, a query result obtained by performing an application query based on the target information is used to perform a corresponding monitoring node configuration operation to obtain corresponding node configuration information.

[0055] Specifically, in this embodiment, when the target information reported by the monitoring center is received through the management center, the query result obtained by performing an application query based on the target information is used to perform a corresponding monitoring node configuration operation to obtain the corresponding node configuration information, including: when the target information reported by the monitoring center is received through the management center, the directory information corresponding to the application ID, the target monitoring node information under the current application, and the policy information are queried using the target information to obtain the corresponding query result; when the query result shows that there is no monitoring node under the current application or all corresponding monitoring nodes are online, the host ID information is directly assigned to the target monitoring node, and the target monitoring node is assigned to the current application, so that the corresponding application configuration information is used as the corresponding node configuration information; the node configuration information includes the corresponding host ID information, target monitoring directory, monitoring policy, and backup end IP address information; when the query result shows that there is an offline monitoring node under the current application, the corresponding offline node is replaced, and the host ID information of the replaced target offline monitoring node is assigned to the target monitoring node, so that the configuration information corresponding to the target offline monitoring node is used as the corresponding node configuration information.

[0056] Step S15: start corresponding protection measures through the target monitoring node using the corresponding node configuration information issued by the management center, and perform file backup.

[0057] In this embodiment, the target monitoring node uses the corresponding node configuration information issued by the management center to start the corresponding protection measures and perform file backup, including: the target monitoring directory is monitored by the target monitoring node using the corresponding node configuration information issued by the management center, and the corresponding monitoring policy configuration operation is performed; for the application files under the corresponding target monitoring directory, the file is backed up to the corresponding backup end based on the backup end IP address information in the node configuration information, so that when file tampering is detected, the file is replaced by requesting the corresponding backup file in the backup end. It can be understood that the node configuration information issued not only includes the host ID, target monitoring directory, monitoring strategy, backup end IP address, but also includes information such as whether to enable the monitoring function, and the target monitoring node will perform corresponding operations according to the specific information content.

[0058] It should be understood that before backing up the files under the local target monitoring directory to the directory corresponding to the backup end. The target monitoring node will first query the management platform whether there is a backup task for the current application (i.e., the current website). If not, it will first register the backup task, and then start the backup. After the backup is completed, the backup task will be deleted. In this process, there may be a backup task that has been completed by the previous monitoring node before the target monitoring node queries the task, so the backup adopts a fast backup mode. The files will be compared before backing up the files, and only inconsistent files and missing files will be backed up. If the target monitoring node inquires from the management platform that there is a backup task for the current website, it means that there are multiple monitoring nodes under the current application. Since the files under the monitoring directory of the monitoring node under the same website are consistent, no backup will be performed.

[0059] In addition, it should be understood that in this embodiment, the file filtering driver module is loaded onto the server in advance for use by the MA in the target Docker container. It is only necessary to pass the host ID together when passing parameters to the driver module through netlink when the MA is started. When the driver receives the parameters, it will obtain the network namespace of the current session, so that a corresponding relationship of [network namespace-host ID-configuration parameters] will appear. When the driver discovers a tampering event, it will first obtain the network namespace of the tampered file, and then find the corresponding configuration through the namespace, and protect and release it through the configuration. In this way, there is no need to install the driver in the container, and one driver can be used for all Docker containers.

[0060] Furthermore, in actual use, the technical solution disclosed in this embodiment supports the following scenarios: 1) Simple Docker scenario: After the image is made, it can be returned to the customer, and the customer will add his own application to it. When the container is started using the image, MA and the application are started together, MA is connected to MC, and the protection takes effect. If the user wants to update the files under the application, the file can be placed on the publishing end, and the publishing end will automatically synchronize the published content to the WEB end. If the website is updated in the destruction and reconstruction mode, the user only needs to use the previous MA image to re-make a new application image. 2) Docker mount directory mode: Some applications only run the application server in a Docker container, and the actual application files are in other places and are provided to the application server by mounting the directory. For this situation, this embodiment has the following two solutions:

[0061] ① Consistent with the simple Docker environment solution, MA and applications can be placed in the same image;

[0062] ② Install MA on the machine where the file is located, directly on the server, and publish the application through the publishing agent.

[0063] 3) k8s scenario: k8s is responsible for managing the creation and destruction of containers. By default, some restrictions are added to the use of containers. For example, each time a container is started, only one process is allowed to be started. There are two solutions to this restriction:

[0064] ① Use MA image to create application image. When creating the image, you can modify the application startup script and start MA at the same time as starting the application. The publishing scheme of application files is also the same as that of a simple Docker environment;

[0065] ②Put the application image and MA image in the same pod. Since containers in the same pod can share resources, MA can also protect the application files. The difference from the simple Docker scenario is that MA and application are in two images. If the application is released by destroying and reconstructing, k8s needs to build two containers, MA and application.

[0066] In summary, this embodiment can be used in Docker and k8s environments and supports various forms of application publishing. It can automatically access the management platform after the container is destroyed and rebuilt, and automatically complete the backup and enable monitoring without manual intervention. In addition, different anti-tampering solutions can be provided, which can be selected according to different usage scenarios.

[0067] It can be seen that in the embodiment of the present application, after installing the corresponding management center and synchronization node, by logging into the corresponding management platform, the protection application object is created, the synchronization node is added, and the monitoring directory is configured to obtain the application ID corresponding to the target protection application; wherein the monitoring directory is the application file directory corresponding to the current application; a Docker image is built based on the application ID to obtain the corresponding target Docker image; in the process of creating a container based on the target Docker image, the corresponding target information containing the application ID is automatically obtained from the current container environment variable through the corresponding target monitoring node; when the target information reported by the monitoring center is received by the management center, the query result obtained by the application query based on the target information is used to perform the corresponding monitoring node configuration operation to obtain the corresponding node configuration information; the corresponding protection measures are started by the target monitoring node using the corresponding node configuration information issued by the management center, and the file is backed up. That is, in this application, before building the Docker image of the tamper-proof target monitoring node, it is necessary to perform directory binding and other operations on the management platform to generate the corresponding application ID. Later, when creating a container using the Docker image, the node configuration information corresponding to the target monitoring node is obtained by collecting information such as the application ID, so that protection can be automatically enabled based on the node configuration information. In this way, on the one hand, the deployment solution for the scenario where the container is frequently destroyed and rebuilt can automatically obtain the previous related protection configuration information after the container is rebuilt, and complete the backup of the application files and the activation of the monitoring protection function without manual intervention; on the other hand, it can effectively prevent attackers from spreading malicious information by tampering with the file content of the application website, thereby effectively improving the user experience.

[0068] See also Figure 4 As shown, the embodiment of the present application also discloses an application file tamper-proof device in a container environment, including:

[0069] The application ID acquisition module 11 is used to create a protection application object, add a synchronization node, and configure a monitoring directory by logging into the corresponding management platform after installing the corresponding management center and synchronization node, so as to obtain an application ID corresponding to the target protection application; wherein the monitoring directory is the application file directory corresponding to the current application;

[0070] An image building module 12 is used to build a Docker image based on the application ID to obtain a corresponding target Docker image;

[0071] An information acquisition module 13 is used to automatically acquire corresponding target information including the application ID from the current container environment variable through the corresponding target monitoring node during the process of creating a container based on the target Docker image;

[0072] The node configuration module 14 is used to, when receiving the target information reported by the monitoring center through the management center, use the query result obtained by performing an application query based on the target information to perform a corresponding monitoring node configuration operation to obtain the corresponding node configuration information;

[0073] The protection start module 15 is used to start corresponding protection measures through the target monitoring node using the corresponding node configuration information issued by the management center, and perform file backup.

[0074] Among them, for more specific working processes of the above-mentioned modules, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0075] It can be seen that in the embodiment of the present application, after installing the corresponding management center and synchronization node, by logging into the corresponding management platform, the protection application object is created, the synchronization node is added, and the monitoring directory is configured to obtain the application ID corresponding to the target protection application; wherein the monitoring directory is the application file directory corresponding to the current application; a Docker image is constructed based on the application ID to obtain the corresponding target Docker image; in the process of creating a container based on the target Docker image, the corresponding target information containing the application ID is automatically obtained from the current container environment variable through the corresponding target monitoring node; when the target information reported by the monitoring center is received by the management center, the query result obtained by performing an application query based on the target information is used to perform the corresponding monitoring node configuration operation to obtain the corresponding node configuration information; the corresponding protection measures are started by the target monitoring node using the corresponding node configuration information issued by the management center, and the file is backed up. That is, in the present application, before constructing the Docker image of the tamper-proof target monitoring node, directory binding and other operations need to be performed on the management platform to generate the corresponding application ID. Later, when creating a container using the Docker image, the node configuration information corresponding to the target monitoring node is obtained by collecting information such as the application ID, so that protection can be automatically enabled based on the node configuration information. In this way, on the one hand, the deployment solution for the scenario where the container is frequently destroyed and rebuilt can automatically obtain the previous related protection configuration information after the container is rebuilt, and complete the backup of the application files and the activation of the monitoring protection function without manual intervention; on the other hand, it can effectively prevent attackers from spreading malicious information by tampering with the file content of the application website, thereby effectively improving the user experience.

[0076] In some specific embodiments, the application ID acquisition module 11 may specifically include:

[0077] The directory acquisition unit is used to obtain the corresponding monitoring directory after installing the corresponding management center and synchronization node and fixing the corresponding IP address;

[0078] The platform login unit is used to log in to the corresponding management platform through the IP address information of the management center, create corresponding protection application objects, configure the monitoring directory, and add corresponding synchronization nodes based on the IP address information of the synchronization node.

[0079] In some specific embodiments, the file tamper-proof device applied in the container environment may further include:

[0080] The table saving unit is used to generate a target table for representing the corresponding relationship between the application ID and the monitoring directory, and save the target table locally.

[0081] In some specific embodiments, the image building module 12 may specifically include:

[0082] The image building unit is used to build a Docker image based on the application ID and the IP address information and port information corresponding to the management center to obtain a corresponding target Docker image.

[0083] In some specific embodiments, the information acquisition module 13 may specifically include:

[0084] An information acquisition unit is used to automatically acquire information from the current container environment variables through the corresponding target monitoring node to obtain the IP address information and port information corresponding to the management center, as well as the application ID as the target information and the local IP address information of the current container, so as to request the management center to establish a connection based on the IP address information and port information corresponding to the management center, and report the target information.

[0085] In some specific embodiments, the node configuration module 14 may specifically include:

[0086] A query result acquisition unit, configured to, when receiving the target information reported by the monitoring center through the management center, query the directory information corresponding to the application ID, the target monitoring node information under the current application, and the policy information to obtain a corresponding query result;

[0087] The first node configuration information acquisition unit is used to directly assign host ID information to the target monitoring node when the query result shows that there is no monitoring node under the current application or all corresponding monitoring nodes are online, and assign the target monitoring node to the current application to use the corresponding application configuration information as the corresponding node configuration information; wherein the node configuration information includes the corresponding host ID information, target monitoring directory, monitoring strategy, and backup end IP address information;

[0088] The second node configuration information acquisition unit is used to perform corresponding offline node replacement when the query result indicates that there is an offline monitoring node under the current application, and assign the host ID information of the replaced target offline monitoring node to the target monitoring node, so as to use the configuration information corresponding to the target offline monitoring node as the corresponding node configuration information.

[0089] In some specific embodiments, the protection startup module 15 may specifically include:

[0090] A node configuration information processing unit, used to monitor the target monitoring directory through the target monitoring node using the corresponding node configuration information issued by the management center, and perform corresponding monitoring policy configuration operations;

[0091] The protective measure application unit is used to back up the application files under the corresponding target monitoring directory to the corresponding backup end based on the backup end IP address information in the node configuration information, so that when file tampering is detected, the file can be replaced by requesting the corresponding backup file in the backup end.

[0092] Furthermore, the present application also discloses an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0093] Figure 5 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the method for preventing application file tampering in a container environment disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0094] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0095] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0096] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the application file tamper-proof method in the container environment executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0097] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned disclosed method for preventing application files from being tampered with in a container environment is implemented. The specific steps of the method can be referred to the corresponding contents disclosed in the aforementioned embodiments, and will not be described in detail here.

[0098] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0099] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0100] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0101] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0102] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for preventing application files from being tampered with in a container environment, characterized in that: include: After installing the corresponding management center and synchronization node, log in to the corresponding management platform to create a protection application object, add a synchronization node, and configure the monitoring directory to obtain the application ID corresponding to the target protection application; wherein the monitoring directory is the application file directory corresponding to the current application; Build a Docker image based on the application ID to obtain a corresponding target Docker image; In the process of creating a container based on the target Docker image, the corresponding target information including the application ID is automatically obtained from the current container environment variable through the corresponding target monitoring node; When the target information reported by the monitoring center is received through the management center, a corresponding target monitoring node configuration operation is performed using a query result obtained by performing an application query based on the target information to obtain corresponding node configuration information; The target monitoring node uses the corresponding node configuration information sent by the management center to start corresponding protection measures and perform file backup.

2. The method for preventing application files from being tampered with in a container environment according to claim 1, characterized in that: After installing the corresponding management center and synchronization node, log in to the corresponding management platform to create protection application objects, add synchronization nodes, and configure monitoring directories, including: After installing the corresponding management center and synchronization node and fixing the corresponding IP address, obtain the corresponding monitoring directory; Log in to the corresponding management platform through the IP address information of the management center, create corresponding protection application objects, configure the monitoring directory, and add corresponding synchronization nodes based on the IP address information of the synchronization node.

3. The method for preventing application files from being tampered with in a container environment according to claim 1, characterized in that: After obtaining the application ID corresponding to the target protection application, the method further includes: A target table for representing the corresponding relationship between the application ID and the monitoring directory is generated, and the target table is saved locally.

4. The method for preventing application files from being tampered with in a container environment according to claim 1, characterized in that: The step of building a Docker image based on the application ID to obtain a corresponding target Docker image includes: A Docker image is constructed based on the application ID, and the IP address information and port information corresponding to the management center to obtain a corresponding target Docker image.

5. The method for preventing application files from being tampered with in a container environment according to claim 1, characterized in that: The automatically acquiring corresponding target information including the application ID from the current container environment variable through the corresponding target monitoring node includes: Information is automatically obtained from the current container environment variables through the corresponding target monitoring node to obtain the IP address information and port information corresponding to the management center, as well as the application ID as the target information and the local IP address information of the current container, so as to request the management center to establish a connection based on the IP address information and port information corresponding to the management center, and report the target information.

6. The method for preventing application files from being tampered with in a container environment according to any one of claims 1 to 5, characterized in that: When the target information reported by the monitoring center is received through the management center, a query result obtained by performing an application query based on the target information is used to perform a corresponding target monitoring node configuration operation to obtain corresponding node configuration information, including: When the target information reported by the monitoring center is received through the management center, the directory information corresponding to the application ID, the target monitoring node information under the current application and the policy information are queried using the target information to obtain the corresponding query result; When the query result indicates that there is no monitoring node under the current application or all corresponding monitoring nodes are online, the host ID information is directly assigned to the target monitoring node, and the target monitoring node is assigned to the current application, so that the corresponding application configuration information is used as the corresponding node configuration information; wherein the node configuration information includes the corresponding host ID information, target monitoring directory, monitoring strategy, and backup end IP address information; When the query result indicates that there is an offline monitoring node under the current application, the corresponding offline node replacement is performed, and the host ID information of the replaced target offline monitoring node is assigned to the target monitoring node, so that the configuration information corresponding to the target offline monitoring node is used as the corresponding node configuration information.

7. The method for preventing application files from being tampered with in a container environment according to claim 6, characterized in that: The target monitoring node uses the corresponding node configuration information issued by the management center to start corresponding protection measures and perform file backup, including: The target monitoring directory is monitored by the target monitoring node using the corresponding node configuration information issued by the management center, and corresponding monitoring policy configuration operations are performed; For the application files under the corresponding target monitoring directory, files are backed up to the corresponding backup end based on the backup end IP address information in the node configuration information, so that when file tampering is detected, the file can be replaced by requesting the corresponding backup file in the backup end.

8. An anti-tampering device for application files in a container environment, characterized in that: include: The application ID acquisition module is used to create a protection application object, add a synchronization node, and configure a monitoring directory by logging into the corresponding management platform after installing the corresponding management center and synchronization node, so as to obtain the application ID corresponding to the target protection application; wherein the monitoring directory is the application file directory corresponding to the current application; An image building module, used to build a Docker image based on the application ID to obtain a corresponding target Docker image; An information acquisition module, used to automatically acquire corresponding target information including the application ID from the current container environment variable through the corresponding target monitoring node during the process of creating a container based on the target Docker image; A node configuration module, for executing a corresponding target monitoring node configuration operation by using a query result obtained by performing an application query based on the target information when the target information reported by the monitoring center is received through the management center, so as to obtain corresponding node configuration information; The protection startup module is used to start corresponding protection measures through the target monitoring node using the corresponding node configuration information issued by the management center, and perform file backup.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the method for preventing application files from being tampered with in a container environment as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the method for preventing application files from being tampered with in a container environment as described in any one of claims 1 to 7.

Images