Multi-cluster application container security measurement method and system based on karmada

Abstract

The invention provides a multi-cluster application container security measurement method and system based on karmada, the method is applied to a multi-cluster structure, the multi-cluster structure comprises a control end and a plurality of member clusters connected with the control end, each member cluster comprises a plurality of nodes, and the nodes are connected with the control end. The method comprises the following steps: a node of a member cluster receives a processing task issued to the member cluster by a control end, and a corresponding container mirror image is matched based on the processing task; nodes of the member cluster adopt an access controller, and legality check is carried out based on identity data of a processing task; the nodes of the member cluster adopt a measurement module, based on the application record corresponding to the container mirror image, multiple basic measurement values are calculated based on data in the application record, and a total security measurement value is calculated based on the multiple basic measurement values; and determining whether to block the processing task based on the total security metric value.

Description

Technical Field

[0001] The present invention relates to the technical field of container cloud, and in particular to a karmada-based multi-cluster application container security measurement method and system. Background Art

[0002] With the rapid development of cloud computing and edge computing technologies, multi-cluster deployment has become a key strategy for handling large-scale distributed applications, optimizing resource allocation, and improving service availability. As the de facto standard in the field of container orchestration, Kubernetes (K8s for short) provides a solid foundation for application deployment in multi-cloud environments with its powerful resource management and automated deployment capabilities. However, as the scale of K8s clusters increases and their geographical distribution increases, the complexity of managing multi-cluster environments also increases, especially in terms of ensuring application security.

[0003] In the prior art, the issue of container operation security is usually addressed by security scanning of application containers in a single cluster. There is a lack of a unified measurement method for container application security and a lack of unified security regulation across multiple clusters. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a multi-cluster application container security measurement method based on karmada to eliminate or improve one or more defects existing in the prior art.

[0005] One aspect of the present invention provides a multi-cluster application container security measurement method based on karmada, the method is applied to a multi-cluster structure, the multi-cluster structure includes a control end and multiple member clusters connected to the control end, each member cluster includes multiple nodes, the method includes the following steps:

[0006] The node of the member cluster receives the processing task issued by the control end to the member cluster, and matches the corresponding container image based on the processing task;

[0007] The nodes of the member cluster use admission controllers to perform legitimacy checks based on the identity data of the processing tasks;

[0008] The nodes of the member cluster use a measurement module to calculate a plurality of basic measurement values ​​based on the application record corresponding to the container image and the data in the application record, and calculate a total security measurement value based on the plurality of basic measurement values;

[0009] Whether to block the processing task is determined based on the total security metric value.

[0010] By adopting the above scheme, this scheme can first complete the management of multiple clusters through the control end based on the processing tasks issued by the control end to the member clusters. In each member cluster, the legitimacy is first checked by the access controller, and then the total security measurement value is calculated by the measurement module. Through the two-stage judgment, the operation safety of each member cluster for the processing tasks is guaranteed, thereby realizing unified security regulation within the scope of multiple clusters.

[0011] In some embodiments of the present invention, an admission controller is used in the nodes of the member cluster, and the step of performing legitimacy verification based on the identity data of the processing task includes user identity authentication, operation authority verification and constraint verification of whether the operation complies with global specifications based on the identity data.

[0012] In some embodiments of the present invention, the node of the member cluster uses a metric module to calculate multiple basic metric values ​​based on the application record corresponding to the container image and based on the data in the application record. The step of calculating the total security metric value based on the multiple basic metric values ​​includes:

[0013] Calculating multiple basic metrics including vulnerability scanning, compliance checking, virus scanning, and image signature verification based on the data in the application records;

[0014] The total security metric value is obtained by weighted summation based on multiple basic metric values.

[0015] In some embodiments of the present invention, in the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value corresponding to the vulnerability scan includes using a container security scanning tool to perform a vulnerability scan on the software package in the container image, giving a score for each vulnerability scanned, and calculating the basic metric value corresponding to the vulnerability scan based on the scores of all vulnerabilities.

[0016] In a specific implementation process, the container security scanning tool may be Clair, Anchore Engine, and Trivy.

[0017] In some embodiments of the present invention, in the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value corresponding to the compliance check includes using a compliance scanning tool to check the percentage of container images that do not meet preset standards as the basic metric value corresponding to the compliance check.

[0018] In a specific implementation process, the compliance scanning tool may be a neuvector compliance baseline checking tool.

[0019] In some embodiments of the present invention, in the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value corresponding to the virus scan includes using antivirus software to integrate into the CI / CD process, scanning the container image to detect malware, if malware is detected, the basic metric value corresponding to the virus scan is 1, if malware is not detected, the basic metric value corresponding to the virus scan is 0.

[0020] In some embodiments of the present invention, in the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value of image signature verification includes signing the container image using a signing tool and verifying the signature before deployment. If the verification is successful, the basic metric value of the image signature verification is 0; if the verification is not successful, the basic metric value of the image signature verification is 1.

[0021] In some embodiments of the present invention, the method further comprises:

[0022] If the processing task is blocked, marking the container image corresponding to the processing task;

[0023] In the step of receiving a processing task issued by a control end to the member cluster by a node of the member cluster and matching a corresponding container image based on the processing task, if the matched container image has a tag, determining whether to directly block is based on the tag.

[0024] In some embodiments of the present invention, if the matching container image has a mark, in the step of determining whether to directly block based on the mark, the modification record of the container image and the generation time of the mark are obtained, and if the modification record of the container image is after the generation time of the mark, it is processed by the admission controller and the measurement module, and whether to block the processing task is determined by the calculated total security measurement value; if the modification record of the container image is not after the generation time of the mark, it is directly blocked.

[0025] The second aspect of the present invention also provides a multi-cluster application container security measurement system based on karmada, the system includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, the processor is used to execute the computer instructions stored in the memory, when the computer instructions are executed by the processor, the system implements the steps implemented by the method described above.

[0026] The third aspect of the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps implemented by the aforementioned karmada-based multi-cluster application container security measurement method.

[0027] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention can be specifically pointed out and obtained in the specification and the accompanying drawings.

[0028] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention.

[0030] Figure 1 It is a schematic diagram of a first implementation of the multi-cluster application container security measurement method based on karmada in the present invention;

[0031] Figure 2 It is a schematic diagram of a second implementation of the multi-cluster application container security measurement method based on karmada of the present invention;

[0032] Figure 3 It is a schematic diagram of a third implementation of the multi-cluster application container security measurement method based on karmada in the present invention;

[0033] Figure 4 This is a schematic diagram of the architecture of this solution;

[0034] Figure 5 This is another schematic diagram of the architecture of this solution;

[0035] Figure 6 This is a schematic diagram of the processing flow of this solution. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0037] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0038] Under the multi-cluster architecture of existing technologies, traditional single-cluster security solutions often cannot effectively cope with the challenges of security monitoring, threat detection, and response across cluster resources. On the one hand, each cluster may run on different infrastructures and have its own security policies and tools, which leads to inconsistency of security policies and difficulty in management. On the other hand, the frequent traffic, data exchange, and resource calls of cross-cluster applications increase the exposure of security vulnerabilities and attack vectors. Therefore, how to achieve unified, efficient, and automated application security measurement and management in a multi-cluster environment has become an urgent problem to be solved.

[0039] At present, there are several solutions that attempt to solve the security monitoring and management of k8s clusters as follows:

[0040] (1) A container image security scanning solution for the k8s cluster is implemented in combination with a third-party image scanning plug-in. The scanning scope of this solution is limited to a single cluster and cannot achieve unified application security measurement and management for multiple clusters.

[0041] (2) Methods based on K8s native extensions or third-party management platforms, Kubernetes Operator, Prometheus monitoring system, and Grafana visualization platform, to achieve performance monitoring and basic security indicator tracking of multi-cluster applications. However, this solution mainly focuses on performance monitoring and tracking of basic security indicators, and does not go deep into security measurement analysis and policy adjustment at the application level. It lacks deep insights into application security in a multi-cluster environment, such as application container image virus scanning, image vulnerability scanning, and compliance detection capabilities, and lacks a unified measurement method for these security issues.

[0042] Therefore, this solution proposes a unified measurement method for container application security in a multi-cluster environment. In view of the multi-cluster container application distribution process, combined with security policies, the security assessment of container applications after distribution is implemented, making it easier to adopt corresponding policies to implement access control of applications within the cluster.

[0043] The disadvantages of the existing technology include:

[0044] 1. Existing technologies are all focused on security scanning of application containers in a single cluster, lacking unified security control across multiple clusters;

[0045] 2. Existing technologies lack a unified measurement method for container application security;

[0046] In this scheme;

[0047] 1. This solution provides a unified security measurement device for multi-cluster container applications;

[0048] 2. This solution combines the container application security measurement device with the multi-cluster container application distribution process;

[0049] 3. This solution can avoid starting application containers with too low security by measuring the security of container applications, implement access control for multi-cluster application containers, and improve security.

[0050] like Figure 1 As shown, the present invention proposes a multi-cluster application container security measurement method based on karmada, the method is applied to a multi-cluster structure, the multi-cluster structure includes a control end and multiple member clusters connected to the control end, each member cluster includes multiple nodes, the method includes the following steps:

[0051] In the specific implementation process, the multi-cluster application container security measurement method of this solution is based on Kubernetes, which is short for K8s. It is an open source containerized application for managing multiple hosts in the cloud platform. The goal of Kubernetes is to make the deployment of containerized applications simple and efficient. Kubernetes provides a mechanism for application deployment, planning, updating, and maintenance; Karmada is an open source multi-cluster management project, which is mainly used to achieve unified management and scheduling of resources among multiple Kubernetes clusters. It allows users to manage multiple Kubernetes clusters like operating a single cluster, providing cross-cluster deployment, expansion, and policy implementation capabilities.

[0052] Step S100, a node of a member cluster receives a processing task issued by a control end to the member cluster, and matches a corresponding container image based on the processing task;

[0053] In the specific implementation process, the container is a virtualization technology at the operating system level, which packages the application and its dependencies in a container and deploys it on the host's operating system kernel; the container image refers to a packaging format used in containerization technology, which contains a complete application and all the components and dependencies required for its operation. The container image can be regarded as an executable software package that contains the application code, runtime environment, library files, configuration files, etc.

[0054] In the specific implementation process, when a user creates a multi-cluster application, he will submit a resource creation request to the Karmada API server. After the request is passed, the karmada-scheduler scheduler determines which clusters will be scheduled based on the propaganda policy and available resources. Then the scheduler on the control side scores and sorts each available cluster and binds the resources to the most suitable or specified cluster. In the present invention, the blocking strategy and application distribution of multiple clusters are distributed to the subordinate clusters through karmada-scheruler. Figure 5 shown.

[0055] Step S200, the node of the member cluster uses an admission controller to perform a legitimacy check based on the identity data of the processing task;

[0056] In the specific implementation process, the application container needs to rely on the container image when it starts. The container image file system adopts the concept of layering. The image is a "set of layers" that has been encapsulated. Among various types of images, the base image is relatively special. It is a pure Linux distribution image that only contains rootfs, that is, the Linux file system. It should be noted that a complete rootfs is not necessarily just one layer, it may be composed of multiple layers. In other non-Base image images, in addition to rootfs, there are other layers and metadata. These layers and metadata store relevant information about the image, such as image id, creation time, and running software package information. These layers and metadata together constitute the image.

[0057] Taking the Docker container engine as an example, when Docker extracts a container image, it first extracts each layer of the image to the corresponding directory, then extracts the size and metadata of each layer to the corresponding directory, and finally writes the layer's dependencies (all parent layers of the layer) into the specified file. From this, it can be seen that each layer of the container image includes the file system, metadata, layer size, and inter-layer dependency table, which correspond to the directories of the host machine respectively. The security measurement of the image that the application container depends on when starting is mainly aimed at the above-mentioned layered files.

[0058] According to the characteristics of container images, we design application container image security measurement module, policy management, access control and other functions. The security measurement module mainly collects and analyzes the detection results of vulnerability scanning, image compliance checking, image virus scanning, etc., and gives the application container security level through a customized formula. The module runs on the k8s working node in the form of a daemonset.

[0059] First, after each cluster container image is built, the image is pulled to the cluster working node and decompressed in layers to complete the security scan of the container image. The scan results are stored locally in the cluster as the benchmark value used by the subsequent unified security measurement module.

[0060] The multi-cluster control end is equipped with a policy management module, which sets the control (blocking) policy of the subordinate clusters according to the security level of the image, and distributes the control policy to the subordinate clusters using the karmada multi-cluster container application release process. Each subordinate cluster designs the cluster Api-server admission controller according to the policy. When the application container is distributed to the subordinate cluster, key information such as the container image name and image id is extracted, and the security measurement value of the image is statistically obtained through the security measurement module. Finally, it is matched with the control policy distributed to the cluster. If the match is successful, it means that the container using the image should not be started, and the application container is blocked from starting through the admission controller.

[0061] In the specific implementation process, API Server, as the gateway of Kubernetes cluster system, is the only entrance to access and manage resource objects. Clients must access or change cluster status and complete data storage through API Server, and it will perform legality checks on each access request, including user identity authentication, operation permission verification, and whether the operation complies with global specification constraints. Only after all checks are completed normally and the object configuration information is verified to be legal can data be accessed or stored in the etcd database.

[0062] The admission controller is used to intercept client requests after authentication and authorization checks, but before objects are persistently stored in etcd. It is used to enforce semantic validation of objects during resource creation, update, and deletion operations. Operation requests to read resource information will not be checked by the admission controller.

[0063] Step S300, the node of the member cluster uses a measurement module to calculate multiple basic measurement values ​​based on the application record corresponding to the container image and the data in the application record, and calculates the total security measurement value based on the multiple basic measurement values;

[0064] Step S400: determining whether to block the processing task based on the total security metric value.

[0065] In a specific implementation process, the total security metric value is compared with a preset security threshold to determine whether to block the processing task.

[0066] like Figure 6 As shown, specifically, the processing of the measurement module includes two stages:

[0067] a. Obtain security metrics information for the image and modify the request (Mutating admission)

[0068] First, the container image parameters in the request are parsed, and a request is made to the measurement module to collect the image measurement information. At the same time, the blocking strategy is matched. If the match is successful, it means that blocking is required and the blocking information is returned. Otherwise, a null value is returned. The return value is stored in the container resource template declaration (annotation) in the form of a key-value pair, and the subsequent verification process continues.

[0069] b. Validating admission

[0070] If the first step can correctly match the blocking policy and the blocking information can be obtained in the request, the verification fails and the container creation process is blocked. Otherwise, the application container is allowed to start.

[0071] like Figure 4 As shown in the figure, in the specific implementation process, after setting the blocking strategy of many cluster container applications, this solution will be distributed to subordinate clusters through karmada-scheduler scheduling, and each subordinate cluster will re-record the strategy for this cluster and store it in the database. At this time, when an application container requests Api-Server to create a replica set (replicasets) through API, Api-Server enters the application container image security measurement module after authentication and authorization. The module first parses the container image in the request, then searches the local scanning database, counts the security measurement data, and returns the statistical signal. The admission controller will receive the signal and match the blocking policy data. When matching the strategy, there are the following situations: 1. There is no blocking strategy, and the default strategy is to release all, that is, regardless of whether the measurement data is counted, the container startup behavior using the image will be released; 2. When there is at least one blocking strategy, and the image obtains security measurement data through the measurement module, it will be matched according to the security measurement value and the strategy. If the match is successful, the container startup using the image will be blocked, otherwise it will not be blocked.

[0072] By adopting the above scheme, this scheme can first complete the management of multiple clusters through the control end based on the processing tasks issued by the control end to the member clusters. In each member cluster, the legitimacy is first checked by the access controller, and then the total security measurement value is calculated by the measurement module. Through the two-stage judgment, the operation safety of each member cluster for the processing tasks is guaranteed, thereby realizing unified security regulation within the scope of multiple clusters.

[0073] In some embodiments of the present invention, an admission controller is used in the nodes of the member cluster, and the step of performing legitimacy verification based on the identity data of the processing task includes user identity authentication, operation authority verification and constraint verification of whether the operation complies with global specifications based on the identity data.

[0074] In the specific implementation process, if the legality check passes, the measurement module is used for further verification.

[0075] like Figure 2 and 3 As shown, in some embodiments of the present invention, the node of the member cluster adopts a measurement module, based on the application record corresponding to the container image, and calculates multiple basic measurement values ​​based on the data in the application record. The step of calculating the total security measurement value based on the multiple basic measurement values ​​includes:

[0076] Step S310, calculating multiple basic metrics including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record;

[0077] Step S320: performing weighted summation based on multiple basic metrics to obtain a total security metric value.

[0078] By adopting the above scheme, a joint judgment is made based on the values ​​of multiple tests to calculate the total security metric value, thereby ensuring the comprehensiveness of the total security metric value consideration.

[0079] In some implementations of the present invention, in the step of performing weighted summation based on multiple basic metrics to obtain a total security metric value, the total security metric value is calculated according to the following formula:

[0080] Total safety metric value = 1-(w1×V+w2×C+w3×M+w4×K);

[0081] Among them, V represents the basic metric value corresponding to vulnerability scanning; C represents the basic metric value corresponding to compliance checking; M represents the basic metric value corresponding to virus scanning; K represents the basic metric value of image signature verification; w1, w2, w3 and w4 represent the weight values ​​corresponding to vulnerability scanning, compliance checking, virus scanning and image signature verification respectively.

[0082] During the specific implementation process, w1, w2, w3 and w4 are allocated in specific proportions according to the organization's specific strategies, w1+w2+w3+w4=1.

[0083] In some embodiments of the present invention, in the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value corresponding to the vulnerability scan includes using a container security scanning tool to perform a vulnerability scan on the software package in the container image, giving a score for each vulnerability scanned, and calculating the basic metric value corresponding to the vulnerability scan based on the scores of all vulnerabilities.

[0084] In a specific implementation process, the container security scanning tool may be Clair, Anchore Engine, and Trivy.

[0085] In some embodiments of the present invention, Clair is used to scan a Docker image and 5 security vulnerabilities are found, with CVSS scores of 9.8, 6.5, 5.0, 7.7 and 8.1, respectively, with a maximum score of 10. The basic metric value corresponding to the vulnerability scan is calculated as a weighted average, for example, (9.8+6.5+5.0+7.7+8.1) / 5 / 10=0.74. If the weight w1 of the vulnerability scan is set to 0.3, the contribution to the total security metric value, that is, w1×V, is 0.3×0.74.

[0086] In some embodiments of the present invention, in the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value corresponding to the compliance check includes using a compliance scanning tool to check the percentage of container images that do not meet preset standards as the basic metric value corresponding to the compliance check.

[0087] In a specific implementation process, the compliance scanning tool may be a neuvector compliance baseline checking tool.

[0088] In some embodiments of the present invention, the compliance scan shows that 20% of the software package versions in the image do not meet the organization's minimum version security requirements. If the weight w2 of the compliance check is set to 0.2, the contribution to the total security metric, i.e., w2×C, is 0.2×20%.

[0089] In some embodiments of the present invention, in the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value corresponding to the virus scan includes using antivirus software to integrate into the CI / CD process, scanning the container image to detect malware, if malware is detected, the basic metric value corresponding to the virus scan is 1, if malware is not detected, the basic metric value corresponding to the virus scan is 0.

[0090] In some embodiments of the present invention, antivirus software (such as VirusTotal API) scans the image and finds no virus. If the virus scan weight w3 is set to 0.4, the virus scan score M is 0, and the contribution to the total security metric value, i.e., w3×M, is 0.4×0; if a virus is found, the total security metric contribution value is 0.4×1.

[0091] In some embodiments of the present invention, in the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value of image signature verification includes signing the container image using a signing tool and verifying the signature before deployment. If the verification is successful, the basic metric value of the image signature verification is 0; if the verification is not successful, the basic metric value of the image signature verification is 1.

[0092] In some embodiments of the present invention, the current image has been signed with a key that does not meet the organization's standards, and the signature has not been verified before deployment. If the image signature verification weight w4 is set to 0.1, the contribution to the total security metric is 0.1×1. If the signature verification is passed, the total security metric contribution is 0.

[0093] In some embodiments of the present invention, combining the above scores and weights, the total security metric value is represented as follows:

[0094] 1-(0.3×0.74+0.2×20%+0.4×1+0.1×1)=0.238, the measurement value range is 0-1, and the closer the value is to 1, the safer the container application is.

[0095] like Figure 3 As shown, in some embodiments of the present invention, the steps of the method further include:

[0096] Step S500: if the processing task is blocked, marking the container image corresponding to the processing task;

[0097] Step S600, in which a node of a member cluster receives a processing task issued by a control terminal to the member cluster, and matches a corresponding container image based on the processing task, if the matched container image has a tag, whether to directly block is determined based on the tag.

[0098] With the above solution, if a processing task is blocked, a blocked mark is generated for the corresponding container image. When the container image is called again, the blocking can be completed directly based on the mark, eliminating the calculation steps for determining the blocking and improving processing efficiency.

[0099] In some embodiments of the present invention, if the matching container image has a mark, in the step of determining whether to directly block based on the mark, the modification record of the container image and the generation time of the mark are obtained, and if the modification record of the container image is after the generation time of the mark, it is processed by the admission controller and the measurement module, and whether to block the processing task is determined by the calculated total security measurement value; if the modification record of the container image is not after the generation time of the mark, it is directly blocked.

[0100] By adopting the above scheme, technicians can modify the container image. Since the modified container may be different from the one when it was blocked, it is possible that it will not be blocked. This scheme records the time of each modification. If the modification record of the container image is after the generation time of the tag, the judgment is successfully made, avoiding system errors caused by blind blocking; if the modification record of the container image is not after the generation time of the tag, it is directly blocked to ensure processing efficiency.

[0101] In summary, this solution can measure the security of application container images at key nodes in the multi-cluster k8s container application release process, and can prevent container images with lower security levels from running on the host to a certain extent, effectively protect the security of container clusters and hosts, and minimize the resulting damage.

[0102] An embodiment of the present invention also provides a multi-cluster application container security measurement system based on karmada, the system includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, the processor is used to execute the computer instructions stored in the memory, when the computer instructions are executed by the processor, the system implements the steps implemented by the method described above.

[0103] The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps implemented by the aforementioned multi-cluster application container security measurement method based on karmada are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0104] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0105] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0106] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0107] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A multi-cluster application container security measurement method based on karmada, characterized in that: The method is applied to a multi-cluster structure, the multi-cluster structure includes a control end and multiple member clusters connected to the control end, each member cluster includes multiple nodes, and the method includes the following steps: The node of the member cluster receives the processing task issued by the control end to the member cluster, and matches the corresponding container image based on the processing task; The nodes of the member cluster use admission controllers to perform legitimacy checks based on the identity data of the processing tasks; The nodes of the member cluster use a measurement module to calculate a plurality of basic measurement values ​​based on the application record corresponding to the container image and the data in the application record, and calculate a total security measurement value based on the plurality of basic measurement values; Whether to block the processing task is determined based on the total security metric value.

2. According to claim 1, the multi-cluster application container security measurement method based on karmada is characterized in that: Admission controllers are used in the nodes of the member cluster. The steps of legitimacy verification based on the identity data of the processing task include user identity authentication based on the identity data, operation authority verification, and constraint verification of whether the operation complies with global specifications.

3. The multi-cluster application container security measurement method based on karmada according to claim 1 is characterized in that: The nodes of the member cluster use a measurement module to calculate multiple basic measurement values ​​based on the application records corresponding to the container image and based on the data in the application records. The step of calculating the total security measurement value based on the multiple basic measurement values ​​includes: Calculating multiple basic metrics including vulnerability scanning, compliance checking, virus scanning, and image signature verification based on the data in the application records; The total security metric value is obtained by weighted summation based on multiple basic metric values.

4. The multi-cluster application container security measurement method based on karmada according to claim 3 is characterized in that: In the step of calculating multiple basic metrics including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric corresponding to the vulnerability scanning includes using a container security scanning tool to perform vulnerability scanning on the software package in the container image, giving a score for each vulnerability scanned, and calculating the basic metric corresponding to the vulnerability scanning based on the scores of all vulnerabilities.

5. The multi-cluster application container security measurement method based on karmada according to claim 3 is characterized in that: In the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value corresponding to the compliance check includes using a compliance scanning tool to check the percentage of container images that do not meet preset standards as the basic metric value corresponding to the compliance check.

6. The multi-cluster application container security measurement method based on karmada according to claim 3 is characterized in that: In the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value corresponding to the virus scan includes using antivirus software to integrate into the CI / CD process, scanning the container image to detect malware, if malware is detected, the basic metric value corresponding to the virus scan is 1, if malware is not detected, the basic metric value corresponding to the virus scan is 0.

7. The multi-cluster application container security measurement method based on karmada according to claim 3 is characterized in that: In the step of calculating multiple basic metric values ​​including vulnerability scanning, compliance checking, virus scanning and image signature verification based on the data in the application record, the step of calculating the basic metric value of image signature verification includes signing the container image using a signing tool and verifying the signature before deployment. If the verification is successful, the basic metric value of the image signature verification is 0; if the verification is not successful, the basic metric value of the image signature verification is 1.

8. The multi-cluster application container security measurement method based on karmada according to any one of claims 1 to 7, characterized in that: The method further comprises the steps of: If the processing task is blocked, marking the container image corresponding to the processing task; In the step of receiving a processing task issued by a control end to the member cluster by a node of the member cluster and matching a corresponding container image based on the processing task, if the matched container image has a tag, determining whether to directly block is based on the tag.

9. The multi-cluster application container security measurement method based on karmada according to claim 8 is characterized in that: In the step of determining whether to directly block based on the tag if the matched container image has a tag, obtaining the modification record of the container image and the generation time of the tag, and if the modification record of the container image is after the generation time of the tag, processing is performed through the admission controller and the metric module, and determining whether to block the processing task through the calculated total security metric value; If the modification record of the container image is not after the generation time of the tag, it will be blocked directly.

10. A multi-cluster application container security measurement system based on karmada, characterized in that: The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions. The processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps implemented by the method as described in any one of claims 1 to 9.

Images