Isolation method, system, device, medium and product of containerized gateway

Abstract

Embodiments of the present invention provide a method, system, device, medium and product for isolating a containerized gateway, in which different types of gateways are deployed in a mixed manner in different nodes of a gateway cluster, and service containers running gateways of the same type constitute a container set. In response to an isolation instruction for a target service container set in a cluster, the routing information of the gateway running in the target service container in the set is retained; the routing information of the gateway running in the first remaining service container in the target container set is revoked to isolate the target service container from the first remaining service container; the routing information of the gateway running in the second remaining service container under the target node is revoked to isolate the second remaining service container from the target service container. Among them, the target service container runs in the target node, and the first remaining service container runs in other nodes. At this point, the isolation of the target service container from other containers in the gateway cluster is achieved.

Description

Technical Field

[0001] The present invention relates to the field of cloud network technology, and in particular to an isolation method, system, device, medium and product for a containerized gateway. Background Art

[0002] As a network node, a gateway can be used to forward messages between different networks or subnets. A gateway can usually be presented as a hardware device, but with the development of virtualization technology, a gateway can also be containerized, that is, the gateway can be run in a container, thereby improving the resource utilization of the hardware device.

[0003] For a gateway cluster consisting of multiple containers running gateways, in order to ensure the reliability and security of the containerized gateways in the cluster, it is often necessary to isolate the containers in the gateway cluster. At this time, how to achieve container isolation becomes an urgent problem to be solved. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a containerized gateway isolation method, system, device, medium and product to achieve container isolation, that is, to achieve containerized gateway isolation.

[0005] In a first aspect, an embodiment of the present invention provides a method for isolating a containerized gateway, including:

[0006] In response to an isolation instruction for a target container set in a gateway cluster, retain routing information of a gateway running in a target service container under the target container set, wherein different types of gateways are running in different service containers under any node in the gateway cluster, and the target container set includes service containers in which gateways of the target type are running under different nodes in the gateway cluster;

[0007] Revoke the routing information of the gateway running in the first remaining service container under the target container set, wherein the target service container runs in the target node of the gateway cluster, and the first remaining service container runs in other nodes of the gateway cluster;

[0008] The routing information of the gateway in the second remaining service container running under the target node is cancelled, and the types of the gateways in the target service container and the second remaining service container are different.

[0009] In a second aspect, an embodiment of the present invention provides an isolation system for a containerized gateway, including: a gateway cluster and a container orchestration tool;

[0010] Different types of gateways are run in different service containers under any node in the gateway cluster, and service containers of the same type of gateways are run under different nodes in the gateway cluster to form a container set; the container orchestration tool includes a controller;

[0011] The container orchestration tool is used to generate an isolation instruction for a target container set in the gateway cluster;

[0012] The controller is configured to control, in response to the isolation instruction, the routing information of the gateway running in the target service container under the target container set to remain unchanged, and the target service container is deployed in the target node of the gateway cluster;

[0013] Sending a routing withdrawal instruction to a first remaining service container in the target container set to withdraw routing information of a gateway running in the first remaining service container, where the first remaining service container is deployed in other nodes of the gateway cluster;

[0014] A routing withdrawal instruction is sent to the second remaining service container under the target node to withdraw routing information of the gateway running in the second remaining service container, and the types of the gateways in the target service container and the second remaining service container are different.

[0015] In a third aspect, an embodiment of the present invention provides an electronic device, including a processor and a memory, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the isolation method of the containerized gateway in the first aspect. The electronic device may also include a communication interface for communicating with other devices or communication systems.

[0016] In a fourth aspect, an embodiment of the present invention provides a non-transitory machine-readable storage medium, on which executable code is stored. When the executable code is executed by a processor of an electronic device, the processor can at least implement the isolation method of the containerized gateway as described in the first aspect.

[0017] In a fifth aspect, an embodiment of the present invention provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a processor, the processor can implement the isolation method of the containerized gateway as described in the first aspect above.

[0018] The architecture of the gateway cluster provided by the embodiment of the present invention may be: different types of gateways are mixedly deployed in the nodes of the gateway cluster, that is, the nodes of the gateway cluster may include service containers running different types of gateways, and service containers running the same type of gateways may constitute a container set. And for the sake of simplicity in subsequent descriptions, the routing information of the gateway running in the container may be referred to as the routing information corresponding to the container.

[0019] Based on the gateway cluster of the above architecture, the isolation method of the containerized gateway provided by the embodiment of the present invention may include: in response to an isolation instruction for a target container set in the gateway cluster, the routing information corresponding to the target service container in the set may be retained, and the routing information corresponding to the first remaining service container in the target container set may be revoked. Among them, the target service container in the target container set runs in the target node of the gateway cluster, and the first remaining service container runs in other nodes. At the same time, the routing information corresponding to the second remaining service container except the target service container under the target node is also revoked. Since the revocation of routing information can make the service container no longer receive messages, the revocation of the routing information corresponding to the first remaining service container can achieve isolation between the target service container and the first remaining service container; the revocation of the routing information corresponding to the second remaining service container can achieve isolation between the target service container and the second remaining service container.

[0020] It can be seen that the target service container in the target container set can be isolated from other service containers in the gateway cluster in the above manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 A schematic diagram of the structure of a gateway cluster provided by an embodiment of the present invention;

[0023] Figure 2 A flowchart of a containerized gateway isolation method provided by an embodiment of the present invention;

[0024] Figure 3a A schematic diagram of a gateway isolation process provided by an embodiment of the present invention;

[0025] Figure 3b A schematic diagram of another gateway isolation process provided by an embodiment of the present invention;

[0026] Figure 4a A schematic diagram of another gateway isolation process provided by an embodiment of the present invention;

[0027] Figure 4b A schematic diagram of another gateway isolation process provided by an embodiment of the present invention;

[0028] Figure 4c A schematic diagram of another gateway isolation process provided by an embodiment of the present invention;

[0029] Figure 4d A schematic diagram of another gateway isolation process provided by an embodiment of the present invention;

[0030] Figure 4e A schematic diagram of another gateway isolation process provided by an embodiment of the present invention;

[0031] Figure 5 A schematic diagram of the structure of another containerized gateway isolation provided in an embodiment of the present invention;

[0032] Figure 6 A schematic diagram of the structure of another containerized gateway isolation provided in an embodiment of the present invention;

[0033] Figure 7 A schematic diagram of the structure of an isolation device for a containerized gateway provided in an embodiment of the present invention;

[0034] Figure 8 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two, but does not exclude the inclusion of at least one.

[0037] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0038] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to identifying", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is identified" may be interpreted as "when determining" or "in response to determining" or "when identifying (stated condition or event)" or "in response to identifying (stated condition or event)", depending on the context.

[0039] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0040] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such a product or system. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the product or system including the elements.

[0041] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the case where there is no conflict between the embodiments, the following embodiments and the features in the embodiments can be combined with each other. In addition, the step sequence in the following method embodiments is only an example and not a strict limitation.

[0042] Figure 1 A schematic diagram of the structure of a gateway cluster provided for an embodiment of the present invention. A gateway cluster can be deployed on a physical host, and the gateway cluster can include at least one node, any of which can include at least one container. Different types of gateways run in different containers under any node in the gateway cluster, that is, different types of gateways can be mixed and deployed on a node of the gateway cluster. In addition, multiple containers running the same type of gateways under different nodes in the gateway cluster can also constitute a container set.

[0043] like Figure 1As shown, the gateway cluster may include nodes A to C, each of which contains containers running different types of gateways. Optionally, the gateways running in the containers may include Internet Gateway (IGW), Serving Gateway (SGW), Communication Gateway (CGW), and Virtual Private Gateway (VGW). Continuing with the above example, Figure 1 As shown, containers running different types of gateways are distinguished in different styles. Figure 1 In the figure, the container can be represented by a rectangular box with a bold solid line, and the container filled with left slashes runs VGW, the container filled with right slashes runs IGW, the container filled with vertical lines runs SGW, and the container filled with crosses runs CGW. Figure 1 The gateway cluster shown may include four container sets, wherein the containers running the same type of gateways in nodes A to C may constitute a first container set, and so on.

[0044] It should be noted that the gateway cluster mentioned in each embodiment of the present invention can be a mixed deployment of multiple types of gateways. Figure 1 This is only an illustration of a mixed deployment of multiple types of gateways. The embodiments of the invention do not limit the number of nodes in the gateway cluster, the number of types of gateways running in the container under any node, or whether the number of types of gateways running in containers under different nodes is the same.

[0045] For a hybrid gateway cluster, the gateway running in the container can use its own routing information to transmit the messages generated by users in the process of using the service, and the messages generated in the process of using the service can be called data messages. For the sake of simplicity in the subsequent description, the routing information of the gateway running in the container can be called the routing information corresponding to the container. Data messages can be transmitted as normal messages using the routing information corresponding to the container to ensure that users can use applications or cloud services normally. Correspondingly, Figure 1 In the illustrated embodiment, the container where the gateway that normally receives data packets is located may be referred to as a service container (pod).

[0046] Optionally, the service provider can provide services in the form of applications or cloud services. For example, when the cloud service is a cloud game, the data message includes game data; when the cloud service is a computing service, the data message includes the computing results. Optionally, the gateway can use the Border Gateway Protocol (BGP) for message transmission.

[0047] When the service container in the gateway cluster needs to be isolated, the container orchestration tool can set the service container to be isolated as an isolated container (pod). Optionally, the service container and the isolated container can be created by the container orchestration tool, which can include Kubernetes, Docker Swarm, Mesos, etc. And considering the normal transmission of data packets, the isolated container and the service container can run in different nodes of the gateway cluster.

[0048] It should be noted that, optionally, the situation where the service container needs to be isolated may include that the service container is attacked by a network, and the isolated container is also the container attacked by the network. Optionally, the present invention does not limit the specific scenario where the container needs to be isolated. In addition to the above-mentioned network attack, any situation where the container needs to be isolated can use the method or system provided by the following embodiments of the present invention.

[0049] Based on the above description, Figure 2 The following is a flow chart of an attack defense method provided by an embodiment of the present invention. The method provided by an embodiment of the present invention can be executed by a container orchestration tool. Figure 2 As shown, the method may include the following steps:

[0050] S101, in response to an isolation instruction for a target container set in a gateway cluster, retain routing information of a gateway running in a target service container under the target container set, wherein the target container set includes service containers having target type gateways running under different nodes in the gateway cluster.

[0051] S102, canceling the routing information of the gateway running in the first remaining service container under the target container set, the target service container runs in the target node of the gateway cluster, and the first remaining service container runs in other nodes of the gateway cluster.

[0052] After the container orchestration tool can generate an isolation instruction for the target container set in the gateway cluster, the container orchestration tool can further perform the following processing: in response to the isolation instruction, the routing information corresponding to the target service container in the target container set is retained, and at the same time, the routing information corresponding to the remaining service containers under the target container set can be revoked. Among them, the service container under the target container set runs a gateway of the target type, such as any one of the above-mentioned IGW, VGW, SGW and VGW. Optionally, the revocation of routing information can be considered as setting the routing information to an unavailable state or deleting the routing information. Optionally, the routing information may include the five-tuple information of the message, the next hop address and other content.

[0053] In addition, the action of "revoke the routing information corresponding to the remaining service containers" can also be executed on all devices in the communication network to which the gateway cluster belongs, thereby ultimately achieving routing convergence. The completion of routing convergence will prevent the gateway running in the remaining service containers from receiving new messages, which means that the messages are removed from the remaining service containers. After removing the messages, the target service container can still receive messages, but the remaining service containers in the target container set will not receive messages, which means that the target service container and the remaining service containers in the target container set are isolated.

[0054] The target service container may be run on the target node in the gateway cluster, and the remaining service containers may be run on other nodes in the gateway cluster. Optionally, the target service container may be a portion of the containers in the target container set, the number of which may be at least one, and the target container set may be any container set in the gateway cluster.

[0055] S103: cancel the routing information of the gateway in the second remaining service container running under the target node, and the types of the gateways in the target service container and the second remaining service container are different.

[0056] At the same time, the container orchestration tool can also revoke the routing information corresponding to the remaining service containers under the target node. In order to distinguish, the remaining service container involved in step S102 can be called the first remaining service container, and the remaining service container involved in step S103 can be called the second remaining service container. Step S103 can also be executed on all devices in the communication network to achieve routing convergence. And the way of revoking the routing information status can achieve routing convergence at the second level. The completion of routing convergence will prevent the gateway running in the second remaining service container from receiving new messages, that is, the message is removed from the second remaining service container, which can isolate the target service container from the second remaining service container under the target node.

[0057] It should be noted that the steps in the embodiment of the method do not have a strict time sequence, and the above steps can be executed sequentially or simultaneously.

[0058] based on Figure 1For the gateway cluster shown, in this embodiment, when an isolation instruction is generated for a target container set in the gateway cluster, the routing information corresponding to the target service container in the set can be retained, and the routing information corresponding to the first remaining service container in the target container set can be revoked to achieve isolation between the target service container and the first remaining service container. Among them, the target service container is deployed in the target node, and the first remaining service container is deployed in other nodes. At the same time, the routing information corresponding to the second remaining service container other than the target service container under the target node can also be revoked to achieve isolation between the target service container and the second remaining service container. It can be seen that the target service container in the gateway cluster can be isolated from other service containers in the above manner.

[0059] According to the above description, the isolation instruction can be generated when the service container is attacked by a network attack. Optionally, the container orchestration tool can detect whether each container set in the gateway cluster is attacked by a network attack, and generate the above isolation instruction after detecting that the target container set is attacked by the tool.

[0060] It should also be noted that since gateways of the same type process the same type of messages, even if a network attack is directed at a service container in a gateway cluster, the traffic that ultimately needs to be isolated, such as attack traffic, will be distributed to the various containers in the container set to which the service container belongs. Therefore, in practice, it can be considered that network attacks are usually launched against an entire container set in a gateway cluster. Figure 1 As can be seen from the gateway cluster shown, the gateways running in the service container in the cluster may include IGW, VGW, SGW, VGW, etc. Optionally, the gateway cluster is usually attacked by an external network attack on the container set to which the service container running IGW, VGW, SGW belongs.

[0061] based on Figure 1 In the gateway cluster with mixed deployment of multiple types of gateways shown in the figure, since containers running different types of gateways are deployed on the same node of the cluster, when the container set in the gateway cluster is attacked by a network attack, the service containers running other types of gateways on the same node as the service containers in the container set will also be affected by the network attack. This makes the impact of the network attack no longer limited to the container set, but expanded to different container sets in the gateway cluster. Figure 1 Taking the gateway cluster shown as an example, when the container set consisting of the IGW running in nodes A to C in the cluster is attacked, the VGW, SGW, and CGW in nodes A to C will also be affected by the network attack.

[0062] And use Figure 2In the illustrated embodiment, after executing step S102, i.e. revoking the routing information of the gateway running in the first remaining service container under the target container set, the isolation between the target service container and the first remaining service container can enable the attack traffic to be concentratedly received by the target service container, and the attack traffic can be removed from the first remaining service container, so that the first remaining service container and the service containers on other nodes in the gateway cluster are not affected by the network attack.

[0063] Similarly, after executing step S103, i.e. revoking the routing information of the gateway running in the second remaining service container under the target node, the isolation between the target service container and the second remaining service container can remove the attack traffic from the second remaining service container, so that the second remaining service container under the target node is not affected by the network attack.

[0064] That is to say, according to the above method, when the target container set is attacked, the target service container in the target node is ultimately affected, and other containers in the gateway cluster will not be affected by the attack, thereby reducing the impact of network attacks on the gateway cluster.

[0065] based on Figure 1 Assume that the target container set is attacked, and the service container contained in the target container set has an IGW gateway running. Figure 2 The illustrated embodiment and the steps provided in this embodiment can also be combined Figure 3a Understand. Figure 3a As shown, after executing step S102, the routing information of the IGW in nodes B and C is revoked, and the service container running the IGW with the revoked routing information can be represented by a thin dotted rectangular box. After executing step S103, the routing information of the other types of gateways in nodes A to C is revoked, and the service containers running the VGW, SGW, and CGW with the revoked routing information can also be represented by a thin dotted rectangular box. At this time, the attack traffic is borne by the container running the IGW in node A.

[0066] When an isolation instruction is generated for a target container set, such as when the target container set is attacked by a network attack, you can follow Figure 2 The illustrated embodiment is processed. During the processing, the service container of the revoked routing information is not deleted, but is in an unavailable state, but this will reduce the number of service containers in the gateway cluster that are used to receive messages and run target type gateways. On the one hand, the reduction in the number of containers can be seen by users in real time to affect the user experience. On the other hand, when the isolation instruction fails, such as after the network attack ends, a small number of containers will not be able to respond to a large number of data messages.

[0067] exist Figure 1 Based on the clusters shown, Figure 3bAs shown, the gateway cluster may also include a spare node. In order to improve the above problem, the container orchestration tool may schedule the first remaining service container in the target container set from the target node to the alternative node corresponding to the gateway cluster while responding to the isolation instruction to revoke the routing information. Among them, container scheduling is equivalent to recreating the routing information for the first remaining container on the alternative node. Since the first remaining service container receives traffic that needs to be isolated, after scheduling, the container orchestration tool may also set the first remaining service container as an isolated container. Among them, in a network attack scenario, the traffic that needs to be isolated and processed and is received by the container running the target type gateway in the target container set is also the attack traffic.

[0068] Through the above container scheduling process, the traffic that needs to be isolated by the target type gateway can be distributed to the target service container in node A and the isolation container in the alternative node. In the network attack scenario, the scheduling of containers can shorten the duration of the network attack and reduce the pressure on the single point (i.e., the target service container). After the network attack is over, the isolation container in the standby node can be rescheduled back to the target node or other nodes of the gateway cluster and reset to a service container. At this time, the number of service containers running the target type gateway is still sufficient and can handle data packets, and users will not perceive the change in the number of service containers.

[0069] Among them, unlike the target node and other nodes in the gateway cluster, the spare node can be used when generating isolation instructions or when the container needs to be scaled up or down. Optionally, the container orchestration tool can use the reserved resources (buffer) on the physical host to create the spare node.

[0070] It should also be noted that the container scheduling process in this embodiment is similar to Figure 2 There is no strict time sequence between the steps in the illustrated embodiment, and container scheduling and Figure 2 The steps in the embodiment shown can be performed sequentially or simultaneously. Figure 3b understand.

[0071] In this embodiment, when there is an isolation instruction for the target container set, while revoking the routing information to achieve container isolation, the container orchestration tool can also schedule the first remaining service container in the target container set to the candidate node, so that the first remaining service container becomes an isolated container. When the isolation instruction is generated when it is detected that the target container set is under a network attack, the above scheduling process can shorten the duration of the attack and ensure that there are enough service containers to process the data packets after the network attack ends. At the same time, the user will not perceive the change in the number of service containers.

[0072] It should be noted that in the schematic diagram of the container isolation process provided by the above and following embodiments of the present invention, the service container whose routing information is revoked can be represented by a rectangular box with thin dashed lines, and the container that can receive messages (traffic that does not need to be isolated, such as data messages, or traffic that needs to be isolated, such as attack traffic) can be represented by a rectangle with bold lines. More specifically, the service container can be represented by a rectangular box with bold solid lines, and the isolation container can be represented by a rectangular box with bold dashed lines. During the container scheduling process, for containers that are scheduled to enter the alternative node, the container can be marked as "×" in the original node. Similarly, for containers that are scheduled out of the alternative node, the container can be marked as "×" in the alternative node. Containers that are scaled down in the node can also be marked as "×".

[0073] In addition, the technical effects that can be achieved by the methods provided in various embodiments of the present invention can also be understood in combination with the following contents:

[0074] For Figure 3b For the hybrid-deployed gateway cluster shown, when the target container set in the cluster is attacked by a network, the above assumption is continued: the service container contained in the target container set has an IGW gateway running in it, then another container isolation method can be: first, the service container running the IGW can be deleted in nodes A~C, and then the container running the IGW gateway can be recreated in the alternative node and set as an isolated container, which is used to bear the traffic that needs to be isolated and processed. However, the gateway is running in the container, and the routing information needs to be re-acquired to re-create the isolated container in the alternative node. Since the acquisition of routing information is very time-consuming, the acquisition time is in the order of minutes, which in turn causes the creation of the isolated container to be very time-consuming, resulting in a greatly reduced speed in completing the isolation of the gateway. Among them, for the isolation instructions generated when subjected to a network attack, the speed of completing the isolation of the gateway can also be considered as the defense speed of the network attack.

[0075] The containerized gateway isolation method provided by each embodiment of the present invention is to first cancel the routing information and then schedule the container. Figure 2 From the description in the illustrated embodiments, it can be seen that the revocation of routing information can achieve routing convergence at the second level, that is, the second remaining server in the gateway cluster can be isolated from the target service container at the second level, and the second remaining service container is not subject to network attacks. Therefore, using the methods provided by the embodiments of the present invention, while reducing the impact of network attacks on the gateway cluster, the service container can also be freed from the impact of network attacks more quickly.

[0076] according to Figure 3b As can be seen from the description in the illustrated embodiment, the standby nodes in the gateway cluster can be used when an isolation instruction is generated or when the service container needs to be expanded or reduced in capacity.

[0077] As for the alternative nodes, an optional method is to deploy two kinds of alternative nodes in the gateway cluster, that is, the service container can have a corresponding alternative node, and the isolation container can also have a corresponding alternative node. Among them, the alternative node corresponding to the service container can be used when the service container is expanded or reduced, and the alternative node corresponding to the isolation container can create an isolation container in the node when the isolation instruction is generated. And the alternative nodes corresponding to different containers can monopolize the computing resources allocated to them. This resource exclusivity will reduce the resource utilization of the physical host.

[0078] Alternatively, a spare node can be deployed in the gateway cluster, and the spare node is shared by the service container and the isolation container, that is, both the service container and the isolation container can run in the spare node, which can improve the resource utilization of the physical host.

[0079] In this embodiment, the setting of sharing the candidate node between the service container and the isolation container can improve the resource utilization of the physical host.

[0080] In practice, the expansion and contraction of containers and the generation of isolation instructions can occur simultaneously, which makes container scheduling a complex process. The overall idea of ​​the scheduling strategy provided by the following embodiments of the present invention can be:

[0081] When the isolation instruction is generated, the service container that needs to be isolated can be scheduled to the candidate node, and the service container can be set as an isolation container.

[0082] When an isolation instruction is generated and the service container that needs to be isolated is expanded, an isolation container can be created in an alternative node to achieve expansion.

[0083] When scaling service containers that do not require isolation in the gateway cluster, you can create or delete service containers in the target node, other nodes, or candidate nodes in the gateway cluster.

[0084] In addition, the above-mentioned various scheduling strategies also need to ensure that service containers and isolated containers that do not need to be isolated in the gateway cluster cannot run on the same candidate node at the same time, and isolated containers can only run on candidate nodes.

[0085] Among them, the service container that needs to be isolated is used to process the traffic that needs to be isolated. In the above-mentioned network attack scenario, the service container that needs to be isolated can be the service container that is attacked by the network, the service container that does not need to be isolated can be the service container that is not attacked by the network, and the traffic that needs to be isolated can be the attack traffic. The scheduling strategies applicable to different situations can be introduced in detail below.

[0086] In an optional case, when there is an isolation instruction for the target container cluster in the gateway cluster, and the container orchestration tool determines that the standby node does not contain a service container, the container orchestration tool can further determine whether the remaining resources of the candidate node are sufficient to schedule the first remaining service container in the target container cluster to the candidate node. If the remaining resources of the candidate node are sufficient to schedule the first remaining service container in the target container cluster to the candidate node, the container orchestration tool can directly schedule the first remaining service container and set the first remaining service container as an isolation container.

[0087] Among them, the fact that the candidate node does not contain a service container means that the standby node is empty or is running a container that was scheduled to the standby node after the last round of container isolation. The last round of container isolation can be for other container clusters in the gateway cluster. Optionally, the container orchestration tool can determine whether the container running in the candidate node is a service container or an isolation container based on the type identifier of the container running in the standby node. Optionally, the number of rounds of container isolation can also be considered as the number of rounds of network attacks.

[0088] Continuing with the above example, assuming that an IGW is running in a container in the target container set, the above situation can be combined with Figure 4a understand.

[0089] In this embodiment, for the target container set that needs to be isolated, when the standby node does not contain a service container and the remaining resources of the candidate node are sufficient, the container orchestration tool can directly schedule the first remaining service container to the candidate node.

[0090] In addition, it should be noted that the embodiments of the present invention do not limit the number of candidate nodes. There can be at least one candidate node, and when there are multiple candidate nodes, the container orchestration tool can traverse the remaining resources of different candidate nodes to schedule the first remaining service container to any node with sufficient remaining resources.

[0091] In another optional situation, when there is an isolation instruction for the target container cluster in the gateway cluster, and the container orchestration tool determines that the spare node contains a service container, at this time, since the service container and the isolation container cannot run in the same spare node at the same time, it is necessary to first schedule the service container in the spare node to the node to be shrunk in the gateway cluster, and then schedule the first remaining service container in the target container set to the spare node.

[0092] Optionally, the node to be shrunk may be any node in the gateway cluster, and the number of nodes to be shrunk may be at least one. Optionally, the container orchestration tool obtains the resource utilization of different service containers under different nodes in the gateway cluster, and determines the node to be shrunk and the service container to be shrunk in the node to be shrunk according to the resource utilization. Optionally, the reduction process of the service container may include: revoking the routing information of the gateway running in the service container to be shrunk, and deleting the service container to be shrunk.

[0093] Continuing with the above example, assuming that an IGW is running in a container in the target container set, the above situation can be combined with Figure 4b Understand. Figure 4b As shown, the alternative node includes a service container running SGW, and the node to be shrunk can be node C. When the target container set needs to be isolated, such as when it is attacked by a network, the service container running SGW in node C can be deleted, and the service container in the alternative node can be scheduled to it, and then the containers running IGW in nodes B and C can be scheduled to the alternative node.

[0094] It is easy to understand that in the process of adjusting the first remaining service container, the container orchestration tool also needs to consider whether the remaining resources of the candidate node are sufficient.

[0095] In this embodiment, for the target container set that needs to be isolated, when the standby node includes a service container, the container orchestration tool can first schedule the service container in the candidate node, and then schedule the first remaining service container to the candidate node.

[0096] In another case, when there is an isolation instruction for the target container set in the gateway cluster, and the container orchestration tool determines that the standby node contains a service container, since the service container and the isolation container cannot run in the same candidate node at the same time, the container orchestration tool can also obtain the resource utilization rate of the service container in the gateway cluster. If the resource utilization rate is less than the preset threshold, it indicates that the working pressure of the service container is small. At this time, the container orchestration tool can also first revoke the routing information corresponding to the service container in the candidate node and delete the service container, that is, to remove the flow and reduce the capacity of the service container in the candidate node, and finally schedule the first remaining service container in the target container set to the candidate node.

[0097] Continuing with the above example, assuming that an IGW is running in a container in the target container set, the above situation can be combined with Figure 4cUnderstand. The candidate node contains a service container running SGW. When the target container set needs to be isolated, such as being attacked by a network, and the resource utilization rate of at least one service container running SGW in nodes A to C is less than a preset threshold, the service container running SGW in the candidate node can be routed and deleted, and then the containers running IGW in nodes B and C can be scheduled to the candidate node.

[0098] In this embodiment, for the target container set that needs to be isolated, when the standby node includes a service container, the service container in the candidate node can also be directly deleted according to resource utilization, and then the first remaining service container is scheduled to the candidate node.

[0099] When there is an isolation instruction for the target container set, such as when it is attacked by a network, and the container orchestration tool is performing container scheduling, the message processing pressure of each service container in the target container set that runs a target type gateway will increase dramatically. At this time, the container orchestration tool can also generate a capacity expansion request for the target type gateway, and in response to the capacity expansion request, create an isolation container running a target type gateway in the standby node, so that the newly created isolation container can share the traffic that needs to be isolated and processed, such as attack traffic.

[0100] In an optional case, if the standby node does not contain a service container, indicating that the standby node is empty or there is a container that was scheduled to the standby node after the previous round of container isolation, the container orchestration tool can respond to this expansion request and directly create an isolated container in the standby node. This situation can also be combined with Figure 4a understand.

[0101] In another optional case, if the standby node contains a service container, the container orchestration tool first schedules the service container in the standby node to the node to be scaled down in the gateway cluster, and then creates an isolated container running the target type gateway in the standby node, that is, to achieve capacity expansion. The process of determining the node to be scaled down can be described in the above-mentioned related embodiments, which will not be repeated here. This situation can also be combined with Figure 4b understand.

[0102] Alternatively, if Figure 4b As shown, before the containers running IGW in nodes B and C are scheduled to the candidate nodes and form isolated containers, the service container running SGW scheduled from the standby node to the node to be scaled down (node ​​C) also needs to revoke the routing information. At this time, the service container can be represented by a thin dotted rectangular box.

[0103] Optionally, after the containers running IGW in nodes B and C are scheduled to the candidate nodes and form isolated containers, at this time, the traffic that needs to be isolated and processed, such as attack traffic, has been shared by an appropriate number of containers, then the service container running SGW scheduled from the candidate node to the node to be scaled down (node ​​C), and the original service containers in nodes A to C that are not used to share the traffic that needs to be isolated and processed can resume normal operation. At this time, the service container that has resumed normal operation can be represented by a rectangular box with a bold solid line.

[0104] In another optional case, if the standby node contains a service container and the resource utilization of the service container is less than a preset threshold, the container orchestration tool first removes and deletes the service container in the standby node, and then expands the capacity of the isolated container in the standby node. Figure 4c The situations shown are similar and can be understood in combination.

[0105] In this embodiment, when there is an isolation instruction for the target container set in the gateway cluster, if there is no service container in the candidate node, the first remaining service container can be directly scheduled to the candidate node, and an isolation container corresponding to the expansion request can also be created in the node. If the candidate node contains a service container, the service container in the candidate node can be processed to ensure that the candidate node does not contain a service container, and then the first remaining service container is scheduled and the isolation container is expanded.

[0106] In practice, when there are isolation instructions for the target container set, such as when it is attacked by a network, and the number of data packets processed by other types of gateways in the service container fluctuates, the container orchestration tool can also generate expansion requests for other types of gateways. Figure 4a and Figure 4b The expansion requests in the illustrated embodiment are differentiated, and the expansion request for a target type of gateway may be referred to as a first expansion request, and the expansion request for another type of gateway may be referred to as a second expansion request.

[0107] In an optional case, the container orchestration tool responds to the second expansion request, and if the candidate node does not include the isolated container, it indicates that the network attack did not cause the container orchestration tool to execute Figure 4a and Figure 4b The scheduling strategy shown can directly create a service container running other types of gateways in the candidate node.

[0108] Continuing with the above example, assuming that an IGW is running in a container in the target container set, this situation can also be combined with Figure 4d Understand. Figure 4dAs shown, other types of gateways may be SGWs, that is, in response to the second capacity expansion request, SGWs may be run in the newly created service container in the standby node.

[0109] In another optional case, the container orchestration tool responds to the second expansion request, and if the candidate node includes an isolated container, the container orchestration tool can create a service container running other types of gateways in the node to be expanded in the gateway cluster. Optionally, similar to the node to be reduced, the container orchestration tool can also use the resource usage rates of different service containers under different nodes in the gateway cluster to determine the node to be expanded.

[0110] Continuing with the above example, assuming that an IGW is running in a container in the target container set, this situation can also be combined with Figure 4e Understand. Figure 4e As shown, other types of gateways may be SGWs, and the node to be expanded may be node A. That is, in response to the second expansion request, a new service container may be created in node A, and the SGW may be running in the service container.

[0111] Optionally, before the containers running IGW in nodes B and C have been scheduled to the candidate nodes and form isolated containers, the newly built service containers running other types of gateways in the nodes to be expanded also need to revoke routing information. That is, the routing information corresponding to the newly built service container running SGW in node A can also be revoked. At this time, Figure 4e As shown, the service container can also be represented by a rectangular frame with thin dotted lines.

[0112] Optionally, after the containers running IGW in nodes B and C have been scheduled to the candidate nodes and formed isolated containers, at this time, the traffic that needs to be isolated and processed, such as attack traffic, has been shared by an appropriate number of containers, then the newly created service container running SGW in node A, and the original service containers in nodes A to C that are not used to share the traffic that needs to be isolated and processed can resume normal operation. At this time, the service container that resumes normal operation can be represented by a rectangular box with a bold solid line.

[0113] In this embodiment, when there is an isolation instruction for a target container set in a gateway cluster and there is also a capacity expansion request for other types of gateways, a service container running the other types of gateways may be created in a candidate node or a node to be expanded.

[0114] It is easy to understand that when the target container set does not need to be isolated, for example, it is not subject to a network attack, and the number of data packets processed by the target type gateway fluctuates, the container orchestration tool can also generate a capacity expansion request for the target type gateway. The container orchestration tool can also create a service container running the target type gateway in the alternative node or the node to be expanded.

[0115] Above Figure 1~Figure 4e The illustrated embodiment has described the defense process of network attacks from the perspective of methods. On this basis, the defense process of network attacks can also be described from the perspective of systems.

[0116] Figure 5 The embodiment of the present invention provides a defense system. Figure 5 As shown, the system may include: a gateway cluster and a container orchestration tool, and the container orchestration tool may include a controller.

[0117] Among them, different types of gateways are running in different service containers under any node in the gateway cluster, that is, the gateway cluster in this embodiment can be a mixed deployment of multiple types of gateways. The specific architecture of the gateway cluster can be seen in Figure 1 The embodiment shown. And the service containers running the same type of gateways under different nodes in the gateway cluster constitute a container set. Optionally, when the container orchestration tool is Kubernetes, the controller therein may be an SDN controller. When the container orchestration tool is Docker Swarm, the controller therein may be a Swarm controller.

[0118] The specific working process of the system can be described as:

[0119] The controller in the container orchestration tool can respond to the isolation instruction for the target container set in the gateway cluster, control the routing information of the gateway in the target service container running under the target container set to remain unchanged, the target service container is deployed in the target node of the gateway cluster, and the target type gateway is running in the service container in the target container set. Optionally, the container orchestration tool can detect whether the container set in the gateway cluster is attacked. When any container set in the gateway cluster, such as the target container set, is detected to be under a network attack, the above-mentioned isolation instruction can be generated.

[0120] At the same time, the controller may also send a routing withdrawal instruction to the first remaining service container in the target container set to withdraw the routing information of the gateway running in the first remaining service container, and the first remaining service container is deployed in other nodes of the gateway cluster. At the same time, the controller may also send a routing withdrawal instruction to the second remaining service container under the target node to withdraw the routing information of the gateway running in the second remaining service container.

[0121] In addition, the contents not described in detail in this embodiment can be found in Figure 2 The relevant description in the illustrated embodiment will not be repeated here.

[0122] In this embodiment, when an isolation instruction is generated for a target container set in a gateway cluster, the routing information corresponding to the target service container in the set can be retained, and the routing information corresponding to the first remaining service container in the target container set can be revoked to achieve isolation between the target service container and the first remaining service container. The target service container is deployed in the target node, and the first remaining service container is deployed in other nodes. At the same time, the routing information corresponding to the second remaining service container under the target node except the target service container can also be revoked to achieve isolation between the target service container and the second remaining service container. It can be seen that the target service container in the gateway cluster can be isolated from other service containers in the above manner.

[0123] Figure 6 A schematic diagram of the structure of another defense system provided by an embodiment of the present invention. Figure 6 As shown, in Figure 5 Based on the system shown, the container orchestration tool may further include a container manager.

[0124] Optionally, when the container orchestration tool is Kubernetes, the container manager can be implemented with the help of kubelet in K8S and the horizontal pod autoscaler (HPA). When the container orchestration tool is Docker Swarm, the container manager can be implemented with the help of user instructions and the management node in Docker Swarm.

[0125] While performing route withdrawal, the container manager in the container orchestration tool can also generate a scheduling instruction. The container manager can respond to the scheduling instruction and schedule the first remaining service container in the target container set to the standby node corresponding to the gateway cluster, and set the first remaining service container in the standby node as an isolated container. The scheduling method of the first remaining service container is related to whether the standby node contains a service container. For specific scheduling methods, see Figure 4a and Figure 4b The process shown will not be repeated here.

[0126] exist Figure 4a In the case shown, the container manager needs to first schedule the service container in the standby node to the node to be shrunk. Optionally, the controller can determine the node to be shrunk based on the resource usage rates of different service containers under different nodes in the gateway cluster.

[0127] On the basis of revoking the routing, in this embodiment, the container managers in the container orchestration tool can work together to schedule the first remaining service container in the target container set to the standby node, so that more containers can share the attack traffic.

[0128] When the target container set in the gateway cluster needs to be isolated, such as when it is attacked by a network, and an isolation instruction is generated, the container manager can also generate a first expansion request for the target type gateway. The container manager can respond to the first expansion request and determine how to create an isolation container running the target type gateway in the standby node based on whether the standby node contains an isolation container, so that the newly created isolation container can share the traffic that needs to be isolated, such as attack traffic. The above specific process can also be seen in Figure 4a and Figure 4c , the specific content will not be repeated here.

[0129] In this embodiment, the container manager in the container orchestration tool can work together to respond to the expansion request generated by the isolation instruction, and through expansion, more containers can share the traffic that needs to be isolated. When the isolation instruction is generated due to a network attack, this embodiment can also shorten the duration of the network attack.

[0130] In practice, for a gateway cluster, there is no need to isolate service containers that are not attacked and are running other types of gateways. As the number of data packets fluctuates, the container manager can also generate a second expansion request for other types of gateways. If the candidate node does not contain an isolated container, the container manager responds to the second expansion request to create a service container running other types of gateways in the node to be expanded in the gateway cluster or the spare node corresponding to the gateway cluster. If the candidate node contains an isolated container, the container manager responds to the second expansion request to create a service container running other types of gateways in the node to be expanded in the gateway cluster.

[0131] Optionally, the container manager may determine the node to be expanded according to the resource usage rates of different service containers under different nodes in the gateway cluster.

[0132] The above specific process can also be found in Figure 4d and Figure 4e , the specific content will not be repeated here.

[0133] In addition, when the target container set is not attacked by the network, the container manager may also generate a capacity expansion request for the target type gateway, and the container manager may also create a service container running the target type gateway in the above manner.

[0134] In this embodiment, the container manager in the container orchestration tool can work together to expand the capacity of the service container that has not been attacked by the network.

[0135] The attack defense device of one or more embodiments of the present invention will be described in detail below. Those skilled in the art will appreciate that the device can be configured using commercially available hardware components through the steps taught in this solution.

[0136] Figure 7 FIG. 1 is a schematic diagram of the structure of an attack defense processing device provided by an embodiment of the present invention. Figure 7 As shown, the device may include:

[0137] A first routing information processing module 11 is used to retain routing information of a gateway running in a target service container under the target container set in response to an isolation instruction for the target container set in the gateway cluster, wherein different types of gateways are running in different service containers under any node in the gateway cluster, and the target container set includes service containers in which gateways of the target type are running under different nodes in the gateway cluster;

[0138] A second routing information processing module 12 is used to cancel the routing information of the gateway running in the first remaining service container under the target container set, wherein the target service container runs in the target node of the gateway cluster, and the first remaining service container runs in other nodes of the gateway cluster;

[0139] The routing information of the gateway running in the second remaining service container under the target node is cancelled, and the gateway types in the target service container and the second remaining service container are different.

[0140] Optionally, the device further includes: a scheduling module 13, configured to schedule the first remaining service container to a standby node corresponding to the gateway cluster in response to the isolation instruction; and to set the first remaining service container as an isolation container.

[0141] Optionally, the scheduling module 13 is configured to schedule the first remaining service container to the standby node corresponding to the gateway cluster if the standby node corresponding to the gateway cluster does not include a service container.

[0142] Optionally, the scheduling module 13 is configured to schedule the service container in the standby node to the node to be shrunk in the gateway cluster if the standby node corresponding to the gateway cluster includes a service container;

[0143] The first remaining service container is scheduled to the standby node that does not include a service container.

[0144] Optionally, the scheduling module 13 is used to respond to the first capacity expansion request for the target type gateway, and if the standby node corresponding to the gateway cluster does not include a service container, create an isolation container running the target type gateway in the standby node.

[0145] Optionally, the scheduling module 13 is used to respond to the first capacity expansion request for the target type gateway, if the standby node corresponding to the gateway cluster includes a service container, schedule the service container in the standby node to the node to be shrunk in the gateway cluster;

[0146] An isolated container running the target type gateway is created in the standby node.

[0147] Optionally, the device also includes: a scaling module 14, which is used to determine the service container to be shrunk in the node to be shrunk according to the resource utilization rates of different service containers under different nodes in the gateway cluster; revoke the routing information of the gateway running in the service container to be shrunk; and delete the service container to be shrunk.

[0148] Optionally, the device further includes: a detection module 15, configured to detect whether the target container set in the gateway cluster is attacked; if it is detected that the target container set is attacked, an isolation instruction for the target container set is generated.

[0149] Optionally, other types of gateways are running in containers other than the target container set in the gateway cluster.

[0150] The scheduling module 13 is configured to respond to the second capacity expansion request for the other type of gateway, and if the standby node corresponding to the gateway cluster does not include an isolated container, create a service container running the other type of gateway in the standby node.

[0151] Optionally, the scheduling module 13 is used to create a service container running the other type of gateway in the node to be expanded included in the gateway cluster in response to the second expansion request if the standby node includes an isolated container.

[0152] Optionally, the expansion and contraction module 14 is used to determine the node to be expanded according to the resource usage rates of different service containers under different nodes in the gateway cluster.

[0153] Figure 7 The device shown can perform Figure 1~Figure 4e For the method of the embodiment shown in FIG. 1 , the parts not described in detail in this embodiment can be referred to FIG. Figure 1~Figure 4e The implementation process and technical effects of this technical solution are shown in FIG. Figure 1~Figure 4e The description in the illustrated embodiment will not be repeated here.

[0154] In addition, in a possible design, the attack defense methods provided in the above embodiments can be applied in electronic devices. Figure 8As shown, the electronic device may include: a processor 21 and a memory 22. The memory 22 is used to store the electronic device to perform the above Figure 1~Figure 4e The program of the attack defense method provided in the illustrated embodiment, the processor 21 is configured to execute the program stored in the memory 22.

[0155] The program includes one or more computer instructions, wherein the one or more computer instructions can achieve the above-mentioned Figure 1~Figure 4d The steps in the attack defense method provided in the illustrated embodiment.

[0156] Optionally, the processor 21 is further configured to execute the aforementioned Figure 1~Figure 4e All or part of the steps in the illustrated embodiments.

[0157] The structure of the electronic device may further include a communication interface 23 for the electronic device to communicate with other devices or communication systems.

[0158] In addition, an embodiment of the present invention provides a non-transitory machine-readable storage medium for storing computer software instructions used by the above electronic device, which includes instructions for executing the above Figure 1~Figure 4e The procedures involved in the attack defense method shown.

[0159] In addition, an embodiment of the present invention provides a computer program product. The computer program product includes a computer program or an instruction. When the computer program or the instruction is executed by a processor, the processor is enabled to implement the above Figure 1~Figure 4e The steps or functions of the attack defense method shown.

[0160] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A containerized gateway isolation method, characterized in that: include: In response to an isolation instruction for a target container set in a gateway cluster, retain routing information of a gateway running in a target service container under the target container set, wherein different types of gateways are running in different service containers under any node in the gateway cluster, and the target container set includes service containers in which gateways of the target type are running under different nodes in the gateway cluster; Revoke the routing information of the gateway running in the first remaining service container under the target container set, wherein the target service container runs in the target node of the gateway cluster, and the first remaining service container runs in other nodes of the gateway cluster; The routing information of the gateway in the second remaining service container running under the target node is cancelled, and the types of the gateways in the target service container and the second remaining service container are different.

2. The method according to claim 1, characterized in that The method further comprises: In response to the isolation instruction, scheduling the first remaining service container to a standby node corresponding to the gateway cluster; The first remaining service container is set as an isolation container.

3. The method according to claim 2, characterized in that The scheduling of the first remaining service container to the standby node corresponding to the gateway cluster includes: If the standby node corresponding to the gateway cluster does not include a service container, the first remaining service container is scheduled to the standby node corresponding to the gateway cluster.

4. The method according to claim 2, characterized in that: The scheduling of the first remaining service container to the standby node corresponding to the gateway cluster includes: If the standby node corresponding to the gateway cluster includes a service container, scheduling the service container in the standby node to the node to be shrunk in the gateway cluster; The first remaining service container is scheduled to the standby node that does not include a service container.

5. The method according to claim 1, characterized in that The method further comprises: In response to a first capacity expansion request for a target type gateway, if a standby node corresponding to the gateway cluster does not include a service container, an isolation container running the target type gateway is created in the standby node.

6. The method according to claim 1, characterized in that The method further comprises: In response to a first capacity expansion request for a target type gateway, if a standby node corresponding to the gateway cluster includes a service container, scheduling the service container in the standby node to a node to be shrunk in the gateway cluster; An isolated container running the target type gateway is created in the standby node.

7. The method according to claim 4 or 6, characterized in that: The method further comprises: Determine the service container to be shrunk in the node to be shrunk according to the resource usage rates of different service containers in different nodes in the gateway cluster; Before scheduling the service container in the standby node to the node to be shrunk in the gateway cluster, the method further includes: Canceling the routing information of the gateway running in the service container to be shrunk; Delete the service container to be shrunk.

8. The method according to claim 1, characterized in that The method further comprises: If it is detected that the target container set is attacked, the isolation instruction is generated.

9. The method according to claim 1, characterized in that: In the gateway cluster, other types of gateways are running in containers other than the target container set; the method further includes: In response to the second capacity expansion request for the other type of gateway, if the standby node corresponding to the gateway cluster does not include an isolation container, a service container running the other type of gateway is created in the standby node.

10. The method according to claim 9, characterized in that The method further comprises: In response to the second capacity expansion request, if the standby node includes an isolated container, determining the node to be expanded in the gateway cluster according to the resource usage rates of different service containers under different nodes in the gateway cluster; A service container running the other type of gateway is created in the node to be expanded.

11. A containerized gateway isolation system, characterized in that: include: Gateway cluster and container orchestration tools; Different types of gateways are run in different service containers under any node in the gateway cluster, and service containers of the same type of gateways are run under different nodes in the gateway cluster, forming a container set; The container orchestration tool includes a controller; The container orchestration tool is used to generate an isolation instruction for a target container set in the gateway cluster; The controller is configured to control, in response to the isolation instruction, the routing information of the gateway running in the target service container under the target container set to remain unchanged, and the target service container is deployed in the target node of the gateway cluster; Sending a routing withdrawal instruction to a first remaining service container in the target container set to withdraw routing information of a gateway running in the first remaining service container, where the first remaining service container is deployed in other nodes of the gateway cluster; A routing withdrawal instruction is sent to the second remaining service container under the target node to withdraw routing information of the gateway running in the second remaining service container, and the types of the gateways in the target service container and the second remaining service container are different.

12. The system according to claim 11, characterized in that A target type gateway is running in a service container in the target container set; The controller is configured to schedule the first remaining service container to a standby node corresponding to the gateway cluster in response to the isolation instruction; The first remaining service container is set as an isolation container.

13. The system according to claim 11, characterized in that The container orchestration tool is used to detect whether the container set in the gateway cluster is attacked; If it is detected that the target container set is attacked, an isolation instruction for the target container set is generated.

14. The system according to claim 12, characterized in that The container orchestration tool further includes a container manager, which is configured to create an isolated container running a target type gateway in the standby node in response to a first capacity expansion request for the target type gateway.

15. The system according to claim 14, characterized in that The container manager is configured to schedule the service container in the standby node to the node to be shrunk in the gateway cluster if the standby node includes a service container; The first remaining service container is scheduled to a standby node corresponding to the gateway cluster.

16. The system according to claim 11, characterized in that In the gateway cluster, other types of gateways are running in containers other than the target container set; The container orchestration tool also includes a container manager, which is used to create a service container running the other type of gateway in the node to be expanded of the gateway cluster or the spare node corresponding to the gateway cluster in response to the second expansion request for the other type of gateway.

17. The system according to claim 15 or 16, characterized in that The container manager is used to determine the nodes to be shrunk or expanded according to the resource usage rates of different service containers under different nodes in the gateway cluster.

18. An electronic device, characterized in that: include: A memory and a processor; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the isolation method for the containerized gateway as described in any one of claims 1 to 10.

19. A non-transitory machine-readable storage medium, characterized in that The non-transitory machine-readable storage medium stores executable code, and when the executable code is executed by a processor of an electronic device, the processor executes the containerized gateway isolation method according to any one of claims 1 to 10.

20. A computer program product, characterized in that The computer program product includes a computer program or instructions, so that the computer program or instructions can implement the steps in the method for controlling a containerized gateway according to any one of claims 1 to 10.

Images