Configuration method and device for attack and defense drilling in cloud native environment and electronic equipment

Abstract

The embodiment of the invention provides an attack and defense drill configuration method and device in a cloud native environment and electronic equipment, and the method comprises the steps: obtaining a first application definition file corresponding to a target container in response to a received attack and defense drill configuration instruction; performing configuration modification on the first application definition file to obtain a second application definition file; the execution of configuration modification comprises: adding or deleting an installation instruction of the probe; the probe is an application program used for executing attack and defense drilling; and deploying the second application definition file on the cloud native platform, so that the cloud native platform creates a container for opening or closing the attack and defense drill function based on the second application definition file. On the premise that a business party does not need to issue a version on line, switching of the attack and defense drill function of a specific container is completed. And an implementation party of the attack and defense drill is supported to implement high-standard random-time attacks.

Description

Technical Field

[0001] The invention of the present application relates to the field of cloud computing technology, and in particular to a configuration method, device and electronic equipment for attack and defense drills in a cloud-native environment. Background Art

[0002] In order to improve the stability and robustness of each business system, various failure scenarios that may be encountered during system operation can be simulated for drills. This process is called attack and defense drills.

[0003] In a cloud-native environment, preparatory work is required before attack and defense drills. For some attack and defense drills, authorization is required through application definition files, which leads to the following problems: 1) The business party needs to conduct a regular release to take effect, which makes the preparation cost of attack and defense drills extremely high. And because the business party conducts the release and launches the version by itself, the business party must be notified before the attack and defense drill, so the attacker cannot carry out a truly high-standard attack, such as a raid at a random time. 2) Authorization through application definition files is equivalent to creating a security vulnerability, allowing external processes to enter the container to execute commands or scripts and launch security attacks on the host. That is, this authorization cannot exist normally, and the authorization must be terminated immediately after the attack and defense drill is completed. This requires the business party to immediately conduct a new release and launch after completing the attack and defense drill. Turning off the authorization configuration in the application definition file will also consume a lot of manpower and material resources. Summary of the invention

[0004] The purpose of the embodiment of the present application is to provide a configuration method, device and electronic device for attack and defense drills in a cloud native environment, so as to achieve the switching of the function drill function of a specific container without the business party having to release a version online. And support the implementer of the attack and defense drill to implement high-standard random time attacks. The specific technical solution is as follows:

[0005] In a first aspect of the present application, a method for configuring an attack and defense drill in a cloud native environment is provided, the method comprising:

[0006] In response to receiving the attack and defense drill configuration instruction, obtaining a first application definition file corresponding to the target container;

[0007] Performing configuration modification on the first application definition file to obtain a second application definition file; the performing configuration modification includes: adding or deleting installation instructions of a probe; the probe is an application program used to perform attack and defense drills;

[0008] The second application definition file is deployed on a cloud native platform, so that the cloud native platform creates a container that turns on or off an attack and defense drill function based on the second application definition file.

[0009] Optionally, the attack and defense drill configuration instruction includes: an attack and defense drill function opening instruction or a closing instruction;

[0010] When the attack and defense drill configuration instruction is the start instruction, the first application definition file is an application definition file released by the business party; the execution configuration is modified to: add the installation instruction;

[0011] When the attack and defense drill configuration instruction is the closing instruction, the first application definition file is: an application definition file with the installation instruction added on the basis of the application definition file released by the business party; and the execution configuration is modified to: delete the installation instruction.

[0012] Optionally, the step of performing configuration modification on the first application definition file includes:

[0013] Identifying lifecycle configuration information of the first application definition file;

[0014] A hook command for installing the probe is added or deleted in the lifecycle configuration information.

[0015] Optionally, the attack and defense drill configuration instruction carries a drill type, and the drill type includes: unauthorized type and authorized type; the authorized type of attack and defense drill includes: an attack and defense drill involving network failures;

[0016] Before obtaining the first application definition file corresponding to the target container, the method further includes:

[0017] Determine the type of drill for the attack and defense drill;

[0018] If the drill type is an authorization type; the step of performing configuration modification on the first application definition file further includes:

[0019] identifying a security context of the first application definition file;

[0020] The network permission configuration item defined in the security context is turned on or off; the network permission configuration item being in the turned-on state indicates that the target container has the permission to modify the network configuration of the host machine.

[0021] Optionally, if the drill type is an unauthorized type, executing the step of performing configuration modification on the first application definition file, or performing online configuration of the attack and defense drill;

[0022] The step of configuring the attack and defense drill online includes: sending a command for installing or uninstalling a probe to the target container; the probe is an application program for executing the attack and defense drill.

[0023] Optionally, after deploying the second application definition file on the cloud native platform, the method further includes:

[0024] If a new version of the application definition file released by the business party is received, the new version of the application definition file is deployed on the cloud native platform so that the cloud native platform deletes the container created based on the second application definition file and creates a container based on the new version of the application definition file.

[0025] In a second aspect of the present application, a configuration device for attack and defense drills in a cloud native environment is provided, the device comprising:

[0026] an acquisition module, configured to acquire a first application definition file corresponding to a target container in response to receiving an attack and defense drill configuration instruction;

[0027] A configuration module, configured to perform configuration modification on the first application definition file to obtain a second application definition file; the configuration modification includes: adding or deleting installation instructions of a probe; the probe is an application program for performing attack and defense drills;

[0028] The first deployment module is used to deploy the second application definition file on a cloud native platform, so that the cloud native platform creates a container for turning on or off an attack and defense drill function based on the second application definition file.

[0029] Optionally, the attack and defense drill configuration instruction includes: an attack and defense drill function opening instruction or a closing instruction;

[0030] When the attack and defense drill configuration instruction is the start instruction, the first application definition file is an application definition file released by the business party; the configuration module is specifically used to: add the installation instruction;

[0031] When the attack and defense drill configuration instruction is the closing instruction, the first application definition file is: an application definition file that adds the installation instruction based on the application definition file released by the business party; the configuration module is specifically used to: delete the installation instruction.

[0032] Optional, configuration module, specifically for:

[0033] Identifying lifecycle configuration information of the first application definition file;

[0034] A hook command for installing the probe is added or deleted in the lifecycle configuration information.

[0035] Optionally, the attack and defense drill configuration instruction carries a drill type, and the drill type includes: unauthorized type and authorized type; the authorized type of attack and defense drill includes: an attack and defense drill involving network failures;

[0036] Optionally, the device further includes: a determination module, configured to determine a drill type of the attack and defense drill before obtaining the first application definition file corresponding to the target container;

[0037] If the drill type is an authorization type; the configuration module is further used to:

[0038] identifying a security context of the first application definition file;

[0039] The network permission configuration item defined in the security context is turned on or off; the network permission configuration item being in the turned-on state indicates that the target container has the permission to modify the network configuration of the host machine.

[0040] Optionally, if the drill type is an unauthorized type, the configuration module is triggered, or an online configuration module is triggered,

[0041] The online configuration module is specifically used to: send a command for installing or uninstalling a probe to the target container; the probe is an application program used to perform attack and defense drills.

[0042] Optionally, the device further comprises:

[0043] The second deployment module is used to deploy the new version of the application definition file on the cloud native platform after the second application definition file is deployed on the cloud native platform, if a new version of the application definition file released by the business party is received, so that the cloud native platform deletes the container created based on the second application definition file and creates a container based on the new version of the application definition file.

[0044] In a third aspect of the present application, an electronic device is provided, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0045] Memory, used to store computer programs;

[0046] The processor is used to implement any of the configuration method steps of the attack and defense drill in the cloud native environment when executing the program stored in the memory.

[0047] In a fourth aspect of the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, any of the steps of the configuration method of attack and defense drills in a cloud-native environment is implemented.

[0048] In a fifth aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements any of the steps of the configuration method for attack and defense drills in a cloud-native environment.

[0049] The configuration method, device and electronic device for attack and defense drills in a cloud-native environment provided by the embodiments of the present application do not require the business party to directly connect to the cloud-native platform. When the attack and defense drill function needs to be turned on or off, the business party does not need to re-release the business. The application definition file is parsed and modified by the application platform, and the modified application definition file is deployed on the cloud-native platform. The cloud-native platform automatically deletes and rebuilds the container according to the existing mechanism, and completes the switching of the function drill function of a specific container without the business party having to release the version online. The cost of configuring the attack and defense drill function for the business party is greatly reduced. In addition, since the configuration of the attack and defense drill is performed by the application platform, it is not necessary to inform the business party of the attack and defense drill message in advance, thereby supporting the implementer of the attack and defense drill to implement high-standard attacks, such as raids at random times. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0051] Figure 1 A first flow chart of a configuration method for attack and defense drills in a cloud-native environment provided in an embodiment of the present application;

[0052] Figure 2 A second flow chart of a method for configuring attack and defense drills in a cloud-native environment provided in an embodiment of the present application;

[0053] Figure 3 A third flow chart of a configuration method for attack and defense drills in a cloud-native environment provided in an embodiment of the present application;

[0054] Figure 4 A structural schematic diagram of a configuration device for attack and defense drills in a cloud native environment provided in an embodiment of the present application;

[0055] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0057] In order to improve the stability and robustness of each business system, various failure scenarios that may be encountered during system operation can be simulated for drills. This process is called attack and defense drills.

[0058] In a cloud-native environment, you need to do some preparatory work before conducting an attack and defense drill. For some attack and defense drills, you need to authorize through application definition files, which may cause problems, as follows:

[0059] 1) The business side needs to conduct a regular version release before it can take effect, which makes the preparation cost of attack and defense drills extremely high. And because the business side releases the version online by themselves, the business side must be notified before the attack and defense drill, so the attacker cannot implement a truly high-standard attack, such as a raid at a random time. 2) Authorization through the application definition file is equivalent to creating a security vulnerability, allowing external processes to enter the container to execute commands or scripts and launch security attacks on the host machine. That is, this authorization cannot exist on a regular basis, and the authorization must be terminated immediately after the attack and defense drill is completed. This requires the business side to immediately release a new version online after completing the attack and defense drill. Disabling the authorization configuration in the application definition file will also consume more manpower and material resources.

[0060] In order to solve the above technical problems, the embodiments of the present application provide a configuration method, device and electronic device for attack and defense drills in a cloud native environment. Figure 1 , which is a first flow chart of a configuration method for attack and defense drills in a cloud native environment provided by an embodiment of the present application, comprising the following steps:

[0061] S101: In response to receiving an attack and defense drill configuration instruction, obtaining a first application definition file corresponding to a target container.

[0062] For ease of understanding, a brief introduction to attack and defense drills is given. Attack and defense drills refer to: in order to improve the stability and robustness of various business systems, relevant tests are performed by simulating various failure scenarios that may be encountered during system operation. Involving different types such as network failures, CPU load, memory load, security attacks, network high-traffic stress tests, database / cache failures, etc. The objects of attack and defense drills include physical machines, virtual machines, containers, etc. This application is mainly aimed at containers in cloud-native environments.

[0063] The cloud native environment is a new type of cloud computing technology system based on technologies such as containers, microservices, and DevOps (development and operations), which aims to improve the development, deployment, and operation and maintenance efficiency of applications. The cloud native environment is based on containerization and realizes the decoupling and scalability of services through a microservice architecture. In the embodiments of this application, the Kubernetes (k8s) cloud native platform is used as an example for illustration.

[0064] In the embodiment of the present application, an application platform is provided for the business party, so that the business party does not directly connect to the cloud native platform, but connects to the cloud native platform through the application platform provided by the embodiment of the present application. For example, if the business party wants to deploy a business on the k8s platform, it can publish a version through the application platform, and the application platform will pass the data required to create the container to the k8s platform, and then the k8s platform will create a container for running the business party's business.

[0065] Among them, the above-mentioned application platform can be built based on a cloud native platform and can be integrated in the cloud native platform. As a part of the cloud native platform, it provides the ability to configure attack and defense drills to be turned on or off.

[0066] The configuration method of attack and defense drills in a cloud-native environment provided in an embodiment of the present application is applied to the above-mentioned application platform.

[0067] In this step, in response to receiving the configuration instruction of the attack and defense drill, the first application definition file corresponding to the target container is obtained, wherein the target container is the container targeted by the attack and defense drill configuration.

[0068] As an example, the target container may be specified by the business party. In this case, the business party has been informed in advance that the attack and defense drill configuration is to be performed, and the configuration instruction is initiated by the business party.

[0069] As another example, the target container can be randomly determined or specified by the implementer of the attack and defense drill. That is, the implementer of the attack and defense drill can also log in to the application platform provided by the embodiment of the present application. Usually, the implementer of the attack and defense drill and the business party belong to the same enterprise. The implementer can conduct attack and defense drills on part of the business party's business without notifying the business party, that is, the implementer specifies the target container for the attack and defense drill. In this example, the business party will not be informed in advance that an attack and defense drill will be conducted, so that a higher standard of attack can be implemented, such as a raid at a random time.

[0070] In the embodiment of the present application, the attack and defense drill configuration for the target container is actually the switching of the attack and defense drill function for the target container, that is, turning on or off the attack and defense drill function.

[0071] Application definition files are usually written in YAML format and are used to describe application-related information. The application definition file involved in the embodiment of the present application is a Deployment component description file based on Kubernetes, which usually defines the specifications of the containers deployed on the Kubernetes cluster (capacity size, number of copies, life cycle, etc.). The definition file is deployed to the cluster through the Kubernetes API, and the cluster will create the containers required for the application according to the requirements declared in the file. These containers are called containers managed by this definition file.

[0072] In this step, the first application definition file corresponding to the target container is obtained, that is, the application definition file used by the k8s platform to create the target container. The application definition file is created by the business party.

[0073] S102: Perform configuration modification on the first application definition file to obtain a second application definition file; performing configuration modification includes: adding or deleting installation instructions of a probe; the probe is an application program used to perform attack and defense drills.

[0074] The application definition file follows a specific format (YAML), so the meaning of each field in the application definition file is determined, so that the application platform can recognize the meaning of each field in the application definition file and can make configuration modifications at specific locations.

[0075] In one embodiment of the present application, the attack and defense drill configuration instruction includes: an attack and defense drill function start instruction or a defense drill function close instruction.

[0076] Specifically, if the attack and defense drill function of the target container needs to be enabled, the attack and defense drill configuration instruction is the enable instruction. In this case, the first application definition file is the application definition file released by the business party. Accordingly, the following configuration modification is performed on the first application definition file: adding the installation instruction of the probe; the probe is an application used to perform the attack and defense drill.

[0077] The probe is the probe of the attack and defense drill management system, which is actually an application program used to communicate with the attack and defense drill management system when the attack and defense drill is implemented, so as to receive and execute the commands issued by the attack and defense drill management system. That is, the probe can be understood as an application program used to execute the attack and defense drill.

[0078] If the attack and defense drill function of the target container needs to be turned off, the attack and defense drill configuration instruction is the turn-off instruction. In this case, the first application definition file is an application definition file that has been added with installation instructions based on the application definition file released by the business party. Accordingly, the following configuration modification is performed on the first application definition file: the installation instruction of the probe is deleted. That is, the modified application definition file is rolled back to the version released by the business party.

[0079] S103: Deploy the second application definition file on the cloud native platform, so that the cloud native platform creates a container for turning on or off the attack and defense drill function based on the second application definition file.

[0080] The application platform deploys the second application definition file on the cloud native platform, for example, by sending the second application definition file to a specified cluster through a k8s API.

[0081] Regarding the activation of the attack and defense drill function, according to the mechanism of the cloud native platform, the cloud native platform will automatically rebuild a new container based on the newly deployed second application definition file. Since the second application definition file contains the installation instructions of the probe, the installation instructions will be executed when a new container is created. The newly created container will have the probe installed, which is equivalent to enabling the attack and defense drill function.

[0082] Regarding the shutdown of the attack and defense drill function, according to the mechanism of the cloud native platform, the cloud native platform will automatically rebuild a new container based on the newly deployed second application definition file. Since the second application definition file does not contain the installation instructions of the probe, the newly created container will not have the probe installed, which is equivalent to shutting down the attack and defense drill function.

[0083] By applying the configuration method of attack and defense drills in a cloud-native environment provided by the embodiment of the present application, the business party does not need to directly connect to the cloud-native platform. When the attack and defense drill function needs to be turned on or off, the business party does not need to re-release the business. The application platform parses and modifies the application definition file, and deploys the modified application definition file on the cloud-native platform. The cloud-native platform automatically deletes and rebuilds the container according to the existing mechanism, and completes the switching of the function drill function of a specific container without the business party having to release the version online. The cost of configuring the attack and defense drill function for the business party is greatly reduced. In addition, since the configuration of the attack and defense drill is performed by the application platform, there is no need to inform the business party of the attack and defense drill news in advance, thereby supporting the implementers of the attack and defense drill to implement high-standard attacks, such as raids at random times.

[0084] It can be seen that the embodiment of the present application provides a method of performing hidden version updates and version rollbacks on the business party's K8s application through the application platform without the business party having to perform version release operations, and encapsulating it into a simple on / off attack and defense authorization button to provide services. The cost of preparatory work for online applications to conduct attack and defense drills is greatly reduced, and since the preparation work for attack and defense drills is performed by the application platform, there is no need to notify the business party in advance, thus providing conditions for implementing higher-level random attack and defense drills.

[0085] In one embodiment of the present application, the step of performing configuration modification on the first application definition file includes: identifying lifecycle configuration information of the first application definition file; and adding or deleting a hook command for installing a probe in the lifecycle configuration information.

[0086] Specifically, to enable the attack and defense drill function, identify the lifecycle configuration information in the first application definition file and modify it. Specifically, add a "post-start" hook command for installing the probe, which is the postStart hook command, which is used to instruct the container to perform specific operations after startup.

[0087] Therefore, after adding a hook command for installing the probe in the lifecycle configuration information, the container created based on the modified application definition file will automatically perform the operation of installing the probe after starting.

[0088] To disable the attack and defense drill function, identify the lifecycle configuration information in the first application definition file and modify it, specifically, delete the "after startup" hook command for installing the probe.

[0089] Therefore, the container created by the cloud native platform based on the modified application definition file will not install the probe.

[0090] It can be seen that in the embodiment of the present application, by identifying the lifecycle configuration information of the first application definition file and adding or deleting the hook command for installing the probe in the lifecycle configuration information, the attack and defense drill function can be turned on and off for the target container. This process uses the cloud native platform's automatic container deletion and reconstruction mechanism, and does not require the business party to release the application, greatly reducing the cost of the business party to configure the attack and defense drill function.

[0091] In one embodiment of the present application, the attack and defense drill configuration instruction carries a drill type, and the drill types include: unauthorized type and authorized type; the authorized type of attack and defense drill includes: attack and defense drill involving network failures.

[0092] Specifically, for attack and defense drills involving network failures, the business container needs to have permission to modify the host's network configuration. However, most containers do not have such permissions by default, so authorization is required by modifying the application definition file.

[0093] See also Figure 2 , which is a second flow chart of a configuration method for attack and defense drills in a cloud native environment provided by an embodiment of the present application, comprising the following steps:

[0094] S201: In response to receiving an attack and defense exercise configuration instruction, determining an attack and defense exercise exercise type. If the exercise type is an authorized type, executing S202.

[0095] S202: Obtain a first application definition file corresponding to the target container, perform configuration modification on the first application definition file, and obtain a second application definition file; performing configuration modification includes: adding or deleting installation instructions of the probe; identifying the security context of the first application definition file; turning on or off the network permission configuration item defined in the security context; the network permission configuration item is in the turned-on state, indicating that the target container has the permission to modify the network configuration of the host machine.

[0096] S203: Deploy the second application definition file on the cloud native platform, so that the cloud native platform creates a container for turning on or off the attack and defense drill function based on the second application definition file.

[0097] Since the attack and defense drill configuration command carries the drill type, the drill type of the attack and defense drill can be directly determined according to the command. Specifically, it includes: unauthorized type and authorized type. Authorized type attack and defense drills include: attack and defense drills involving network failures.

[0098] For attack and defense drills involving network failures, it is necessary to modify some authorization information defined in the security context in the first application definition file.

[0099] Therefore, performing configuration modification not only involves the addition and elaboration of installation instructions, but also requires identifying the security context of the first application definition file and turning on or off the network permission configuration items defined in the security context.

[0100] In cloud native platforms, security contexts define the privileges and access control settings of a Pod or container. These settings affect how a Pod or container runs. That is, the security context contains authorization information for various operations, clarifying whether different operations are allowed.

[0101] As an example, for the K8s platform, the security context is the SecurityContext of the Pod in the K8s specification, which defines some security options for the container to run.

[0102] Common examples: 1. securityContext.privileged = true, which allows certain system commands to be executed in the container. 2. securityContext.capabilities.add grants specified capabilities to the container. For example, adding NET_ADMIN in add allows the container to manage the host's network configuration.

[0103] If the drill type is an authorization type, that is, it involves network failures, the application container needs to have the permission to modify the network configuration of the host machine, based on which the network permission configuration item defined in the security context can be modified. The network permission configuration item is in the open state, indicating that the target container has the permission to modify the network configuration of the host machine.

[0104] It can be seen that in the embodiments of the present application, different configuration processes are executed for different types of attack and defense drills. For attack and defense drills involving network-related failures, the security context part in the first application definition file is located, and the authorization information defined in the security context is modified to meet the needs of attack and defense drills involving network-related failures. This process does not require the business party to perform any operations, and the configuration operations of the attack and defense drills are automatically performed by the application platform, which greatly reduces the cost for the business party to configure the attack and defense drill functions. In addition, since the configuration of the attack and defense drills is performed by the application platform, there is no need to inform the business party of the news of the attack and defense drills in advance, thereby supporting the implementers of the attack and defense drills to implement high-standard attacks, such as raids at random times.

[0105] In addition, the modified application definition file is only deployed to the cluster, and operations such as upgrading the application version will overwrite the modified definition file, thereby revoking the larger permissions granted after the container is restarted, reducing security risks.

[0106] In one embodiment of the present application, if the drill type is an unauthorized type, a step of performing configuration modification on the first application definition file is executed, or an attack and defense drill online configuration is performed; the step of online configuration of the attack and defense drill includes: sending a command for installing or uninstalling a probe to the target container; the probe is an application used to perform attack and defense drills.

[0107] Specifically, for unauthorized attack and defense drills, there is no need to modify permissions for the security context part of the application definition file. Only the installation of the probe needs to be executed, which can be achieved through online configuration, that is, directly issuing specific instructions to the target container.

[0108] See also Figure 3 , which is a third flow chart of a configuration method for attack and defense drills in a cloud native environment provided by an embodiment of the present application, comprising the following steps:

[0109] S301: In response to receiving an attack and defense exercise configuration instruction, determine the exercise type of the attack and defense exercise. If the exercise type is an unauthorized type, execute S302 or S303.

[0110] S302: Obtain a first application definition file corresponding to the target container, perform configuration modification on the first application definition file, and obtain a second application definition file; performing configuration modification includes: adding or deleting installation instructions of a probe; the probe is an application for performing attack and defense drills. Deploy the second application definition file on the cloud native platform, so that the cloud native platform creates a container with an attack and defense drill function turned on or off based on the second application definition file.

[0111] S303: Send a command for installing or uninstalling a probe to the target container; the probe is an application program used to perform attack and defense drills.

[0112] Among them, step S302 is to install the probe by modifying the first application definition file. The modified application definition file needs to be deployed on the cloud native platform so that the cloud native platform rebuilds the container. This process has been described in detail above and will not be repeated here.

[0113] Step S303 is an online configuration method, which installs or deletes the probe by executing commands in the started container. In other words, for unauthorized attack and defense drills, there is no need for the k8s platform to recreate the container. The command for installing or deleting the probe can be directly executed in the started target container to switch the attack and defense drill function of the target container.

[0114] It can be seen that in the embodiments of the present application, the type of attack and defense drill can be determined in advance, and different implementation methods can be adopted according to the type of drill. If the attack and defense drill does not require authorization, there is no need to modify the application definition file. It is only necessary to execute the command for installing or deleting the probe in the running target container. The target container after installing or deleting the probe is the container that completes the attack and defense drill function switching. There is no need for the cloud native platform to re-create the container, which improves configuration efficiency.

[0115] In one embodiment of the present application, after deploying the second application definition file on the cloud native platform, the method further includes:

[0116] If a new version of the application definition file released by the business party is received, the new version of the application definition file is deployed on the cloud native platform so that the cloud native platform deletes the container created based on the second application definition file and creates a container based on the new version of the application definition file.

[0117] In one embodiment of the present application, after deploying the second application definition file on the cloud native platform, the method further includes:

[0118] If a new version of the application definition file released by the business party is received, the new version of the application definition file is deployed on the cloud native platform so that the cloud native platform deletes the container created based on the second application definition file and creates a container based on the new version of the application definition file.

[0119] Specifically, after completing the attack and defense drill, it is necessary to restart the container as soon as possible to take back the larger permissions granted and reduce security risks.

[0120] In the embodiment of the present application, the attack and defense drill can be closed silently by the business party releasing a new version. Specifically, the new version of the application definition file released by the business party is received, and the new version of the application definition file is deployed on the cloud native platform. The cloud native platform will automatically delete the container created based on the second application definition file based on the existing mechanism, and create a container based on the new version of the application definition file.

[0121] Therefore, the business side does not need to issue a command to close the drill function. Instead, after the business side releases a new definition file, the new file is deployed and a new container is automatically created to close the drill.

[0122] Since in the embodiment of the present application, the modification of the application definition file occurs in the application platform and only acts on the cloud native platform, not on the business party, it can be understood as a temporary modification. Therefore, when the business party releases a new version online, the application definition file may still be the original application definition file, or it may be partially modified. Regardless of whether the business party modifies the application definition file, as long as the business party releases a new version online, the application platform receives the new application definition file provided by the business party and deploys it on the cloud native platform. The cloud native platform will automatically create a new container, overwriting the container previously created based on the second application definition file, and realize the closure of the attack and defense drill.

[0123] Based on the same inventive concept, the embodiment of the present application also provides a configuration device for attack and defense drills in a cloud native environment, see Figure 4 , which is a structural diagram of a configuration device for attack and defense drills in a cloud native environment provided by an embodiment of the present application, including the following modules:

[0124] An acquisition module 401 is used to acquire a first application definition file corresponding to a target container in response to receiving an attack and defense drill configuration instruction;

[0125] Configuration module 402, used to perform configuration modification on the first application definition file to obtain a second application definition file; the configuration modification includes: adding or deleting installation instructions of a probe; the probe is an application program used to perform attack and defense drills;

[0126] The first deployment module 403 is used to deploy the second application definition file on the cloud native platform, so that the cloud native platform creates a container for turning on or off the attack and defense drill function based on the second application definition file.

[0127] Therefore, the business side does not need to directly connect to the cloud native platform. When the attack and defense drill function needs to be turned on or off, the business side does not need to re-release the business. The application platform parses and modifies the application definition file, and deploys the modified application definition file on the cloud native platform. The cloud native platform automatically deletes and rebuilds the container according to the existing mechanism, and completes the switching of the function drill function of a specific container without the business side having to release the version online. The cost of configuring the attack and defense drill function for the business side is greatly reduced. In addition, since the configuration of the attack and defense drill is performed by the application platform, there is no need to inform the business side of the attack and defense drill news in advance, thereby supporting the implementers of the attack and defense drill to implement high-standard attacks, such as raids at random times.

[0128] It can be seen that the embodiment of the present application provides a method of performing hidden version updates and version rollbacks on the business party's K8s application through the application platform without the business party having to perform version release operations, and encapsulating it into a simple on / off attack and defense authorization button to provide services. The cost of preparatory work for online applications to conduct attack and defense drills is greatly reduced, and since the preparation work for attack and defense drills is performed by the application platform, there is no need to notify the business party in advance, thus providing conditions for implementing higher-level random attack and defense drills.

[0129] In one embodiment of the present application, the attack and defense drill configuration instruction includes: an attack and defense drill function opening instruction or a closing instruction;

[0130] When the attack and defense drill configuration instruction is the start instruction, the first application definition file is an application definition file released by the business party; the configuration module is specifically used to: add the installation instruction;

[0131] When the attack and defense drill configuration instruction is the closing instruction, the first application definition file is: an application definition file that adds the installation instruction based on the application definition file released by the business party; the configuration module is specifically used to: delete the installation instruction.

[0132] In one embodiment of the present application, the configuration module is specifically used to:

[0133] Identifying lifecycle configuration information of the first application definition file;

[0134] A hook command for installing the probe is added or deleted in the lifecycle configuration information.

[0135] In one embodiment of the present application, the attack and defense drill configuration instruction carries a drill type, and the drill type includes: unauthorized type and authorized type; the authorized type of attack and defense drill includes: an attack and defense drill involving network failures;

[0136] In one embodiment of the present application, the apparatus further includes: a determination module, configured to determine a drill type of the attack and defense drill before obtaining the first application definition file corresponding to the target container;

[0137] If the drill type is an authorization type; the configuration module is further used to:

[0138] identifying a security context of the first application definition file;

[0139] The network permission configuration item defined in the security context is turned on or off; the network permission configuration item being in the turned-on state indicates that the target container has the permission to modify the network configuration of the host machine.

[0140] In one embodiment of the present application, if the drill type is an unauthorized type, the configuration module is triggered, or the online configuration module is triggered.

[0141] The online configuration module is specifically used to: send a command for installing or uninstalling a probe to the target container; the probe is an application program used to perform attack and defense drills.

[0142] In one embodiment of the present application, the device further includes:

[0143] The second deployment module is used to deploy the new version of the application definition file on the cloud native platform after the second application definition file is deployed on the cloud native platform, if a new version of the application definition file released by the business party is received, so that the cloud native platform deletes the container created based on the second application definition file and creates a container based on the new version of the application definition file.

[0144] The present application also provides an electronic device, such as Figure 5 As shown, it includes a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504.

[0145] Memory 503, used for storing computer programs;

[0146] The processor 501 is used to execute the program stored in the memory 503, and implements the following steps:

[0147] In response to receiving the attack and defense drill configuration instruction, obtaining a first application definition file corresponding to the target container;

[0148] Performing configuration modification on the first application definition file to obtain a second application definition file; the performing configuration modification includes: adding or deleting installation instructions of a probe; the probe is an application program used to perform attack and defense drills;

[0149] The second application definition file is deployed on a cloud native platform, so that the cloud native platform creates a container that turns on or off an attack and defense drill function based on the second application definition file.

[0150] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0151] The communication interface is used for communication between the above terminal and other devices.

[0152] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0153] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0154] In another embodiment provided by the present invention, a computer-readable storage medium is also provided, in which a computer program is stored. When the computer program is executed by a processor, the configuration method of attack and defense drills in a cloud-native environment described in any of the above embodiments is implemented.

[0155] In another embodiment provided by the present invention, a computer program product including instructions is also provided. When the computer is run on a computer, the computer executes the configuration method of attack and defense drills in a cloud native environment described in any of the above embodiments.

[0156] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0157] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0158] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, computer storage medium, and computer program product embodiments, since they are basically similar to the configuration method embodiment of the attack and defense drill in the cloud native environment, the description is relatively simple, and the relevant parts can be referred to the partial description of the configuration method embodiment of the attack and defense drill in the cloud native environment.

[0159] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A configuration method for attack and defense drills in a cloud native environment, characterized in that: The method comprises: In response to receiving the attack and defense drill configuration instruction, obtaining a first application definition file corresponding to the target container; Performing configuration modification on the first application definition file to obtain a second application definition file; the performing configuration modification includes: adding or deleting installation instructions of a probe; the probe is an application program used to perform attack and defense drills; The second application definition file is deployed on a cloud native platform, so that the cloud native platform creates a container that turns on or off an attack and defense drill function based on the second application definition file.

2. The method according to claim 1, characterized in that The attack and defense drill configuration instructions include: an attack and defense drill function opening instruction or a closing instruction; When the attack and defense drill configuration instruction is the start instruction, the first application definition file is an application definition file released by the business party; the execution configuration is modified to: add the installation instruction; When the attack and defense drill configuration instruction is the closing instruction, the first application definition file is: an application definition file with the installation instruction added on the basis of the application definition file released by the business party; and the execution configuration is modified to: delete the installation instruction.

3. The method according to claim 1 or 2, characterized in that: The step of performing configuration modification on the first application definition file comprises: Identifying lifecycle configuration information of the first application definition file; A hook command for installing the probe is added or deleted in the lifecycle configuration information.

4. The method according to claim 1, characterized in that The attack and defense drill configuration instruction carries a drill type, and the drill type includes: unauthorized type and authorized type; the authorized type of attack and defense drill includes: an attack and defense drill involving network failures; Before obtaining the first application definition file corresponding to the target container, the method further includes: Determine the type of drill for the attack and defense drill; If the drill type is an authorization type; the step of performing configuration modification on the first application definition file further includes: identifying a security context of the first application definition file; The network permission configuration item defined in the security context is turned on or off; the network permission configuration item being in the turned-on state indicates that the target container has the permission to modify the network configuration of the host machine.

5. The method according to claim 4, characterized in that If the drill type is an unauthorized type, executing the step of performing configuration modification on the first application definition file, or performing online configuration of the attack and defense drill; The step of configuring the attack and defense drill online includes: sending a command for installing or uninstalling a probe to the target container; The probe is an application program used to perform attack and defense drills.

6. The method according to claim 1, characterized in that After deploying the second application definition file on the cloud native platform, the method further includes: If a new version of the application definition file released by the business party is received, the new version of the application definition file is deployed on the cloud native platform so that the cloud native platform deletes the container created based on the second application definition file and creates a container based on the new version of the application definition file.

7. A configuration device for attack and defense drills in a cloud native environment, characterized in that: The device comprises: an acquisition module, configured to acquire a first application definition file corresponding to a target container in response to receiving an attack and defense drill configuration instruction; A configuration module, configured to perform configuration modification on the first application definition file to obtain a second application definition file; the configuration modification includes: adding or deleting installation instructions of a probe; the probe is an application program for performing attack and defense drills; A deployment module is used to deploy the second application definition file on a cloud native platform so that the cloud native platform creates a container that enables or disables an attack and defense drill function based on the second application definition file.

8. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 6 when executing a program stored in a memory.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images