Container security enhancement method and system supporting virtualized cloud environment

Abstract

The invention provides a container security enhancement method and system supporting a virtualized cloud environment. The method comprises the steps that vulnerability detection is conducted on stateless application programs of a container mirror image read-only layer; carrying out antivirus detection on the stateless binary program of the read-only layer of the container mirror image; performing compliance detection and semantic detection on the file of the preset type, including performing compliance detection on the text configuration file; performing semantic detection on the script file; and carrying out dynamic analysis on the written mirror image file. By means of the container mirror image security detection mode, container security enhancement supporting the virtualized cloud environment is achieved, and the problem that in the related technology, the security enhancement effect of storage is poor is solved.

Description

Technical Field

[0001] The present invention relates to the field of cloud native technology, and in particular to a container security enhancement system method and system supporting a virtualized cloud environment. Background Art

[0002] Container technology is a kernel-lightweight operating system layer virtualization technology. Different from the hardware abstraction layer virtualization method of virtual machines, containers provide a virtualization method for sharing the operating system kernel. There is no need to repeatedly load the kernel when executing the container, and the container kernel is shared with the host machine, thereby converting hardware resources into more computing resources.

[0003] In the related technology, the container security enhancement method cannot be applied in different environments, and the security enhancement effect is not good. Summary of the invention

[0004] The main purpose of the present invention is to provide a container security enhancement method and system supporting a virtualized cloud environment to solve the problems existing in the related art.

[0005] In order to achieve the above-mentioned purpose, according to the first aspect of the present invention, a container security enhancement method supporting a virtualized cloud environment is provided, including vulnerability detection of stateless applications in the read-only layer of container images; antivirus detection of stateless binary programs in the read-only layer of container images; compliance detection and semantic detection of files of preset types, including compliance detection of text configuration files; semantic detection of script files; and dynamic analysis of written image files.

[0006] Optionally, the method further isolates container instance resources including: isolating container resources based on a lightweight virtual machine; or isolating container resources based on a lightweight container runtime sandbox; or isolating container resources based on Linux native security capabilities.

[0007] Optionally, the method also includes enhancing operating system access control functionality.

[0008] Optionally, the container resource isolation based on the lightweight virtual machine includes: providing container isolation through hardware virtualization in the case where each container has its own corresponding lightweight virtual machine and small kernel.

[0009] Optionally, the container resource isolation based on the lightweight container runtime sandbox includes: limiting the application program's direct access to the host kernel by API simulation.

[0010] Optionally, the enhanced operating system access control function includes using the Linux operating system preset security module to implement a mandatory access subject / object access right attribute setting engine and a subject / object access authorization mechanism; integrating the Linux Namespaces mechanism to implement a container instance-centric access control mechanism.

[0011] Optionally, the method also includes isolating the tenant network.

[0012] Optionally, the method further includes performing security monitoring on the application layer network.

[0013] According to a second aspect of the present invention, a container security enhancement system supporting a virtualized cloud environment is provided, comprising a container image security detection unit, configured to perform vulnerability detection on a stateless application program in a read-only layer of a container image; perform antivirus detection on a stateless binary program in a read-only layer of a container image; perform compliance detection and semantic detection on files of preset types, including compliance detection on text configuration files; semantic detection on script files; and dynamic analysis of written image files; a container instance security enhancement unit, configured to perform container resource isolation based on a lightweight virtual machine; or perform container resource isolation based on a lightweight container runtime sandbox; or perform container resource isolation based on Linux native security capabilities.

[0014] Optionally, the device also includes a host machine and operating system kernel security enhancement unit, which is configured to enhance the operating system access control function.

[0015] This embodiment supports a container security enhancement method and system for a virtualized cloud environment, wherein the method includes vulnerability detection of stateless applications in the read-only layer of container images; antivirus detection of stateless binary programs in the read-only layer of container images; compliance detection and semantic detection of files of preset types, including compliance detection of text configuration files; semantic detection of script files; and dynamic analysis of written image files. The container security enhancement supporting the virtualized cloud environment is achieved by means of container image security detection, overcoming the problem of poor storage security enhancement effect in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1is a flow chart of a method for enhancing container security in a virtualized cloud environment according to an embodiment of the present invention;

[0018] Figure 2 is a schematic diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0020] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present invention described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0021] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0022] According to an embodiment of the present invention, a container security enhancement method supporting a virtualized cloud environment is provided, comprising:

[0023] Step 101: Perform vulnerability detection on the stateless application of the container image read-only layer.

[0024] Step 102: Perform antivirus detection on the stateless binary program of the read-only layer of the container image;

[0025] Step 103: performing compliance detection and semantic detection on files of a preset type, including performing compliance detection on text configuration files;

[0026] Step 104: Perform semantic detection on the script file; and perform dynamic analysis on the written image file.

[0027] In the above embodiment, a variety of container security detection methods are used to ensure the security of container images and fine-grained security analysis, including vulnerability detection of stateless applications in the read-only layer of container images to ensure that the base layer of the basic image does not have serious security vulnerabilities; antivirus detection of stateless binary programs in the read-only layer of container images to ensure that they are not infected by malicious code; compliance detection of text configuration files to ensure that they do not have weak configurations; semantic analysis of existing script files through webshell backdoor detection to determine whether they have vulnerabilities or malicious code; dynamic analysis of binary files written to image files and with abnormal behavior through sandbox technology to ensure that the executable programs in the image files do not have malicious programs, and automatic generation of mandatory access control rules based on behavioral data.

[0028] As an optional implementation of this embodiment, the method further isolates container instance resources including: isolating container resources based on a lightweight virtual machine; or isolating container resources based on a lightweight container runtime sandbox; or isolating container resources based on Linux native security capabilities.

[0029] As an optional implementation of this embodiment, the container resource isolation based on the lightweight virtual machine includes: providing container isolation through hardware virtualization in the case where each container has its own corresponding lightweight virtual machine and small kernel.

[0030] As an optional implementation of this embodiment, container resource isolation based on the lightweight container runtime sandbox includes: limiting the application program from directly accessing the host kernel through API simulation.

[0031] Among the above optional implementations, container instance resource isolation can be solved in three ways. Including lightweight virtual machine solutions, represented by Kata Containers, which is a lightweight virtual machine implementation based on QEMU. It is currently mainly composed of six modules: Agent, Runtime, Proxy, Sim, Kernel and QEMU. In Kata Containers, each container has its own lightweight virtual machine and small kernel, providing container isolation through hardware virtualization, while being compatible with the container runtime OCI standard. Currently, it only supports X86, X86-64, arm and other architectures.

[0032] It can also be implemented through a lightweight container runtime sandbox, represented by Google Legvisor, which is a user space kernel that limits the application's direct access to the host kernel through API simulation while maintaining the access results expected by the application. Currently, it only supports the X86 architecture.

[0033] It can also be implemented through Linux native security capabilities. For example, it can be enforced through the security mechanism that has been implemented in the host kernel, and can be widely applied to Linux systems under various CPU architectures.

[0034] As an optional implementation of this embodiment, the method also includes enhancing the access control function of the operating system.

[0035] As an optional implementation of this embodiment, the enhanced operating system access control function includes implementing a mandatory access subject / object access right attribute setting engine and a subject / object access authorization mechanism with the help of a preset security module of the Linux operating system; integrating the Linux Namespaces mechanism to implement an access control mechanism centered on a container instance.

[0036] In the above optional implementation, since the security enhancement of the container host is based on the domestic Linux operating system, mandatory access control and security audit functions are implemented. Therefore, this solution improves the security of the Linux operating system kernel from the perspective of enhancing the operating system access control function, and enhances the operating system access control function through the study of access control policies, policy descriptions, and policy support structures.

[0037] During implementation, you can use Linux Security Modules, Loadable kernel module, SELinux, Seccomp, Apparmor and other security modules to implement the mandatory access subject / object access permission attribute setting engine and subject / object access authorization mechanism, and integrate the Linux Namespaces mechanism to implement an access control mechanism centered on container instances.

[0038] As an optional implementation manner of this embodiment, the method further includes isolating the tenant network.

[0039] As an optional implementation manner of this embodiment, the method further includes performing security monitoring on the application layer network.

[0040] Container security enhancement technology that supports virtualized cloud environments mainly solves the security isolation and security enhancement issues of virtualized cloud environments. It improves the security assurance capabilities of the entire virtualized cloud environment by adopting system access control strategies, system kernel security reinforcement, container instance security enhancement, tenant network isolation, image security detection, application layer network security monitoring and other enhancement measures.

[0041] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0042] According to an embodiment of the present invention, a container security enhancement system supporting a virtualized cloud environment is also provided, including a container image security detection unit, which is configured to perform vulnerability detection on a stateless application program in a read-only layer of a container image; perform antivirus detection on a stateless binary program in a read-only layer of a container image; perform compliance detection and semantic detection on files of preset types, including compliance detection on text configuration files; semantic detection on script files; and dynamic analysis of written image files; a container instance security enhancement unit, which is configured to perform container resource isolation based on a lightweight virtual machine; or to perform container resource isolation based on a lightweight container runtime sandbox; or to perform container resource isolation based on Linux native security capabilities.

[0043] Optionally, the device also includes a host machine and operating system kernel security enhancement unit, which is configured to enhance the operating system access control function.

[0044] Optionally, the device also includes a host machine and an operating system kernel security enhancement unit, which is configured to perform container resource isolation based on a lightweight virtual machine, including: providing container isolation through hardware virtualization in the case where each container has its own corresponding lightweight virtual machine and small kernel.

[0045] Optionally, the container resource isolation based on the lightweight container runtime sandbox includes: limiting the application program's direct access to the host kernel by API simulation.

[0046] Optionally, the enhanced operating system access control function includes using the Linux operating system preset security module to implement a mandatory access subject / object access right attribute setting engine and a subject / object access authorization mechanism; integrating the Linux Namespaces mechanism to implement a container instance-centric access control mechanism.

[0047] Optionally, the device also includes a tenant network isolation unit configured to isolate the tenant network.

[0048] Optionally, the device further comprises an application network security monitoring unit configured to perform security monitoring on the application layer network.

[0049] An embodiment of the present invention provides an electronic device, such as Figure 2 As shown, the electronic device includes one or more processors 31 and a memory 32. Figure 2 A processor 31 is taken as an example.

[0050] The controller may further include: an input device 33 and an output device 34 .

[0051] The processor 31, the memory 32, the input device 33 and the output device 34 may be connected via a bus or other means. Figure 2 The example of connecting through bus is taken in the following.

[0052] The processor 31 may be a central processing unit (CPU). The processor 31 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips. The general-purpose processor may be a microprocessor or any conventional processor.

[0053] The memory 32 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the control method in the embodiment of the present invention. The processor 31 executes various functional applications and data processing of the server by running the non-transitory software programs, instructions and modules stored in the memory 32, that is, the enterprise data exchange method based on email in the above method embodiment is realized.

[0054] The memory 32 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of a processing device operated by the server, etc. In addition, the memory 32 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 32 may optionally include a memory remotely arranged relative to the processor 31, and these remote memories may be connected to a network connection device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0055] The input device 33 can receive input digital or character information and generate key signal input related to user settings and function control of the processing device of the server. The output device 34 can include display devices such as a display screen.

[0056] One or more modules are stored in the memory 32, and when executed by one or more processors 31, the execution is as follows: Figure 1 The method shown.

[0057] Those skilled in the art can understand that the implementation of all or part of the processes in the above-mentioned embodiment method is a program that can be completed by instructing related hardware through a computer program, which can be stored in a computer-readable storage medium. When the program is executed, it can include the process of the embodiment of the above-mentioned method. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviated: HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0058] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A container security enhancement method supporting a virtualized cloud environment, characterized in that: include: Detect vulnerabilities in read-only layer stateless applications of container images; Perform antivirus detection on stateless binary programs in the read-only layer of container images; Perform compliance and semantic testing on files of preset types, including compliance testing on text configuration files and semantic testing on script files; Perform dynamic analysis on written image files.

2. The container security enhancement method supporting a virtualized cloud environment according to claim 1, characterized in that: The method also isolates container instance resources by: isolating container resources based on a lightweight virtual machine; or isolating container resources based on a lightweight container runtime sandbox; or isolating container resources based on Linux native security capabilities.

3. The container security enhancement method supporting a virtualized cloud environment according to claim 1, characterized in that: The method also includes enhancing operating system access control functionality.

4. The container security enhancement method supporting a virtualized cloud environment according to claim 2, characterized in that: The container resource isolation based on the lightweight virtual machine includes: Container isolation is provided through hardware virtualization, where each container has its own corresponding lightweight virtual machine and small kernel.

5. The container security enhancement method supporting a virtualized cloud environment according to claim 4, characterized in that: Container resource isolation based on lightweight container runtime sandbox includes: limiting the application's direct access to the host kernel through API simulation.

6. The container security enhancement method supporting a virtualized cloud environment according to claim 3, characterized in that: Enhanced operating system access control functions include using the Linux operating system's preset security module to implement a mandatory access subject / object access permission attribute setting engine and a subject / object access authorization mechanism; integrating the Linux Namespaces mechanism to implement a container instance-centric access control mechanism.

7. The method for enhancing container security in a virtualized cloud environment according to any one of claims 1 to 6, characterized in that: The method also includes isolating tenant networks.

8. The container security enhancement method supporting a virtualized cloud environment according to claim 7, characterized in that: The method also includes performing security monitoring on the application layer network.

9. A container security enhancement system supporting a virtualized cloud environment, characterized in that: include: A container image security detection unit, configured to perform vulnerability detection on a stateless application in a read-only layer of a container image; Perform antivirus detection on stateless binary programs in the read-only layer of container images; Compliance detection and semantic detection are performed on files of preset types, including compliance detection on text configuration files, semantic detection on script files, and dynamic analysis on written image files. The container instance security enhancement unit is configured to isolate container resources based on lightweight virtual machines; or to isolate container resources based on lightweight container runtime sandboxes; or to isolate container resources based on Linux native security capabilities.

10. The container security enhancement system supporting a virtualized cloud environment according to claim 9, characterized in that: The device also includes a host machine and an operating system kernel security enhancement unit, which is configured to enhance the operating system access control function.

Images