Loading method and device for runtime application protection, equipment and medium

Abstract

The method comprises: obtaining an application protection file adapted to a first container image; wherein the application protection file records function code for implementing runtime application protection; determining file loading code corresponding to the application protection file; adding the file loading code to a first layer construction document of the first container image to obtain a second layer construction document; constructing a second container image according to the second layer construction document, and instantiating the second container image to obtain a target container. The method of the present disclosure realizes automatic loading of runtime application protection, avoids complex manual operation, and reduces the cost of subsequent maintenance by modifying the layer construction file without modifying the application image itself, thereby realizing decoupling between the configuration of the runtime application protection and the application image.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of container security, and particularly relates to a loading method and device of runtime application protection, equipment and medium. BACKGROUND

[0002] With the development of cloud computing and container technology, the application of container images is more and more extensive, and the security requirement for container images is higher and higher. In the related technology, the user needs to intervene to inject a runtime application protection (RASP) agent into the running environment of the application. However, this method needs to manually copy and modify the application image, which increases the operation complexity, and the runtime application protection has high coupling with the application, and the subsequent maintenance cost is high. SUMMARY

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a loading method, device, equipment and medium of runtime application protection.

[0004] The present disclosure provides a loading method of runtime application protection, comprising:

[0005] obtaining an application protection file adapted to a first container image; wherein the application protection file records a function code for implementing runtime application protection;

[0006] determining a file loading code corresponding to the application protection file;

[0007] adding the file loading code to a first layer construction document of the first container image to obtain a second layer construction document;

[0008] constructing a second container image according to the second layer construction document, and instantiating the second container image to obtain a target container; wherein the second container image loads the runtime application protection on the basis of the first container image.

[0009] The present disclosure further provides a loading device of runtime application protection, comprising:

[0010] an obtaining module configured to obtain an application protection file adapted to a first container image; wherein the application protection file records a function code for implementing runtime application protection;

[0011] a determining module configured to determine a file loading code corresponding to the application protection file;

[0012] an adding module, configured to add the file loading code into a first layer build document of the first container image to obtain a second layer build document;

[0013] a building module, configured to build a second container image according to the second layer build document, and instantiate the second container image to obtain a target container; wherein the second container image is loaded with the runtime application protection on the basis of the first container image.

[0014] The embodiments of the present disclosure further provide an electronic device, which comprises a processor, a memory for storing executable instructions of the processor, and the processor is configured to read the executable instructions from the memory and execute the instructions to implement the loading method of the runtime application protection provided by the embodiments of the present disclosure.

[0015] The embodiments of the present disclosure further provide a computer readable storage medium, which stores a computer program for executing the loading method of the runtime application protection provided by the embodiments of the present disclosure.

[0016] The technical solution provided by the embodiments of the present disclosure has the following advantages compared with the prior art: the loading method of the runtime application protection provided by the embodiments of the present disclosure comprises: obtaining an application protection file adapted to a first container image; wherein the application protection file records functional code for implementing runtime application protection; determining file loading code corresponding to the application protection file; adding the file loading code into a first layer build document of the first container image to obtain a second layer build document; building a second container image according to the second layer build document, and instantiating the second container image to obtain a target container; wherein the second container image is loaded with the runtime application protection on the basis of the first container image. By using the above technical solution, the application protection file adapted to the first container image is determined, the loading code corresponding to the application protection file is introduced into the layer build document, and then the application protection file is integrated into the container image in the process of building the container image according to the layer build document, and the automatic loading of the runtime application protection is realized in the target container obtained by instantiating the container image, which avoids complex manual operation, and the application image itself does not need to be modified in the way of modifying the layer build document, which reduces the intrusion to the business code, realizes the decoupling between the configuration of the runtime application protection and the application image, and reduces the cost of subsequent maintenance. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative labor.

[0019] Figure 1 A flowchart of a loading method of runtime application protection provided by an embodiment of the present disclosure;

[0020] Figure 2 A schematic diagram of a loading method of runtime application protection provided by an embodiment of the present disclosure;

[0021] Figure 3 A structural schematic diagram of a loading device of runtime application protection provided by an embodiment of the present disclosure;

[0022] Figure 4 A structural schematic diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] In order to more clearly illustrate the above-mentioned purposes, features and advantages of the present disclosure, the solutions of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0024] In the following description, many specific details are set forth in order to provide a thorough understanding of the present disclosure, but the present disclosure can also be implemented in other ways different from those described herein; obviously, the embodiments in the description are only some of the embodiments of the present disclosure, not all the embodiments.

[0025] The wide application of container technology makes the deployment and management of applications more efficient. However, with the popularity of containers, applications in containers are facing more and more security threats. In the related art, the method of integrating RASP detection function in container runtime includes:

[0026] 1. Direct integration. Specifically, in the application image production stage, personnel of each flow line maintain and integrate the image with RASP Agent capability respectively. The automation degree of this method is low, and the cognition and dependence on flow line personnel are too high, with high maintenance cost. It is only suitable for a small number of specific application image protection scenarios.

[0027] 2. Dynamic loading. Specifically, in the container running stage, RASP Agent is copied into the container, so that the container has RASP detection capability. In this method, RASP Agent needs to be copied again after the container restarts, which is cumbersome to operate.

[0028] 3. Host-level monitoring. Specifically, the RASP Agent is deployed on the container host, and the application in the container is monitored and protected through the interception mechanism at the kernel level or system call level. This method has a coarse granularity and is difficult to accurately protect each application in the container. The process and network behavior of the container are monitored, which is limited and may not accurately capture and intercept specific application layer attacks.

[0029] As can be seen, in the related art, the RASP Agent is usually injected into the running environment of the application. This method usually requires copying and modifying the application image, and the runtime application protection has a high coupling with the application, and the subsequent maintenance cost is high.

[0030] To solve the above problems, the embodiments of the present disclosure provide a loading method of RASP. Through the method, the function code of the RASP agent can be embedded into the container image without manually copying the function code of the RASP agent, so that the container has the RASP function originally, improves the security of the container application, and reduces the complexity of maintaining and deploying the container. The method will be introduced in combination with specific embodiments.

[0031] Figure 1 A flowchart of a loading method of runtime application protection is provided for the embodiments of the present disclosure. The loading method of runtime application protection can be applied to a loading device of runtime application protection. The loading device of runtime application protection can be implemented by software and / or hardware, and is generally integrated in an electronic device. As shown in the figure, the loading method of runtime application protection includes the following steps. Figure 1

[0032] Step 101, obtaining an application protection file adapted to the first container image; wherein the application protection file records the function code for implementing runtime application protection.

[0033] The first container image can be a container image that does not integrate the function code for implementing RASP, and the first container image can be understood as an original container image. The application protection file can be a file encapsulating the function code for implementing the RASP agent, for example, the application protection file can be rasp-agent.jar. The compiling language used by the application protection file is consistent with the compiling language used by the first container image.

[0034] ​RASP, also known as runtime application self-protection, can be directly injected into the protected application. RASP can provide real-time protection at the function level in the service. RASP can monitor, detect and protect against security threats in real time in the runtime environment of the application without updating the policy or upgrading the code of the protected application. Through RASP, the application itself can increase the immune ability to respond to attacks and vulnerabilities. Unlike traditional perimeter protection systems, RASP runs directly inside the application and has the following functions: first, real-time monitoring. Specifically, RASP monitors the behavior of the application during application execution, captures potential security threats such as abnormal requests and malicious inputs, and has high detection and low false positives. RASP also has good detection effect on encrypted requests and obfuscated bypass attacks. Second, self-protection. Specifically, once abnormal behavior is detected, RASP can take protective measures such as blocking malicious requests and performing repair operations to ensure the continuous security of the application. Third, intelligent decision-making. Specifically, RASP can make intelligent responses based on predefined security policies or dynamic threat intelligence, reducing human intervention and improving the timeliness of security protection. RASP is suitable for responding to application-level attacks such as Structured Query Language (SQL) injection, Cross-Site Scripting (XSS), and data leakage. RASP can provide in-depth and real-time security protection for applications.

[0035] In the embodiments of the present disclosure, in the continuous integration (CI) stage, a human or automatic execution of a start operation for an image building pipeline is performed. The image building pipeline can be a workflow for building a container image. In response to the start operation, a loading device of the RASP can determine whether the first container image has the RASP function. If yes, the first container image is directly pushed to the preset container image library. Otherwise, an application protection file adapted to the first container image is obtained.

[0036] In some embodiments of the present disclosure, obtaining the application protection file adapted to the first container image includes: determining a target programming language of the first container image; and determining a candidate protection file corresponding to the runtime application protection and written in the target programming language as the application protection file.

[0037] The target programming language can be a programming language used to write the first container image. The candidate protection file can be a file written in different languages to implement the RASP agent function, and the embodiment does not limit the candidate protection file. For example, the candidate protection file can include a RASP agent file written in Python language, a RASP agent file written in Java language, a RASP agent file written in Hypertext Preprocessor (PHP) language, and the like.

[0038] In the embodiment, the loading device of the RASP can determine the target programming language of the first container image. There are various methods to determine the target programming language, and the embodiment does not limit, for example, the loading device of the RASP can parse the document or project description of the first container image to obtain the target programming language, or the loading device of the RASP can determine the target programming language according to the start command or runtime environment setting of the first container image. Further, in the plurality of candidate protection files written in a plurality of programming languages, the candidate protection file written in the target programming language is determined as the application protection file corresponding to the first container image. Thus, the writing language of the first container image and the application protection file is consistent, and the application protection file can normally run and normally protect the container image.

[0039] Step 102, determine the file loading code corresponding to the application protection file.

[0040] The file loading code can be used to load the RASP agent in the container image. The RASP agent is a component that implements the RASP function, and the RASP agent can be understood as an executor or implementation carrier of the RASP.

[0041] In the embodiment of the present disclosure, if it is determined that there is an application protection file adapted to the first container image, the file loading code of the existing application protection file is obtained, or the loading device of the RASP can generate the file loading code corresponding to the application protection file.

[0042] In some embodiments of the present disclosure, the file loading code includes file copying code, variable setting code, and container startup code.

[0043] The file copying code can be used to copy the application protection file to a target path, which can be a directory required to store the application protection file integrated in the second container image. The file copying code can include a copy (COPY) instruction, the name of the application protection file, and the target path.

[0044] The variable setting code can be used to configure a start parameter of the application program, so that the application protection file is loaded when the application program is started, that is, the loading of the RASP agent is implemented. The start parameter can be an environment variable identified when the application program is started. The variable setting code can include a variable setting (ENV) instruction, a running configuration parameter, a running configuration parameter value, the running configuration parameter value can include an agent setting parameter and a target path. The running configuration parameter can be a parameter used to configure the running of the virtual machine. For example, the running configuration parameter can be JAVA_OPTS. The running configuration parameter value can be a specific value corresponding to the running configuration parameter. The agent setting parameter can be used to increase the function by loading the corresponding agent without modifying the original program. For example, the agent setting parameter can be -javaagent.

[0045] The container startup code can be used to start an interpreter when the container is started, and then execute a specified command through the interpreter. Through the execution of the command, the RASP agent is loaded when the running configuration parameter value configured by the variable setting code is set, and the application program in the container is started. The container startup code can include a command execution (CMD) instruction, an interpreter startup character, a command execution character, a running configuration parameter, and a target path. The interpreter startup character is used to start the interpreter, and the command execution character is used to indicate the command after the command execution character.

[0046] In the above scheme, the file copying code, the variable setting code, and the container startup code are the codes required to implement the automatic loading of the RASP, and based on the above codes, the conditions for implementing the automatic loading of the RASP by modifying the layer construction file are created.

[0047] In some embodiments of the present disclosure, the file loading code corresponding to the application protection file is determined, including:

[0048] According to the target path of the application protection file and the copying instruction, the file copying code is constructed, according to the target path of the application protection file and the variable setting instruction, the variable setting code is constructed, and according to the target path of the application protection file and the command execution instruction, the container startup code is constructed.

[0049] In this embodiment, the RASP loading device can obtain the target path to which the application protection file needs to be copied, splice the name of the application protection file and the target path after the copying instruction, and obtain the constructed copying code. Moreover, the RASP loading device can splice the running configuration parameter, the agent setting parameter, and the target path after the variable setting (ENV) instruction, and obtain the variable setting code. Moreover, the RASP loading device can splice the interpreter startup character, the command execution character, the running configuration parameter, and the target path after the command execution instruction, and obtain the container startup code.

[0050] In the above scheme, the agent setting parameter option is configured in the running configuration parameter, so that the RASP agent can be automatically loaded when the application is started. Moreover, according to different programming languages and running environments, the loading mode of the RASP can be set, for example, the -javaagent parameter can be used in the Java application, and in other programming languages, the start script or plug-in corresponding to the programming language can be set, so that the application protection file does not conflict with the application itself, and the potential influence of the application protection file on the start time, performance and dependency management of the application is reduced.

[0051] In step 103, the file loading code is added to the first layer construction document of the first container image to obtain a second layer construction document.

[0052] The layer construction document (Dockerfile) is a text document, which can include a series of instructions for automatically building a container image. The layer construction document can define one or more of the base environment, application, library, configuration file and dependency of the container image. The layer construction document is the core of building a Docker container image, which can make it easier for users to manage and deploy applications in the container image. The first layer construction document can be used to build the first container image, which can be understood as a pre-configured original document. The second layer construction document can be a layer construction document obtained by integrating the RASP automatic loading function based on the first layer construction document. The application protection file can be copied to the container image through the second layer construction document, and the related parameters of the application protection file can be configured in the second layer construction document, so that the RASP is loaded when the container is started.

[0053] In the embodiments of the present disclosure, for each file loading code, the loading device of the RASP can determine the instruction type of the file loading code, determine the code addition position corresponding to the instruction type in the first layer construction document, and add the file loading code to the code addition position. After the above processing is performed for each file loading code, the second layer construction document is obtained.

[0054] Therefore, by constructing the second layer construction document, dynamic management of the RASP configuration is realized, and the related configuration of the RASP can be automatically adjusted and updated through the layer construction file in different container deployment environments (for example, development, testing, production, etc.).

[0055] In some embodiments of the present disclosure, adding the file loading code to the first layer construction document of the first container image to obtain the second layer construction document includes:

[0056] In the replication layer of the first layer construction document, the file replication code is added, and in the environment setting layer of the first layer construction document, the variable setting code is added, and the original start code in the execution layer of the first layer construction document is replaced by the container start code, to obtain the second layer construction document.

[0057] The replication layer can be a layer corresponding to the replication instruction in the first layer construction document. The environment setting layer can be a layer corresponding to the variable setting instruction in the first layer construction document. The original start code can be an original code for starting the container in the first layer construction document.

[0058] In the embodiment, the loading device of the RASP can determine the replication layer corresponding to the replication instruction, and add the file replication code in the replication layer to obtain the updated replication layer. Moreover, the loading device of the RASP can determine the environment setting layer corresponding to the variable setting instruction, and add the variable setting code in the environment setting layer to obtain the updated environment setting layer. Moreover, the loading device of the RASP can parse the existing code with the command execution instruction in the first layer construction document, determine the original start code, and replace the original start code with the container start code. Furthermore, after the addition of the file replication code, the variable setting code, and the container start code is completed, the second layer construction document is obtained.

[0059] In the above scheme, the subsequent automatic loading of the RASP is realized by adding the corresponding code at the corresponding position of the first layer construction file, the environment variable configuration required by the application protection file is met by modifying the construction file, the decoupling of the environment variable configuration management and the application program is realized, and the flexibility and manageability of the configuration are ensured. Moreover, the modification of the layer construction file has consistency, and the consistency and correctness of the configuration in different environments (for example, development, test, production, etc.) are ensured, and the protection failure caused by the difference in the configuration of the RASP in different environments is avoided. Moreover, based on the layer construction document, the related configuration of the RASP in the original first container image is realized by automatically adjusting the environment variable, without manually rebuilding the image.

[0060] In step 104, a second container image is constructed according to the second layer construction document, and the second container image is instantiated to obtain a target container.

[0061] The target container can be a container obtained by instantiating the second container.

[0062] In this embodiment of the disclosure, after determining the second-layer build document, the RASP loading device can read the instructions in the second-layer build document. Specifically, the RASP loading device can determine the base image based on the second container image. Then, the subsequent instructions in the second-layer build document are executed sequentially according to the instruction order. Each executed instruction creates a new layer on top of the already established layers, with the base image being the first established layer. These layers are combined to form the final second container image.

[0063] After determining the second container image, in the continuous deployment pipeline, the second container image, which integrates the application protection file, is deployed to the target environment (e.g., Kubernetes, OpenShift cluster, Docker container). The second container image is then instantiated to obtain the target container. When the target container starts, the application protection file is automatically run, enabling automatic loading and initialization of the RASP agent. During the runtime of the target container, the RASP agent continuously monitors the application and provides security protection.

[0064] In some embodiments of this disclosure, building a second container image according to a second-layer build document includes: if the second container image is successfully started according to the second-layer build document, then pushing the second container image to a preset container image repository. The preset container image repository can be a pre-set virtual repository for storing container images.

[0065] In this embodiment, after determining the second-layer build document, the RASP loading device can determine whether the second container image can be built normally based on the second-layer build document. If so, the second container image is pushed to the preset container image library through the pipeline.

[0066] In the above solution, the application protection file (RASP) is integrated into the second container image corresponding to the second-layer build document through file loading code. This allows the target container instantiated based on the second container image to automatically load RASP at application runtime. Furthermore, RASP takes effect upon application startup, enabling real-time monitoring and protection of application runtime security, preventing attacks such as SQL injection and XSS, thus achieving immediate protection.

[0067] In some embodiments of this disclosure, the loading method for runtime application protection further includes: if starting the second container image according to the second-layer build document fails, starting the first container image according to the first-layer build document and pushing the first container image to a preset container image library.

[0068] In the embodiment, after determining the second layer construction document, the loading device of the RASP can determine whether the second container image can be normally constructed according to the second layer construction document. If not, the first container image is generated according to the first layer construction document, and the first container image is pushed to the preset container image library through the pipeline. In addition, the abnormal information generated in the process of constructing the second container image by the second layer construction document is recorded through the pipeline, and the abnormal information is sent to the R&D personnel to remind the R&D user to solve the problem.

[0069] In the above scheme, in the case that the construction of the second container image according to the second layer construction document fails, the abnormal information is automatically recorded through the pipeline for analysis and improvement iteration by the R&D personnel, and the R&D personnel is notified. At the same time, a first container image without integrated application protection file is generated, and the first container image is pushed to the preset container image library, thereby avoiding blocking the continuous deployment (CD) pipeline.

[0070] The loading method of the runtime application protection provided in the embodiments of the present disclosure includes: obtaining an application protection file adapted to a first container image; wherein the application protection file records function code for implementing runtime application protection; determining file loading code corresponding to the application protection file; adding the file loading code to a first layer construction document of the first container image to obtain a second layer construction document; constructing a second container image according to the second layer construction document, and instantiating the second container image to obtain a target container; wherein the second container image loads the runtime application protection on the basis of the first container image. By using the above technical scheme, the application protection file adapted to the first container image is determined, the loading code corresponding to the application protection file is introduced into the layer construction document, and then the application protection file is integrated into the container image in the process of constructing the container image according to the layer construction document, and then the automatic loading of the runtime application protection is realized in the target container obtained by instantiating the container image, thereby avoiding complex manual operation, and the application image itself does not need to be modified in the form of modifying the layer construction file, thereby reducing the invasion to the business code, realizing the decoupling between the configuration of the runtime application protection and the application image, and reducing the cost of subsequent maintenance.

[0071] In addition, the automation integration of the continuous integration / continuous deployment pipeline is realized. Specifically, in the development and operation integrated (DevOps) process, the application protection file encapsulating the RASP agent function code is integrated in the integration process automation of the second container image, the automatic building of the second container image integrated with the application protection file is realized through the continuous integration / continuous deployment pipeline, and the effectiveness of the RASP function can be verified through the automated security testing (for example, vulnerability scanning, stress testing, etc.), and the second container image can be deployed to the test or production environment. The collaboration efficiency between different personnel is greatly improved. Specifically, in the case where the security testing part of RASP needs to be integrated into the continuous integration and continuous delivery process, the application protection file is automatically injected when the second container image is built, so that the application protection file is correctly integrated in each built second container image, and the RASP function will not be disabled due to version differences.

[0072] In addition, the application protection file is automatically loaded when the target container starts, ensuring that the RASP agent function implemented by the code encapsulated in the application protection file is automatically implemented when the target container starts without additional manual intervention. The automatic loading of the application protection file can be realized by configuring a startup script, an environment variable or a mounted way in the second container image. In addition, for a plurality of configuration files (for example, protection policies, monitoring rules, etc.) relied on by the RASP agent, the configuration files can be flexibly changed according to specific application scenarios.

[0073] Next, the loading method of the runtime application protection in the embodiments of the present disclosure is further described through a specific example, Figure 2 A schematic diagram of a loading method of runtime application protection provided by the embodiments of the present disclosure is shown in Figure 2 As shown in the figure, in the continuous integration pipeline, a human or automatic execution of a startup operation for the image making pipeline is performed, and the RASP loading device starts the pipeline for making the second container image in response to the startup operation. Through the pipeline, it is determined whether the first container image needs to have the RASP function. If the first container image has the RASP function, it means that the first container image does not need additional RASP function, then the first container image is normally made and pushed to the preset container image library; if the first container image does not have the RASP function, it means that the first container image needs additional RASP function, then the file loading code is determined. Specifically, the RASP loading device can confirm the programming language and the running environment of the first container image, and determine the file loading code corresponding to the application protection file consistent with the programming language and the running environment.

[0074] Further, the implementation code of the integrated RASP agent is added to the second container image. Specifically, first, the second layer build document is determined, and the second container image is built according to the second layer build document. Specifically, the file copy code is added to the pre-configured first layer build document, so that when the second container image is built, the code file implementing the RASP agent is copied into the second container image. The RASP agent related variable setting code and container startup code are configured in the first layer build document, so that when the container starts, the RASP can be normally loaded. In the second layer build document, rasp-agent.jar is the RASP component, and the -javaagent option is configured in the JAVA_OPTS environment variable, so that the RASP Agent is automatically loaded when the application starts. After determining the second layer build document, the second container image is built according to the second layer build document.

[0075] Further, after the second container image is built, whether the second container image can be normally started is tested. If not, the error log is automatically recorded and the exception information is generated through the pipeline, and the exception information is sent to the R&D personnel for analysis and improvement iteration. Moreover, the first container image is normally made, and the first container image is pushed to the preset container image library. If the second container image can be normally started, the normal log is recorded, and the second container image is pushed to the preset container image library through the pipeline, so as to avoid blocking the continuous deployment process.

[0076] In the continuous deployment pipeline, the second container image containing the application protection file encapsulating the code implementing the RASP agent function is deployed to the target environment (such as Kubernetes, Openshift cluster, Docker container). When the target container starts, the RASP agent is automatically loaded and initialized, realizing the automatic loading of the RASP. The RASP agent continuously monitors the application and provides security protection during the running of the target container.

[0077] In the above scheme, the layer integrating the application protection file is added in the second layer build document, and the new second container image is generated and pushed to the preset container image library according to the second layer build document. The newly generated second container image originally has the RASP function. The manual modification of the image making process and the cumbersome process of copying the application protection file into the container are avoided. Therefore, without interfering with the image making process, the cumbersome process of manually copying the application protection file into the container is omitted. The application protection file is automatically copied and integrated into the container image, so that the second container image originally has the RASP capability.

[0078] The RASP loading method provided by the embodiments of the present disclosure has one or more of the following effects:

[0079] First, the automation and non-invasive integration of RASP loading are realized. Specifically, by adding file loading code corresponding to the RASP agent in the second layer construction document, developers and operation and maintenance personnel can automatically load the RASP component during the construction of the second container image without modifying the application itself, reducing the invasion of business code. Moreover, the deployment process of RASP is simplified. Specifically, the security mechanisms implemented by RASP are bundled with the target container, and operation and maintenance personnel and developers deploy the target container without the need for additional security protection configuration after the target container is deployed, simplifying the deployment steps of the target container.

[0080] Second, the instant security protection is provided. Specifically, the RASP agent takes effect when the target container starts, and can monitor and protect the runtime security of the application in the target container in real time, prevent common SQL injection, XSS attacks and other attacks, and provide instant protection. Moreover, the security of the application is improved. Specifically, the RASP is automatically loaded when the target container starts, which can dynamically protect the application during runtime, providing additional security protection and thus enhancing the overall security of the application. Moreover, since RASP runs inside the application, it can detect and prevent vulnerabilities from being exploited in real time, thus greatly reducing the risk of security vulnerabilities being attacked in the production environment.

[0081] Third, the consistency across environments is provided. Specifically, by uniformly packaging the second container image, the same RASP running configuration can be ensured in different environments (e.g., development, testing, production), avoiding security configuration deviations due to different environments.

[0082] Fourth, the configurability and flexibility are provided. Specifically, through the environment variables and configuration files, the configuration of RASP can be customized according to different application scenarios, meeting various business needs and increasing flexibility. The system stability and reliability are improved. Moreover, the self-protection mechanism of RASP enables the application to handle itself when attacked, reducing the possibility of system crash or business interruption and improving the stability and reliability of the system.

[0083] Fifth, the operation and maintenance burden is reduced. Specifically, by automatically loading the RASP agent, operation and maintenance personnel are avoided from manually loading or configuring RASP after each target container starts, simplifying the management process of the target container and reducing the risk of misoperation in security configuration.

[0084] Sixth, the observability is enhanced. Specifically, the RASP is provided with monitoring and logging functions, and the RASP is integrated in the target container, so that the running state of the application, attack behavior and potential security vulnerabilities can be recorded in detail, facilitating subsequent security analysis and troubleshooting. Through continuous monitoring and protection, the RASP can prevent potential attacks in real time without affecting normal business, and reduce business risks caused by undetected vulnerabilities.

[0085] Seventh, the cooperation efficiency of personnel is improved. Specifically, the RASP is directly integrated into the target container, so that the developer introduces the RASP in the development stage, and the development and operation cooperation efficiency is improved. The additional burden of the developer and the operation personnel is reduced, and a high-efficiency and safe protection means is provided, so that the security protection is more closely combined with the development and deployment process of the application program, and the security and efficiency are improved.

[0086] Figure 3 The structure schematic diagram of the loading device of the runtime application protection provided by the embodiment of the disclosure can be implemented by software and / or hardware, and the device can be integrated in an electronic device. As shown in the structure schematic diagram of the loading device of the runtime application protection provided by the embodiment of the disclosure, Figure 3 The loading device of the runtime application protection comprises:

[0087] The acquisition module 301 is configured to acquire an application protection file adapted to the first container image. The application protection file records function code for implementing runtime application protection.

[0088] The determination module 302 is configured to determine file loading code corresponding to the application protection file.

[0089] The adding module 303 is configured to add the file loading code to a first layer construction document of the first container image to obtain a second layer construction document.

[0090] The construction module 304 is configured to construct a second container image according to the second layer construction document, and instantiate the second container image to obtain a target container. The second container image is integrated with the application protection file based on the first container image.

[0091] Optionally, the acquisition module 301 is configured to:

[0092] Determine a target programming language of the first container image.

[0093] Determine a candidate protection file corresponding to the runtime application protection and written in the target programming language as the application protection file.

[0094] Optionally, the file loading code comprises file copying code, variable setting code and container starting code.

[0095] Optionally, the determining module 302 is configured to:

[0096] According to the target path of the application protection file, the copy instruction, a file copy code is constructed, according to the target path of the application protection file, the variable setting instruction, a variable setting code is constructed, and according to the target path of the application protection file, the command execution instruction, a container startup code is constructed.

[0097] Optionally, the adding module 303 is configured to:

[0098] In the copy layer of the first layer construction document, the file copy code is added, in the environment setting layer of the first layer construction document, the variable setting code is added, and the original startup code in the execution layer of the first layer construction document is replaced by the container startup code, to obtain the second layer construction document.

[0099] Optionally, the constructing a second container image according to the second layer construction document comprises:

[0100] If the second container image is started successfully according to the second layer construction document, the second container image is pushed to a preset container image library.

[0101] Optionally, the loading apparatus of the runtime application protection further comprises:

[0102] The pushing module is configured to, if the second container image fails to be started according to the second layer construction document, start the first container image according to the first layer construction document, and push the first container image to the preset container image library.

[0103] It should be noted that, Figure 3 The loading apparatus 300 of the runtime application protection shown can perform each step in the loading method embodiment of the runtime application protection described above, and achieve each process and effect in the loading method embodiment of the runtime application protection described above, which will not be repeated here.

[0104] Figure 4 A structural schematic diagram of an electronic device is provided for the embodiments of the present disclosure. As shown in Figure 4 The electronic device 400 includes one or more processors 401 and a memory 402.

[0105] The processor 401 can be a central processing unit (CPU) or other forms of processing units with the loading capability of the runtime application protection and / or the instruction execution capability, and can control other components in the electronic device 400 to perform the desired functions.

[0106] The memory 402 can include one or more computer program products that can include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory, for example, can include random access memory (RAM), cache memory, and / or the like. The non-volatile memory, for example, can include read-only memory (ROM), hard disk drives, solid-state drives, and / or the like. The computer-readable storage media can store one or more computer program instructions implementing the loading method of runtime application protection of the embodiments of the present disclosure described above and / or other desired functions. Various contents such as input signals, signal components, noise components, and the like can also be stored in the computer-readable storage media.

[0107] In one example, the electronic device 400 can further include an input device 403 and an output device 404, which are interconnected through a bus system and / or other forms of connection mechanisms (not shown).

[0108] In addition, the input device 403 can further include, for example, a keyboard, a mouse, and the like.

[0109] The output device 404 can output various information including the determined distance information, direction information, and the like to the outside. The output device 404 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0110] Of course, in order to simplify, Figure 4 Only some of the components related to the present disclosure among the electronic device 400 are shown in the figure, and components such as buses, input / output interfaces, and the like are omitted. In addition, the electronic device 400 can further include any other appropriate components according to specific application cases.

[0111] In addition to the above-mentioned method and device, the embodiments of the present disclosure can also be a computer program product including computer program instructions that, when executed by a processor, cause the processor to perform the loading method of runtime application protection provided by the embodiments of the present disclosure.

[0112] The computer program product can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server. The embodiments of the present disclosure can be a computer program product, which can include a computer program tangibly embodied in a machine readable storage medium.

[0113] In addition, embodiments of the present disclosure can also be a computer readable storage medium, which stores computer program instructions, and the computer program instructions, when executed by a processor, cause the processor to perform the loading method of the runtime application protection provided by the embodiments of the present disclosure.

[0114] The computer readable storage medium can take the form of one or more combinations of any type of readable media. The readable media can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any suitable combination thereof. More specific examples (a non-exhaustive list) of the readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), an optical fiber, a portable compact disc read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0115] It should be noted that, in this document, the terms such as "first" and "second" are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0116] The foregoing is merely illustrative of the various implementations of the present disclosure and the general principles thereof. Numerous modifications can be made to these illustrations, and equivalents can be substituted therefor, without departing from the scope of the present disclosure. The specific embodiments commensurate with the specific application are intended to be illustrative only and not limiting of the scope of the application as set forth in the following claims.

Claims

1. A method for loading runtime application protection, characterized in that, include: Obtain the application protection file adapted to the first container image; wherein, the application protection file records the functional code that implements runtime application protection; Determine the file loading code corresponding to the application protection file; The file loading code is added to the first layer build document of the first container image to obtain the second layer build document; wherein, the layer build document is a text document containing a series of instructions for automating the process of building the container image; A second container image is constructed based on the second layer build document, and the second container image is instantiated to obtain the target container; wherein, the second container image integrates the application protection file based on the first container image; The step of adding the file loading code to the first layer build document of the first container image to obtain the second layer build document includes: In the copy layer of the first-layer build document, file copying code is added, and in the environment setting layer of the first-layer build document, variable setting code is added. The original startup code in the execution layer of the first-layer build document is replaced with container startup code to obtain the second-layer build document. The copy layer is the layer corresponding to the copy instruction in the first-layer build document, the environment setting layer is the layer corresponding to the variable setting instruction in the first-layer build document, and the original startup code is the original code used to start the container in the first-layer build document.

2. The method according to claim 1, characterized in that, The process of obtaining the application protection file adapted to the first container image includes: Determine the target programming language for the first container image; The candidate protection file written in the target programming language corresponding to the runtime application protection is determined as the application protection file.

3. The method according to claim 1, characterized in that, The file loading code includes file copying code, variable setting code, and container startup code.

4. The method according to claim 3, characterized in that, The step of determining the file loading code corresponding to the application-protected file includes: Based on the target path and copy instructions of the application protected file, file copying code is constructed; based on the target path and variable setting instructions of the application protected file, variable setting code is constructed; and based on the target path and command execution instructions of the application protected file, container startup code is constructed.

5. The method according to claim 1, characterized in that, The step of building the second container image based on the second-layer build document includes: If the second container image is successfully started according to the second layer build document, the second container image will be pushed to the preset container image library.

6. The method according to claim 1, characterized in that, The method further includes: If starting the second container image according to the second layer build document fails, then starting the first container image according to the first layer build document and pushing the first container image to the preset container image library.

7. A loading device for runtime application protection, characterized in that, include: The acquisition module is used to acquire the application protection file adapted to the first container image; wherein, the application protection file records the functional code that implements runtime application protection. The determination module is used to determine the file loading code corresponding to the application-protected file; An add module is used to add the file loading code to the first layer build document of the first container image to obtain the second layer build document; wherein, the layer build document is a text document containing a series of instructions for automating the process of building the container image; The build module is used to build a second container image based on the second layer build document and instantiate the second container image to obtain the target container; wherein the second container image integrates the application protection file based on the first container image; The step of adding the file loading code to the first layer build document of the first container image to obtain the second layer build document includes: In the copy layer of the first-layer build document, file copying code is added, and in the environment setting layer of the first-layer build document, variable setting code is added. The original startup code in the execution layer of the first-layer build document is replaced with container startup code to obtain the second-layer build document. The copy layer is the layer corresponding to the copy instruction in the first-layer build document, the environment setting layer is the layer corresponding to the variable setting instruction in the first-layer build document, and the original startup code is the original code used to start the container in the first-layer build document.

8. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the runtime application protection loading method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for executing the runtime application protection loading method as described in any one of claims 1-6.

Images