Container mirror image security deployment method and device
Through the Jenkins pipeline scheduling container image security deployment method, the security authentication server is used to sign and verify container image, which solves the risk of tampering during container image deployment and improves deployment efficiency and security.
Patent Information
- Application Number
- CN202411209477.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-30
- Publication Date
- 2024-12-20
AI Technical Summary
In the cloud native era, container images may be at risk of being tampered with during deployment. How to ensure the secure deployment of container images to ensure business security has become an urgent problem.
Through the container image security deployment method executed by Jenkins pipeline scheduling, the security authentication server requests the target container image from the secure container image warehouse based on the request of the container deployment server, and conducts signature verification based on the correspondence between the image signature and the image identification to ensure the integrity of the image and security.
It effectively avoids the security risk of container images being tampered with, improves the deployment efficiency and security of container images, and ensures the security of mirrors through automated signature verification and deployment processes.
Smart Images
Figure CN119167435A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of software information technology, and in particular to a method and device for securely deploying container images. Background Art
[0002] Jenkins is an open source, scalable web-based software development and operation platform for continuous integration, delivery, and deployment. The Jenkins pipeline is a method of automating software development workflows that can be used for tasks such as building, testing, and deployment.
[0003] In the cloud-native era, Docker container technology has quickly become the standard for application deployment due to its lightweight and efficient features. Container images are generally obtained by pulling code, compiling and building, and making them from Dockerfile. However, during the deployment of container images, there may be risks of tampering during storage and pulling for use. How to securely deploy container images to ensure the security of business development has become an urgent problem to be solved. Summary of the invention
[0004] In view of this, the present application provides a container image security deployment method and system to ensure the secure deployment of container images.
[0005] The technical solution is as follows:
[0006] In a first aspect, an embodiment of the present application provides a method for secure deployment of a container image, the method being executed by a Jenkins pipeline scheduler, the method comprising:
[0007] The security authentication server requests the target container image from the secure container image repository based on the container deployment request sent by the container deployment server;
[0008] The security authentication server obtains the target container image sent by the secure container image repository, and performs signature verification on the target container image based on the correspondence between the image signature and the image identifier;
[0009] In response to the signature verification being passed, the security authentication server sends the target container image to the container deployment server, so that the container deployment server deploys the target container image.
[0010] In an optional implementation, the method further includes:
[0011] The Jenkins server obtains the business source code and container image building instructions from the code repository server;
[0012] The container compilation node builds a business container image based on the business source code and the container image building instruction sent by the Jenkins server, and stores the business container image in the secure container image repository, wherein the target container image is any business container image in the secure container image repository.
[0013] In an optional implementation, the method further includes:
[0014] The security authentication server generates an image signature of the business container image and an image identifier of the business container image; wherein the image signature of the business container image is obtained by signing and encrypting the image hash value of the business container image using a signature encryption algorithm, and the image identifier of the business container image is generated based on the image name of the business container image;
[0015] The security authentication server stores the image signature of the business container image and the image identifier of the business container image in correspondence with each other, so as to obtain a corresponding relationship between the image signature and the image identifier.
[0016] In an optional implementation, the signature encryption algorithm includes an SM2 elliptic curve public key cryptography algorithm.
[0017] In an optional implementation, the performing signature verification on the target container image based on the correspondence between the image signature and the image identifier includes:
[0018] Obtain the image hash value and image name of the target container image;
[0019] Determine the target image signature based on the image hash value of the target container image, and determine the target image identifier based on the image name of the target container image;
[0020] Determine the image signature to be matched based on the target image identifier and the corresponding relationship between the image signature and the image identifier;
[0021] If the target image signature is the same as the image signature to be matched, it is determined that the target container image signature verification has passed; if the target image signature is different from the image signature to be matched, it is determined that the target container image signature verification has failed.
[0022] In a second aspect, an embodiment of the present application provides a container image security deployment system, which is executed by a Jenkins pipeline scheduling, and the system includes: a secure container image repository, a security authentication server, and a container deployment server; wherein,
[0023] The security authentication server is used to request a target container image from the secure container image repository based on the container deployment request sent by the container deployment server;
[0024] The security authentication server is further used to obtain the target container image sent by the secure container image repository, and perform signature verification on the target container image based on the correspondence between the image signature and the image identifier;
[0025] The security authentication server is further configured to send the target container image to the container deployment server when the signature verification of the target container image passes, so that the container deployment server deploys the target container image.
[0026] In an optional implementation, the system further includes: a Jenkins server, a code repository server, and a container compilation node; wherein,
[0027] The Jenkins server is used to obtain business source code and container image building instructions from the code warehouse server;
[0028] The container compilation node is used to build a business container image based on the business source code and the container image building instruction sent by the Jenkins server, and store the business container image in the secure container image warehouse.
[0029] In an optional implementation, it is characterized in that:
[0030] The security authentication server is further used to generate an image signature of the business container image and an image identifier of the business container image; wherein the image signature of the business container image is obtained by signing and encrypting the image hash value of the business container image using a signature encryption algorithm, and the image identifier of the business container image is generated based on the image name of the business container image;
[0031] The security authentication server is further used to store the image signature of the business container image and the image identifier of the business container image in correspondence to obtain a corresponding relationship between the image signature and the image identifier.
[0032] In an optional implementation, the signature encryption algorithm includes an SM2 elliptic curve public key cryptography algorithm.
[0033] In an optional implementation, the security authentication server is used to perform signature verification on the target container image based on the correspondence between the image signature and the image identifier, specifically including: obtaining the image hash value and the image name of the target container image; determining the target image signature based on the image hash value of the target container image, and determining the target image identifier based on the image name of the target container image; determining the image signature to be matched based on the target image identifier and the correspondence between the image signature and the image identifier; if the target image signature is the same as the image signature to be matched, determining that the target container image signature verification has passed; if the target image signature is different from the image signature to be matched, determining that the target container image signature verification has failed.
[0034] The above technical solution has the following beneficial effects:
[0035] The embodiment of the present application provides a method for secure deployment of container images, which is scheduled and executed by a Jenkins pipeline, and includes: a secure identification server requests a target container image from a secure container image repository based on a container deployment request sent by a container deployment server; the secure identification server obtains the target container image sent by the secure container image repository, and performs signature verification on the target container image based on the correspondence between the image signature and the image identifier; in response to the signature verification being passed, the secure identification server sends the target container image to the container deployment server, so that the container deployment server deploys the target container image. In the embodiment of the present application, the security risk of container image tampering is avoided by verifying the signature of the container image to be deployed based on the security identification server; in addition, the method for secure deployment of container images provided in the embodiment of the present application is automatically scheduled and executed by the Jenkins pipeline, which improves the deployment efficiency and security of container images.
[0036] The embodiment of the present application also provides a system corresponding to the above method, which has the same beneficial effects as the above method. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] Figure 1 A schematic diagram of the structure of a container image security deployment system provided in an embodiment of the present application;
[0038] Figure 2 A flowchart of a method for securely deploying a container image provided in an embodiment of the present application;
[0039] Figure 3 A flowchart of another method for securely deploying container images provided in an embodiment of the present application. DETAILED DESCRIPTION
[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0041] To ensure the safe deployment of container images, the present application embodiment provides a method for safe deployment of container images, which can be executed by Jenkins pipeline scheduling. Figure 1 The container image security deployment system provided includes: Jenkins server Server1, code warehouse server Server2, container compilation node Server3, secure container image warehouse Server4, security authentication server Server5, and container deployment server Server6.
[0042] Jenkins server Server1 can schedule other services Server2 to Server6 based on the Jenkins pipeline.
[0043] The code repository server Server2 is used to store business source code and container image building instructions Dockerfile. Dockerfile is a text file that contains all the instructions for building a Docker image. Dockerfile defines the image building process through a series of instructions. These instructions describe how to start from the base image, add, modify or install necessary software and configuration, and finally generate a new Docker image. These instructions can be about setting up the working environment, installing software, defining environment variables, etc., to ensure that the image has all the required functions and configurations.
[0044] The container compilation node Server3 is used to receive the business source code and container image building instructions pushed by the Jenkins server Server1, and provide a secure compilation environment for making business container images.
[0045] The secure container image repository Server4 is used to store business container images that have been signed and encrypted.
[0046] The security authentication server Server5 is used to sign and encrypt the business container image, and in response to the container deployment request of the container deployment server Server6, pull the business container image from the security container image repository Server4, perform signature verification on the pulled business container image, and forward the business container image that passes the signature verification to the container deployment server Server6.
[0047] The container deployment server Server6 is used to only allow the container image to be deployed to be pulled by the security authentication server Server5 after being signed based on the pre-set network security policy, so as to ensure that the image has not been tampered with.
[0048] It should be noted that the embodiment of the present application does not limit the deployment method of Server1 to Server6 in actual applications. Technical personnel can deploy different services separately on different servers, or deploy some or all of the services on one server as appropriate. The embodiment of the present application does not limit this.
[0049] Combine the following Figure 2 A method for securely deploying a container image provided in an embodiment of the present application is described. The method may include:
[0050] Step S100: The security authentication server requests a target container image from the secure container image repository based on the container deployment request sent by the container deployment server.
[0051] Among them, the container deployment server sends a container deployment request to the security authentication server, and the container deployment request is used to request a target container image. After receiving the container deployment request, the security authentication server requests the target container image from the secure container image repository.
[0052] It can be understood that the target container image is the container image required by the container deployment task, and the container deployment request should at least include the image name of the target container image.
[0053] Step S200: The security authentication server obtains the target container image sent by the secure container image repository, and performs signature verification on the target container image based on the correspondence between the image signature and the image identifier.
[0054] Specifically, the security authentication server requests the target container image from the secure container image repository based on the container deployment request, receives the target container image returned by the secure container image repository, and performs signature verification on the target container image based on the correspondence between the image signature and the image identifier. The correspondence between the image signature and the image identifier is generated by the security authentication server for the business container image when the container compilation node stores the generated business container image in the secure container image repository.
[0055] In an optional implementation, a method for generating a correspondence between an image signature and an image identifier includes: a security identification server generates an image signature of a business container image and an image identifier of the business container image; wherein the image signature of the business container image is obtained by signing and encrypting an image hash value of the business container image using a signature encryption algorithm, and the image identifier of the business container image is generated based on an image name of the business container image; the security identification server saves the image signature of the business container image and the image identifier of the business container image in correspondence to obtain a correspondence between the image signature and the image identifier.
[0056] Specifically, the security authentication server uses a signature encryption algorithm to sign and encrypt the image hash value of the business container image to obtain the image signature of the business container image, and generates the image identifier of the business container image based on the image name of the business container image, wherein the image identifier of the business container image is used to uniquely identify the business container image. Finally, the security authentication server saves the image signature of the business container image and the image identifier of the business container image in a one-to-one correspondence, that is, obtains the corresponding relationship between the image signature and the image identifier.
[0057] Among them, each container image has a corresponding image hash value, which is a unique identifier for each container image. The hash value of the container image is calculated on all layers and metadata of the image using the SHA-256 hash algorithm. This algorithm can generate a fixed-length hash value for the input data, ensuring that the result of each calculation is unique, thereby providing an unchangeable identifier for the image.
[0058] The signature encryption algorithm is not specifically limited in the embodiments of the present application. Optionally, the signature encryption algorithm may include an SM2 elliptic curve public key cryptography algorithm.
[0059] The embodiment of the present application does not limit the method of generating the image identifier of the business container image based on the image name of the business container image. Optionally, the image identifier corresponding to the image name of the business container image can be obtained based on the Snowflake algorithm (Snowflake) or the secure hash algorithm (SHA-1).
[0060] In an optional implementation, the signature verification of the target container image based on the correspondence between the image signature and the image identifier in the above step S200 includes:
[0061] Step S201: Obtain the image hash value and image name of the target container image.
[0062] The security authentication server obtains an image hash value and an image name of the target container image, wherein the image hash value is sent by the secure container image repository, and the image name can be determined based on the target container image.
[0063] Step S202: determining a target image signature based on the image hash value of the target container image, and determining a target image identifier based on the image name of the target container image.
[0064] The method for obtaining the target image signature and the target image identifier is the same as the method for obtaining the image signature and the image identifier of the business container image provided in the aforementioned embodiment, and will not be repeated here.
[0065] Step S203: Determine the image signature to be matched based on the target image identifier and the correspondence between the image signature and the image identifier.
[0066] Specifically, the security authentication server determines the image signature corresponding to the target image identifier from the correspondence between the pre-stored image signature and the image identifier based on the target image identifier, that is, the image signature to be matched. It can be understood that when there is no target image identifier or there is no image signature corresponding to the target image identifier, it can be determined that the container image has been tampered with, and the subsequent steps are no longer executed.
[0067] Step S204: If the target image signature is the same as the image signature to be matched, it is determined that the target container image signature verification has passed; if the target image signature is different from the image signature to be matched, it is determined that the target container image signature verification has failed.
[0068] Specifically, the target image signature is matched and compared with the image signature to be matched. If the two are the same, it is determined that the target container image signature verification has passed, that is, the container image has not been tampered with; if the two are different, it is determined that the target container image signature verification has failed, that is, the container image has been tampered with, and subsequent deployment tasks will not be executed, and error information will be fed back.
[0069] Step S300: In response to the signature verification being passed, the security authentication server sends the target container image to the container deployment server, so that the container deployment server deploys the target container image.
[0070] Specifically, when the security authentication server passes the signature verification of the target container image, the target container image is sent to the container deployment server, and the container deployment server can perform secure deployment based on the target container image. As can be seen from the above, in this embodiment of the present application, the container deployment server does not directly obtain the container image from the secure container image repository, but obtains it through the security authentication server, and the security authentication server implements the signature verification of the container image pulled from the secure container image repository to ensure that the target container image has not been tampered with and to ensure the security of the container image deployment.
[0071] In an optional implementation, the container image secure deployment method provided in an embodiment of the present application also includes: the Jenkins server obtains the business source code and container image building instructions from the code repository server; the container compilation node builds the business container image based on the business source code and container image building instructions sent by the Jenkins server, and stores the business container image in the secure container image repository, where the target container image is any business container image in the secure container image repository.
[0072] Among them, the business source code is the code used to make the business container image to realize the business function. It is generally pre-compiled by the staff and stored in the code warehouse server. The container image building instruction is specifically Dockerfile. Dockerfile is a text file that contains all the instructions for building the container image. Dockerfile is also pre-written by the staff and stored in the code warehouse server.
[0073] Specifically, the container compilation node stores the constructed business container image in the secure container image repository in advance. The subsequent container deployment server requests the target container image from the secure authentication server according to the required image container, and the secure authentication server pulls the corresponding image container from the secure container image repository.
[0074] Refer to the following Figure 3 A flow chart of another method for securely deploying a container image is shown, the method comprising:
[0075] (1) The Jenkins pipeline schedules the Jenkins server to obtain the business source code and Dockerfile from the code repository server, and pushes the business source code and Dockerfile to the container compilation node;
[0076] (2) The container compiles the node business source code and Dockerfile to build a business container image, and pushes the prepared business container image to the secure container image repository;
[0077] (3) After receiving the business container image, the secure container image repository returns the image hash value corresponding to the business container image to the container compilation node and feeds back a completion mark to the container compilation node;
[0078] (4) The container compilation node sends the image name and image hash value of the business container image to the security authentication server. The security authentication server uses the signature encryption algorithm to sign and encrypt the image hash value to obtain the image signature, determine the image identifier based on the image name, and save the two in a one-to-one correspondence to obtain the corresponding relationship between the image signature and the image identifier for subsequent signature verification. After saving, the container compilation node feeds back the successful signature mark, and the container compilation node further feeds back the successful signature mark to the Jenkins server.
[0079] (5) The Jenkins server sends a container deployment task to the container deployment server, and the container deployment server sends a container deployment request to the security authentication server to request a target container image. The target container image is any business container image stored in the secure container image repository. It should be noted that the target container image needs to complete the signature encryption link in step (4) above.
[0080] (6) The security authentication server pulls the target container image from the secure container image repository, and the secure container image repository sends the target container image and the image hash value corresponding to the target container image to the security authentication server;
[0081] (7) The security authentication server determines the image ID of the target container image based on its image name, determines the image signature to be matched based on the image ID and the correspondence between the pre-stored image signature and the image ID, and uses a signature encryption algorithm to sign and encrypt the image hash value of the target container image to obtain the target image signature; finally, the image signature to be matched is compared with the target image signature to determine the signature verification result;
[0082] (8) If the target image signature is the same as the image signature to be matched, it is determined that the target container image signature verification has passed, and the container deployment server can further complete the deployment task based on the target container image. If the target image signature is different from the image signature to be matched, it is determined that the target container image signature verification has failed, the container deployment task is no longer executed, and an error message is fed back.
[0083] In summary, the embodiment of the present application provides a method for secure deployment of container images, which is scheduled and executed by the Jenkins pipeline. When executing the method, the container image to be deployed is signed based on the security authentication server to avoid the security risk of tampering with the container image; in addition, the method for secure deployment of container images provided by the embodiment of the present application is automatically scheduled and executed by the Jenkins pipeline, which improves the deployment efficiency and security of the container image.
[0084] Corresponding to the above method, the embodiment of the present application also provides a container image security deployment system, the structural diagram of which can be referred to as Figure 1The system is executed by the Jenkins pipeline scheduling, and includes: Jenkins server Server1, code repository server Server2, container compilation node Server3, secure container image repository Server4, security authentication server Server5, container deployment server Server6. Among them,
[0085] A security authentication server, used to request a target container image from a secure container image repository based on a container deployment request sent by a container deployment server;
[0086] The security authentication server is also used to obtain the target container image sent by the secure container image repository, and perform signature verification on the target container image based on the correspondence between the image signature and the image identifier;
[0087] The security authentication server is also used to send the target container image to the container deployment server after the signature verification of the target container image is passed, so that the container deployment server deploys the target container image.
[0088] In an optional implementation,
[0089] Jenkins server, used to obtain business source code and container image building instructions from the code repository server;
[0090] The container compilation node is used to build a business container image based on the business source code and container image building instructions sent by the Jenkins server, and store the business container image in a secure container image repository.
[0091] In an optional implementation, the security authentication server is further used to generate an image signature of the business container image and an image identifier of the business container image; wherein the image signature of the business container image is obtained by signing and encrypting the image hash value of the business container image using a signature encryption algorithm, and the image identifier of the business container image is generated based on the image name of the business container image;
[0092] The security authentication server is also used to store the image signature of the business container image and the image identifier of the business container image in correspondence to obtain the corresponding relationship between the image signature and the image identifier.
[0093] In an optional implementation, the signature encryption algorithm includes an SM2 elliptic curve public key cryptography algorithm.
[0094] In an optional implementation, the security authentication server is used to perform signature verification on the target container image based on the correspondence between the image signature and the image identifier, specifically including: obtaining the image hash value and the image name of the target container image; determining the target image signature based on the image hash value of the target container image, and determining the target image identifier based on the image name of the target container image; determining the image signature to be matched based on the target image identifier and the correspondence between the image signature and the image identifier; if the target image signature is the same as the image signature to be matched, determining that the target container image signature verification has passed, if the target image signature is different from the image signature to be matched, determining that the target container image signature verification has failed.
[0095] It should be noted that the steps executed by each module in a container image security deployment system provided in an embodiment of the present application and the related technical features correspond to the method provided in the embodiment of the application. The description of the device part can be found in the embodiment of the aforementioned method part and will not be repeated here.
[0096] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.
[0097] Those skilled in the art can understand that the flowchart shown in the figure is only an example in which the embodiments of the present application can be implemented, and the scope of application of the embodiments of the present application is not limited by any aspect of the flowchart.
[0098] In the several embodiments provided in the present application, it should be understood that the disclosed methods, devices and equipment can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.
[0099] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
[0100] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0101] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for secure deployment of container images, characterized in that: The method is executed by Jenkins pipeline scheduling, and the method includes: The security authentication server requests the target container image from the secure container image repository based on the container deployment request sent by the container deployment server; The security authentication server obtains the target container image sent by the secure container image repository, and performs signature verification on the target container image based on the correspondence between the image signature and the image identifier; In response to the signature verification being passed, the security authentication server sends the target container image to the container deployment server, so that the container deployment server deploys the target container image.
2. The method according to claim 1, characterized in that: The method further comprises: The Jenkins server obtains the business source code and container image building instructions from the code repository server; The container compilation node builds a business container image based on the business source code and the container image building instruction sent by the Jenkins server, and stores the business container image in the secure container image repository, wherein the target container image is any business container image in the secure container image repository.
3. The method according to claim 2, characterized in that The method further comprises: The security authentication server generates an image signature of the business container image and an image identifier of the business container image; wherein the image signature of the business container image is obtained by signing and encrypting the image hash value of the business container image using a signature encryption algorithm, and the image identifier of the business container image is generated based on the image name of the business container image; The security authentication server stores the image signature of the business container image and the image identifier of the business container image in correspondence with each other, so as to obtain a corresponding relationship between the image signature and the image identifier.
4. The method according to claim 3, characterized in that The signature encryption algorithm includes the SM2 elliptic curve public key cryptography algorithm.
5. The method according to claim 3, characterized in that: The performing signature verification on the target container image based on the correspondence between the image signature and the image identifier includes: Obtain the image hash value and image name of the target container image; Determine the target image signature based on the image hash value of the target container image, and determine the target image identifier based on the image name of the target container image; Determine the image signature to be matched based on the target image identifier and the corresponding relationship between the image signature and the image identifier; If the target image signature is the same as the image signature to be matched, it is determined that the target container image signature verification has passed; if the target image signature is different from the image signature to be matched, it is determined that the target container image signature verification has failed.
6. A container image security deployment system, characterized in that: The system is executed by Jenkins pipeline scheduling, and the system includes: a secure container image repository, a security authentication server and a container deployment server; wherein, The security authentication server is used to request a target container image from the secure container image repository based on the container deployment request sent by the container deployment server; The security authentication server is further used to obtain the target container image sent by the secure container image repository, and perform signature verification on the target container image based on the correspondence between the image signature and the image identifier; The security authentication server is further configured to send the target container image to the container deployment server when the signature verification of the target container image passes, so that the container deployment server deploys the target container image.
7. The system according to claim 6, characterized in that The system also includes: a Jenkins server, a code repository server, and a container compilation node; wherein, The Jenkins server is used to obtain business source code and container image building instructions from the code warehouse server; The container compilation node is used to build a business container image based on the business source code and the container image building instruction sent by the Jenkins server, and store the business container image in the secure container image warehouse.
8. The system according to claim 7, characterized in that The security authentication server is further used to generate an image signature of the business container image and an image identifier of the business container image; wherein the image signature of the business container image is obtained by signing and encrypting the image hash value of the business container image using a signature encryption algorithm, and the image identifier of the business container image is generated based on the image name of the business container image; The security authentication server is further used to store the image signature of the business container image and the image identifier of the business container image in correspondence to obtain a corresponding relationship between the image signature and the image identifier.
9. The system according to claim 8, characterized in that The signature encryption algorithm includes the SM2 elliptic curve public key cryptography algorithm.
10. The system according to claim 9, characterized in that The security authentication server is used to perform signature verification on the target container image based on the correspondence between the image signature and the image identifier, specifically including: obtaining the image hash value and the image name of the target container image; determining the target image signature based on the image hash value of the target container image, and determining the target image identifier based on the image name of the target container image; determining the image signature to be matched based on the target image identifier and the correspondence between the image signature and the image identifier; if the target image signature is the same as the image signature to be matched, determining that the target container image signature verification has passed, and if the target image signature is different from the image signature to be matched, determining that the target container image signature verification has failed.