Network access control method based on network side vehicle container

Abstract

The invention provides a network access control method based on a network side vehicle container, which belongs to the technical field of network security, and comprises the following steps: deploying a business service container and the network side vehicle container in a container unit; configuring an access white list through the service management and control platform, and synchronizing the access white list to a network side vehicle container; when monitoring that a network access request initiated by the business service container is public network access, hijacking the public network access request to a network side vehicle container based on a firewall rule; the method comprises the following steps: acquiring a protocol type and server associated information in a public network access request, extracting corresponding server verification information from the server associated information according to the protocol type, querying in an access white list according to the server verification information, and when acquiring that the access white list contains the server verification information, querying in the access white list according to the public network access request. And establishing communication connection with a public network server for data transmission. According to the method, detection of public network service requests of various protocol types is realized, and the convenience of accessing white list configuration is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network access control method based on a network sidecar container. Background Art

[0002] With the rapid development of information technology, network configuration is often based on container technology to meet the business needs of network application scenarios. Containers provide a packaged operating environment and facilitate network construction. However, network environments built based on containers are vulnerable to attacks due to network security vulnerabilities. Attackers can exploit these vulnerabilities to enter the container and use the existing environment as a relay to launch a rebound shell attack or transmit sensitive data to public network servers. To address this issue, setting up a public network whitelist—limiting data transmission to public network servers with specific domain names or IP addresses—is proposed to ensure network security.

[0003] However, existing public network whitelist control solutions are often implemented through the NAT (Network Address Translation) firewall at the data center egress. The NAT firewall detects access requests initiated based on the public network whitelist configured by the IP address. However, when the access request initiated by the business service container does not contain an IP address, the NAT firewall has difficulty detecting the access request, resulting in the incorrect interception of legitimate network access requests. In addition, for large-scale network service scenarios, the outbound data traffic may reach hundreds of GB. Due to the inconvenience and lag in whitelist configuration by business and R&D personnel, data transmission traffic is damaged, making it difficult for traditional technical solutions to meet the needs of large-scale and complex network scenarios.

[0004] Therefore, a network access control method based on network sidecar container is proposed. Summary of the Invention

[0005] In order to solve the above technical problems, the present invention provides a network access control method based on a network sidecar container, which is used to solve the problems in traditional technology that NAT firewalls only perform access detection based on IP addresses and configure whitelists, which are inconvenient and delayed.

[0006] An embodiment of the present invention provides a network access control method based on a network sidecar container, including:

[0007] Deploy business service containers and network sidecar containers in the container unit;

[0008] Configure the access whitelist through the service management and control platform and synchronize it to the network sidecar container;

[0009] When monitoring the network access request initiated by the business service container, if it is detected that the network access request is for public network access, the public network access request is hijacked to the network sidecar container based on the firewall rules;

[0010] Parsing the public network access request through the network sidecar container to obtain the protocol type and server association information in the public network access request;

[0011] Corresponding server verification information is extracted from the server association information according to the protocol type, and a query is performed in the access whitelist based on the server verification information. When the access whitelist is found to contain the server verification information, a communication connection is established with the public network server for data transmission according to the public network access request.

[0012] Preferably, the present invention provides a network access control method based on a network sidecar container, the steps of: configuring an access whitelist through a service management and control platform and synchronizing it to the network sidecar container; comprising:

[0013] The service control platform is provided with an external data interface, and R&D personnel configure the access whitelist in the service control platform through the external data interface.

[0014] Preferably, the present invention provides a network access control method based on a network sidecar container, the step of: when monitoring a network access request initiated by the business service container, when detecting that the network access request is a public network access, hijacking the public network access request to the network sidecar container based on firewall rules; comprising:

[0015] When monitoring the network access request initiated by the business service container, if it is detected that the network access request is an intranet access, obtaining the intranet access request;

[0016] Parse the intranet access request to obtain the source address information of the business service container, the target intranet server IP address and the port protocol;

[0017] Based on the intranet access rule, it is determined whether the business service container has access rights. When it is determined that the business service container has access rights, a communication connection between the business service container and the target intranet server is established based on the port protocol.

[0018] Preferably, the present invention provides a network access control method based on a network sidecar container, the step of: when monitoring a network access request initiated by the business service container, when detecting that the network access request is a public network access, hijacking the public network access request to the network sidecar container based on firewall rules; comprising:

[0019] Parse the public network access request to obtain the source address information, service port number, and target public network server address information of the business service container;

[0020] Based on firewall rules, the target public network server address information in the public network access request is changed to the network sidecar container address information, and the public network access request is hijacked to the network sidecar container; optionally, including:

[0021] Execute iptables commands based on firewall rules;

[0022] {iptables-t nat-p datarules-r output-d Network Sidecar Address-jACCEPT}

[0023] Among them, iptables is the command prompt, -t nat is the network address translation identifier, -p datarules changes the original data transmission rules, -r output replaces the original data output rules, -d Network Sidecar Address changes the target address of data transmission to the network sidecar container address, and -j ACCEPT uses the changed rules to transmit data.

[0024] Preferably, the present invention provides a network access control method based on a network sidecar container, the steps of: extracting corresponding server verification information from the server association information according to the protocol type, and querying the access whitelist according to the server verification information; when the access whitelist contains the server verification information, establishing a communication connection with the public network server for data transmission according to the public network access request; comprising:

[0025] When the protocol type in the public network access request is Hypertext Transfer Protocol Security, obtaining the domain name information in the server-associated information, performing a query based on the domain name whitelist information in the access whitelist, and when the domain name whitelist information is found to contain the domain name information, establishing a communication connection with the public network server for data transmission according to the public network access request;

[0026] When the protocol type in the public network access request is Hypertext Transfer Protocol, obtaining the request header domain name information in the server association information, performing a query based on the domain name whitelist information in the access whitelist, and when the domain name whitelist information is found to contain the request header domain name information, establishing a communication connection with the public network server for data transmission according to the public network access request;

[0027] When the protocol type in the public network access request is Transmission Control Protocol or User Datagram Protocol, obtaining the target server IP address information in the server association information, performing a query based on the IP whitelist information in the access whitelist, and when the IP whitelist information is found to contain the target server IP address information, establishing a communication connection with the public network server for data transmission according to the public network access request;

[0028] The server verification information includes domain name information, request header domain name information and target server IP address information.

[0029] Preferably, the present invention provides a network access control method based on a network sidecar container, comprising the steps of: extracting corresponding server verification information from the server association information according to the protocol type, querying the access whitelist according to the server verification information, and establishing a communication connection with the public network server for data transmission according to the public network access request when the access whitelist contains the server verification information; and further comprising:

[0030] When it is found that the server verification information is not included in the access whitelist, the communication connection between the network sidecar container and the public network server is prohibited according to the public network access request, and a prohibited access prompt message is returned to the business service container.

[0031] Preferably, the present invention provides a network access control method based on a network sidecar container, comprising the steps of: extracting corresponding server verification information from the server association information according to the protocol type, querying the access whitelist according to the server verification information, and establishing a communication connection with the public network server for data transmission according to the public network access request when the access whitelist contains the server verification information; and further comprising:

[0032] Monitor and analyze public network access requests that successfully establish a communication connection with the public network server to obtain the IP address of the public network server with which the communication connection is established;

[0033] Count the access frequency of the network sidecar container to the public server IP address, and when the access frequency reaches a preset high access frequency, set the public server corresponding to the public server IP address as a verification-free server;

[0034] The network sidecar container maps the business IP address and business port number of the business service container to the IP address and public port number of the verification-free server; when the public network server in the public network access request initiated by the business service container is a verification-free server, the network sidecar container does not hijack the public network access request, and the business service container directly establishes a communication connection with the public network server.

[0035] Preferably, the present invention provides a network access control method based on a network sidecar container, comprising the steps of: extracting corresponding server verification information from the server association information according to the protocol type, querying the access whitelist according to the server verification information, and establishing a communication connection with the public network server for data transmission according to the public network access request when the access whitelist contains the server verification information; and further comprising:

[0036] Obtain the communication link established between the network sidecar container and the public network server, and monitor the real-time data transmission volume of each communication sub-link;

[0037] Obtaining data to be transmitted in the network sidecar container that has established a communication connection with the public network server but has not been transmitted;

[0038] According to the link utilization rate of each communication sub-link, intelligently allocate the communication sub-links for data transmission for the data to be transmitted; optionally, including:

[0039] Obtaining the real-time transmission data volume and link resource occupancy of the communication sub-link, and performing normalization processing and analysis to obtain a comprehensive evaluation value of the communication sub-link;

[0040] According to the comprehensive evaluation value of each communication sub-link, for the data to be transmitted with a high priority, the communication sub-link is selected to perform data transmission on the data to be transmitted.

[0041] Preferably, the present invention provides a network access control method based on a network sidecar container, the steps of obtaining the real-time transmission data volume and link resource occupancy of the communication sub-link, performing normalization processing and analysis, and obtaining a comprehensive evaluation value of the communication sub-link; comprising:

[0042] Calculating a comprehensive evaluation value based on the standard remaining bandwidth, standard transmission delay, standard packet loss rate of the communication sub-link and the standard flow table bandwidth of the switch in link transmission;

[0043] L i =ω1bw si +ω2dl si +ω3r si +ε·SW si

[0044] Among them, L i is the comprehensive evaluation value of the ith communication sub-link, bw si is the normalized standard residual bandwidth of the ith communication sub-link, ω1 is the bandwidth weight corresponding to the standard residual bandwidth, and dl si is the normalized standard transmission delay of the ith communication sub-link, ω2 is the delay weight corresponding to the standard transmission delay, r si is the normalized standard packet loss rate of the ith communication sub-link, ω3 is the packet loss rate weight corresponding to the standard packet loss rate, ε is a constant, SW si is the standard flow table bandwidth of the switch in the i-th communication sub-link;

[0045]

[0046] Among them, bw i is the remaining bandwidth of the i-th communication sub-link, is the total bandwidth of the i-th communication sub-link, SD i (t) is the amount of data sent by the i-th communication sub-link at time t, SD i (t+Δt) is the amount of data sent after the interval Δt;

[0047]

[0048] Among them, bw min is the minimum bandwidth among all communication sub-links;

[0049] The network sidecar container sends the first latency test information with the container timestamp to the public network server to obtain the container sending time and server reception time

[0050] The public network server sends the second delay test information with the server timestamp to the network sidecar container, and obtains the server sending time and container receipt time

[0051]

[0052] Among them, dl A The total delay of data information transmission between the network sidecar container and the public network server through the i-th communication sub-link, dl i The transmission delay of the i-th communication sub-link;

[0053]

[0054] Among them, dl maxis the maximum transmission delay in all communication sub-links;

[0055] Get the number of data packets SX sent by the network sidecar container to the public network server through the i-th communication sub-link at time t i (t), measure again after the interval Δt, and obtain the number of data packets sent at time t+Δt SX i (t+Δt);

[0056] Get the number of data packets RX received by the public network server at time t through the i-th communication sub-link i (t), measure again after the interval Δt, and obtain the number of data packets RX received at time t+Δt i (t+Δt);

[0057]

[0058] Among them, r i is the packet loss rate of the i-th communication sub-link;

[0059]

[0060] Among them, r max is the maximum packet loss rate in all communication sub-links;

[0061] Get the flow table bandwidth of the switch in the i-th communication sub-link;

[0062]

[0063] in, is the bandwidth occupied by the switch transmitting data information in the i-th communication sub-link, is the bandwidth of the jth sub-data in the data information transmitted by the switch in the i-th communication sub-link. The currently transmitted data information contains a total of m sub-data. c_byte is the number of bytes of the jth sub-data. t_duration j The duration of transmitting the jth sub-data;

[0064]

[0065] Among them, SW i is the flow table bandwidth of the switch in the i-th communication sub-link, SW max is the maximum flow table bandwidth of the switches in all communication sub-links, SW si is the standard flow table bandwidth of the switch in the i-th communication sub-link.

[0066] Compared with traditional technologies, the beneficial effects of the present invention are: a network access control method based on a network sidecar container realizes the detection of public network service requests of various protocol types by extracting the corresponding server verification information in the server association information based on the network sidecar container, solving the inconvenience of NAT firewall in traditional technology that only performs access detection based on IP address, further avoiding the situation where legitimate network access requests are mistakenly intercepted, and realizing precise control and monitoring of data information transmitted to the public network server through the network sidecar container. Through the setting of the service management and control platform, business personnel and R&D personnel can configure the access whitelist through the service management and control platform and synchronize it to the network sidecar container, solving the problems of inconvenience and lag in access whitelist configuration in traditional technology, thereby improving the access efficiency and data transmission rate of the business service container to the public network server, making it suitable for large-scale data transmission and complex network service scenarios, further improving the network security protection capabilities in the containerized deployment environment, and reducing the complexity and cost of operation and maintenance.

[0067] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purposes and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0068] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 A schematic diagram of the flow of a network access control method based on a network sidecar container provided by the present invention;

[0070] Figure 2 This is a schematic diagram of container unit deployment for a network access control method based on a network sidecar container provided by the present invention. DETAILED DESCRIPTION

[0071] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0072] Example 1:

[0073] The embodiment of the present invention provides a network access control method based on a network sidecar container, referring to Figure 1 and Figure 2 ,include:

[0074] Deploy business service containers and network sidecar containers in the container unit;

[0075] Configure the access whitelist through the service management and control platform and synchronize it to the network sidecar container;

[0076] When monitoring network access requests initiated by business service containers, if the network access requests are detected to be public network access, the public network access requests are hijacked to the network sidecar container based on the firewall rules;

[0077] Parse public network access requests through the network sidecar container to obtain the protocol type and server association information in the public network access requests;

[0078] The corresponding server verification information is extracted from the server association information according to the protocol type, and the access whitelist is searched based on the server verification information. When the access whitelist contains the server verification information, a communication connection with the public network server is established for data transmission according to the public network access request.

[0079] In the above embodiments, the business service container and the network sidecar container are deployed in the container unit, and a communication connection is established with the network sidecar container through the service management and control platform, and the access whitelist configured in the service management and control platform is synchronized to the network sidecar container.

[0080] In the above embodiment, when monitoring the network access request initiated by the business service container, when it is detected that the network access request is a public network access, the public network access request is hijacked to the network sidecar container based on the firewall rules, and the public network access request is parsed to obtain the protocol type and server association information in the public network access request. According to the protocol type, the corresponding server verification information is extracted from the server association information, and a query is performed based on the access whitelist. When the query finds that the access whitelist contains the server verification information, a communication connection with the public network server is established according to the public network access request for data transmission.

[0081] In the above embodiment, when it is detected that the network access request initiated by the business service container is an intranet access, the intranet access request is checked for access rights based on the intranet access rules, and a communication connection is established with the target intranet server after the check passes.

[0082] In the above embodiments, the protocol types include Hypertext Transfer Protocol (HTTP), Hypertext Transfer Protocol (HTTP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP).

[0083] In the above embodiments, when the protocol type is Hypertext Transfer Protocol (HTTP), the domain name information in the server association information is extracted; when the protocol type is Hypertext Transfer Protocol (HTTP), the request header domain name information in the server association information is obtained; when the protocol type is Transmission Control Protocol (TCP) or User Datagram Protocol (UDP), the target server IP address information in the server association information is obtained.

[0084] In the above embodiment, the server verification information includes domain name information, request header domain name information and target server IP address information.

[0085] In the above embodiments, the service management and control platform can be implemented as a DevOps platform.

[0086] The beneficial effects of the above technology are: by deploying the network sidecar container in the container unit, the hijacking of the public network access request is realized when the network access request initiated by the business service container is for public network access; and the network sidecar container extracts the corresponding server verification information from the server association information according to the protocol type in the public network access request, and performs a query based on the access whitelist to realize access verification of the public network access request; compared with the traditional technology, the above method realizes the detection of public network service requests of various protocol types by extracting the corresponding server verification information from the server association information based on the network sidecar container, and solves the problem that the NAT firewall in the traditional technology only accesses based on the IP address The inconvenience of detection further avoids the situation where legitimate network access requests are mistakenly intercepted, and the network sidecar container realizes the precise control and monitoring of data information transmitted to the public network server. The service management and control platform is set up, and business personnel and R&D personnel can configure access whitelists through the service management and control platform and synchronize them to the network sidecar container, which solves the problems of inconvenience and lag in access whitelist configuration in traditional technologies, thereby improving the access efficiency and data transmission rate of business service containers to public network servers, making it suitable for large-scale data transmission and complex network service scenarios, further improving the network security protection capabilities in the containerized deployment environment, and reducing the complexity and cost of operation and maintenance.

[0087] Example 2:

[0088] An embodiment of the present invention provides a network access control method based on a network sidecar container, comprising the steps of configuring an access whitelist through a service management and control platform and synchronizing it to the network sidecar container; comprising:

[0089] The service management and control platform is equipped with an external data interface, through which R&D personnel configure the access whitelist within the service management and control platform.

[0090] In the above embodiment, developers configure the access whitelist in the service control platform through the external data interface and synchronize it to the network sidecar container.

[0091] The beneficial effects of the above technologies are: through the external data interface and service management and control platform, R&D personnel can configure the access whitelist, and by synchronizing the network sidecar container, the access whitelist in the network sidecar container can be updated in real time, thereby improving autonomy and management efficiency; and through precise control of the access whitelist, the network security of the container environment is improved, unauthorized access and attacks are avoided, and at the same time, the efficiency of traffic management is improved, and the utilization of network resources is optimized.

[0092] Example 3:

[0093] An embodiment of the present invention provides a network access control method based on a network sidecar container, comprising the following steps: when monitoring a network access request initiated by a business service container, if the network access request is detected to be a public network access, hijacking the public network access request to the network sidecar container based on firewall rules; including:

[0094] When monitoring the network access request initiated by the business service container, if it is detected that the network access request is for intranet access, the intranet access request is obtained;

[0095] Parse the intranet access request to obtain the source address information of the business service container, the IP address of the target intranet server, and the port protocol;

[0096] Based on the intranet access rules, it is determined whether the business service container has access rights. When it is determined that the business service container has access rights, a communication connection is established between the business service container and the target intranet server based on the port protocol.

[0097] In the above embodiment, when it is detected that the network access request initiated by the business service container is an intranet access request, the intranet access request is parsed, and it is determined based on the intranet access rules whether the business service container has intranet access rights. When it is determined that the business service container has access rights, a communication connection is established between the business service container and the target intranet server based on the port protocol.

[0098] The beneficial effect of the above technology is that: when it is detected that the network access request initiated by the business service container is an intranet access request, based on the intranet access rules, it is possible to determine whether the business service container has intranet access rights. If the business service container has access rights, it is possible to communicate with the target intranet server by parsing the obtained port protocol, thereby realizing data transmission between the business service container and the target intranet server.

[0099] Example 4:

[0100] An embodiment of the present invention provides a network access control method based on a network sidecar container, comprising the following steps: when monitoring a network access request initiated by a business service container, if the network access request is detected to be a public network access, hijacking the public network access request to the network sidecar container based on firewall rules; including:

[0101] Parse the public network access request to obtain the source address information, service port number, and target public network server address of the business service container;

[0102] Based on firewall rules, the target public server address in the public network access request is changed to the network sidecar container address, hijacking the public network access request to the network sidecar container. Optional options include:

[0103] Execute iptables commands based on firewall rules;

[0104] {iptables-t nat-p datarules-r output-d Network Sidecar Address-jACCEPT}

[0105] Among them, iptables is the command prompt, -t nat is the network address translation identifier, -p datarules changes the original data transmission rules, -r output replaces the original data output rules, -d Network Sidecar Address changes the target address of data transmission to the network sidecar container address, and -j ACCEPT uses the changed rules to transmit data.

[0106] In the above embodiment, when a network access request is detected by the business service container, the target public network server address information in the public network access request is changed to the network sidecar container address information based on the firewall rules, thereby hijacking the public network access request.

[0107] In the above embodiment, the firewall rules can be implemented as iptables commands. By setting the network address translation identifier, the original data transmission rules are changed, the target public network server address information is changed to the network sidecar container address information, and the changed rules are continued to be used to transmit data, thereby realizing the hijacking of public network access requests.

[0108] The beneficial effect of the above technology is that when the network access request initiated by the business service container is a public network access request, the public network access request is hijacked to the public network server based on the firewall rules, which facilitates the network sidecar container to perform access whitelist verification on the initiated public network access request.

[0109] Example 5:

[0110] An embodiment of the present invention provides a network access control method based on a network sidecar container, comprising the following steps: extracting corresponding server verification information from server association information according to the protocol type, querying an access whitelist based on the server verification information, and establishing a communication connection with a public network server for data transmission based on a public network access request when the access whitelist contains the server verification information; the method comprises:

[0111] When the protocol type in the public network access request is Hypertext Transfer Protocol Security, obtain the domain name information in the server association information, query based on the domain name whitelist information in the access whitelist, and when the domain name information is found in the queried domain name whitelist information, establish a communication connection with the public network server for data transmission according to the public network access request;

[0112] When the protocol type in the public network access request is Hypertext Transfer Protocol, obtain the request header domain name information in the server association information, query based on the domain name whitelist information in the access whitelist, and when the queried domain name whitelist information contains the request header domain name information, establish a communication connection with the public network server for data transmission according to the public network access request;

[0113] When the protocol type in the public network access request is Transmission Control Protocol or User Datagram Protocol, obtain the target server IP address information in the server association information, perform a query based on the IP whitelist information in the access whitelist, and if the queried IP whitelist information contains the target server IP address information, establish a communication connection with the public network server according to the public network access request to transmit data;

[0114] Server verification information, including domain name information, request header domain name information, and target server IP address information.

[0115] In the above embodiment, when the protocol type in the public network access request is the Hypertext Transfer Protocol Secure (HTTPS protocol), the domain name information (Server Name Indication, SNI) in the server association information is extracted, and the domain name information is queried based on the domain name whitelist information in the access whitelist. When the domain name whitelist information is found to contain the domain name information, a communication connection is established between the network sidecar container and the public network server.

[0116] In the above embodiment, when the protocol type in the public network access request is the Hypertext Transfer Protocol (http protocol), the request header domain name information in the server association information is obtained, that is, the request domain name host of the request header head in the server association information is obtained as the request header domain name information, and a query is performed based on the domain name whitelist information in the access whitelist. When the domain name whitelist information is found to contain the request header domain name information, a communication connection is established between the network sidecar container and the public network server.

[0117] In the above embodiments, when the protocol type in the public network access request is Transmission Control Protocol (TCP) or User Datagram Protocol (UDP), the target server IP address information in the server association information is obtained, and a query is performed based on the IP whitelist information in the access whitelist. When the IP whitelist information is found to contain the target server IP address information, a communication connection with the public network server is established for data transmission.

[0118] In the above embodiment, the access whitelist includes domain name whitelist information and IP whitelist information.

[0119] In the above embodiment, the server verification information includes domain name information, request header domain name information and target server IP address information.

[0120] In the above embodiments, R&D personnel and business personnel can expand the protocol type of the network sidecar container through the service management and control platform to enable it to meet the public network service request verification of multiple transmission protocols.

[0121] The beneficial effect of the above technology is that: through the above technical solution, access whitelist query based on server verification information of multiple protocols such as https, http, TCP, and UDP is realized. While realizing the verification of public network service requests, it can meet the different business needs of business service containers, thereby improving the applicability and flexibility of the method.

[0122] Example 6:

[0123] An embodiment of the present invention provides a network access control method based on a network sidecar container, comprising the steps of: extracting corresponding server verification information from server association information according to a protocol type, querying an access whitelist based on the server verification information, and establishing a communication connection with a public network server for data transmission according to a public network access request when the access whitelist contains the server verification information; and further comprising:

[0124] When it is found that the access whitelist does not contain the server verification information, the communication connection between the network sidecar container and the public network server is prohibited according to the public network access request, and a prohibited access prompt message is returned to the business service container.

[0125] In the above embodiment, when the network sidecar container finds that the whitelist does not contain the server verification information, it prohibits establishing a communication connection with the public network server and returns a prohibited access prompt message to the business service container.

[0126] In the above embodiment, the access prohibition prompt information can be implemented as "prohibiting access to the public network, and only allowing access to addresses in the whitelist."

[0127] The beneficial effect of the above technology is that when the access whitelist does not contain server verification information, data transmission to the public network server is prohibited, avoiding the business service container from establishing a communication connection with the public network server that is not in the access whitelist, and improving the security of intranet data.

[0128] Example 7:

[0129] An embodiment of the present invention provides a network access control method based on a network sidecar container, comprising the steps of: extracting corresponding server verification information from server association information according to a protocol type, querying an access whitelist based on the server verification information, and establishing a communication connection with a public network server for data transmission according to a public network access request when the access whitelist contains the server verification information; and further comprising:

[0130] Monitor and parse public network access requests that successfully establish a communication connection with a public network server to obtain the IP address of the public network server with which the communication connection is established;

[0131] Count the access frequency of the network sidecar container to the public network server IP address. When the access frequency reaches the preset high access frequency, set the public network server corresponding to the public network server IP address as a verification-free server.

[0132] The network sidecar container maps the business IP address and business port number of the business service container to the IP address and public port number of the verification-free server; when the public server in the public network access request initiated by the business service container is a verification-free server, the network sidecar container does not hijack the public network access request, and the business service container directly establishes a communication connection with the public network server.

[0133] In the above embodiment, the public network server IP address of the public network server that successfully establishes a communication connection with the network sidecar container is obtained, and the access frequency to the public network server IP address is counted. When the access frequency reaches the preset high access frequency, the public network server corresponding to the public network server IP address is set as a verification-free server, and a mapping relationship between the business service container and the verification-free server is established.

[0134] In the above embodiment, when the public network server in the public network access request initiated by the business service container is an authentication-free server, the network sidecar container does not hijack the public network access request, and the business service container directly establishes a communication connection with the public network server.

[0135] The beneficial effect of the above technology is that: when the access frequency of the network sidecar container to the public network server reaches the preset high access frequency, it is set as a verification-free server, and a mapping relationship between the business service container and the verification-free server is established, thereby realizing a direct communication connection between the business service container and the public network server with a high access frequency, avoiding the network sidecar container from hijacking the public network access requests of the public network server with a high access frequency, affecting the data access rate of the business service container.

[0136] Example 8:

[0137] An embodiment of the present invention provides a network access control method based on a network sidecar container, comprising the steps of: extracting corresponding server verification information from server association information according to a protocol type, querying an access whitelist based on the server verification information, and establishing a communication connection with a public network server for data transmission according to a public network access request when the access whitelist contains the server verification information; and further comprising:

[0138] Obtain the communication link established between the network sidecar container and the public network server, and monitor the real-time data transmission volume of each communication sub-link;

[0139] Get the data to be transmitted that has not yet been transmitted in the network sidecar container and has established a communication connection with the public network server;

[0140] Based on the link utilization of each communication sub-link, intelligently allocate communication sub-links for data transmission. Optional features include:

[0141] Obtain the real-time transmission data volume and link resource occupancy of the communication sub-link, perform normalization processing and analysis, and obtain the comprehensive evaluation value of the communication sub-link;

[0142] According to the comprehensive evaluation value of each communication sub-link, for the data to be transmitted with a high priority, a communication sub-link is selected to transmit the data.

[0143] In the above embodiments, by monitoring the communication link between the network sidecar container and the public network server, the real-time data transmission volume is obtained. Then, through the network sidecar container, effective monitoring of network data traffic between the intranet and the extranet and transparent forwarding of data information are achieved to ensure that legitimate business is not affected.

[0144] In the above embodiment, the link utilization of each communication sub-link is obtained based on the real-time data transmission volume of each communication sub-link between the network sidecar container and the public network server, and the communication sub-link is intelligently allocated for data transmission for the data to be transmitted.

[0145] In the above embodiments, the real-time transmission data volume and link resource occupancy of each communication sub-link are normalized and analyzed to obtain a comprehensive evaluation value of the communication sub-link, and a communication sub-link is selected to transmit the data to be transmitted based on the priority of the data to be transmitted.

[0146] The beneficial effects of the above technology are: through the communication link between the network sidecar container and the public network server, traffic monitoring of real-time data transmission between the intranet and the extranet is realized, and based on the link utilization rate of each communication sub-link, the function of intelligently allocating communication sub-links for data transmission of the data to be transmitted is realized, thereby avoiding the problem of transmitting data to be transmitted to the communication sub-link with blocked data transmission, resulting in slower data transmission, and at the same time improving the data transmission rate between the network sidecar container and the public network server.

[0147] Example 9:

[0148] An embodiment of the present invention provides a network access control method based on a network sidecar container, comprising the steps of obtaining the real-time transmission data volume and link resource occupancy of a communication sub-link, performing normalization processing and analysis, and obtaining a comprehensive evaluation value of the communication sub-link; and comprising:

[0149] Calculate a comprehensive evaluation value based on the standard remaining bandwidth, standard transmission delay, standard packet loss rate of the communication sub-link, and the standard flow table bandwidth of the switch in link transmission;

[0150] L i =ω1bw si +ω2dl si +ω3r si +ε·SW si

[0151] Among them, L i is the comprehensive evaluation value of the ith communication sub-link, bw si is the normalized standard residual bandwidth of the ith communication sub-link, ω1 is the bandwidth weight corresponding to the standard residual bandwidth, and dl si is the normalized standard transmission delay of the ith communication sub-link, ω2 is the delay weight corresponding to the standard transmission delay, r si is the normalized standard packet loss rate of the ith communication sub-link, ω3 is the packet loss rate weight corresponding to the standard packet loss rate, ε is a constant, SW si is the standard flow table bandwidth of the switch in the i-th communication sub-link;

[0152]

[0153] Among them, bw i is the remaining bandwidth of the i-th communication sub-link, is the total bandwidth of the i-th communication sub-link, SD i (t) is the amount of data sent by the i-th communication sub-link at time t, SD i (t+Δt) is the amount of data sent after the interval Δt;

[0154]

[0155] Among them, bw min is the minimum bandwidth among all communication sub-links;

[0156] The network sidecar container sends the first latency test information with the container timestamp to the public network server to obtain the container sending time and server reception time

[0157] The public network server sends the second latency test information with the server timestamp to the network sidecar container to obtain the server sending time and container receipt time

[0158]

[0159] Among them, dl A The total delay of data information transmission between the network sidecar container and the public network server through the i-th communication sub-link, dl i The transmission delay of the i-th communication sub-link;

[0160]

[0161] Among them, dl max is the maximum transmission delay in all communication sub-links;

[0162] Get the number of data packets SX sent by the network sidecar container to the public network server through the i-th communication sub-link at time t i (t), measure again after the interval Δt, and obtain the number of data packets sent at time t+Δt SX i (t+Δt);

[0163] Get the number of data packets RX received by the public network server through the i-th communication sub-link at time t i (t), measure again after the interval Δt, and obtain the number of data packets RX received at time t+Δt i (t+Δt);

[0164]

[0165] Among them, r i is the packet loss rate of the i-th communication sub-link;

[0166]

[0167] Among them, r max is the maximum packet loss rate in all communication sub-links;

[0168] Get the flow table bandwidth of the switch in the i-th communication sub-link;

[0169]

[0170] in, is the bandwidth occupied by the switch transmitting data information in the i-th communication sub-link, is the bandwidth of the jth sub-data in the data information transmitted by the switch in the i-th communication sub-link. The currently transmitted data information contains a total of m sub-data. c_byte is the number of bytes of the jth sub-data. t_duration j The duration of transmitting the jth sub-data;

[0171]

[0172] Among them, SW i is the flow table bandwidth of the switch in the i-th communication sub-link, SW max is the maximum flow table bandwidth of the switches in all communication sub-links, SW si is the standard flow table bandwidth of the switch in the i-th communication sub-link.

[0173] In the above embodiment, the comprehensive evaluation value is calculated based on the standard remaining bandwidth, standard transmission delay, standard packet loss rate of the communication sub-link and the standard flow table bandwidth of the switch in link transmission.

[0174] In the above embodiment, the remaining bandwidth of the communication sub-link is calculated by combining the amount of data sent at time t and the amount of data sent within the interval Δt on the communication sub-link to calculate the data occupied bandwidth of the current communication sub-link, and the remaining bandwidth is calculated using the total bandwidth of the communication sub-link. Normalization is performed based on the minimum bandwidth of all communication sub-links to calculate the standard remaining bandwidth of the communication sub-link.

[0175] In the above embodiments, the transmission delay of the communication sub-link is calculated by sending the first delay test information with the container timestamp to the public network server through the network sidecar container, and the public network server sends the second delay test information with the server timestamp to the network sidecar container, obtaining the container sending time, server receiving time, server sending time and container receiving time, and calculating it through the total delay of data information transmission; normalization is performed based on the maximum transmission delay in all communication sub-links to calculate the standard transmission delay of the communication sub-link.

[0176] In the above embodiment, the packet loss rate of the communication sub-link is calculated by the number of data packets sent by the network sidecar container at time t, the number of data packets sent at time t+Δt, the number of data packets received by the public network server at time t, and the number of data packets received at time t+Δt. The packet loss rate of the communication sub-link is normalized based on the maximum packet loss rate of all communication sub-links to calculate the standard packet loss rate of the communication sub-link.

[0177] In the above embodiments, the flow table bandwidth of the switch in the communication sub-link is calculated by calculating the occupied bandwidth by the number of bytes of data information transmitted by the switch in the communication sub-link, and then calculating the flow table bandwidth of the switch; normalization is performed based on the maximum flow table bandwidth of the switches in all communication sub-links to calculate the standard flow table bandwidth of the switches in the communication sub-link.

[0178] The beneficial effects of the above technology are: by setting the corresponding weights of the standard remaining bandwidth, standard transmission delay, and standard packet loss rate of the communication sub-link, the utilization rate of the communication sub-link is evaluated, and based on the usage analysis of the flow table bandwidth of the switch in the communication sub-link, the comprehensive evaluation value of the communication sub-link is obtained, which facilitates the intelligent selection of the communication sub-link for data transmission in the subsequent steps.

[0179] In summary, the network access control method based on network sidecar containers proposed in this paper achieves the advantages of precise control, real-time updates, multi-protocol support, autonomous configuration, and security for container-based networks through precise public network whitelist management and control, real-time whitelist update mechanisms, and multi-protocol support. These advantages help improve the security and management efficiency of container environments, providing a more reliable and efficient network management solution for container services.

[0180] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A network access control method based on a network sidecar container, characterized in that: include: Deploy business service containers and network sidecar containers in the container unit; Configure the access whitelist through the service management and control platform and synchronize it to the network sidecar container; When monitoring the network access request initiated by the business service container, when it is detected that the network access request is a public network access, the public network access request is hijacked to the network sidecar container based on the firewall rule; Parsing the public network access request through the network sidecar container to obtain the protocol type and server association information in the public network access request; Corresponding server verification information is extracted from the server association information according to the protocol type, and a query is performed in the access whitelist according to the server verification information. When the access whitelist is found to contain the server verification information, a communication connection is established with the public network server for data transmission according to the public network access request.

2. According to claim 1, a network access control method based on a network sidecar container is characterized in that: The step of configuring an access whitelist through a service management and control platform and synchronizing it to the network sidecar container includes: The service control platform is provided with an external data interface, and the R&D personnel configure the access whitelist in the service control platform through the external data interface.

3. According to claim 1, a network access control method based on a network sidecar container is characterized in that: The step of: when monitoring the network access request initiated by the business service container, when monitoring that the network access request is a public network access, hijacking the public network access request to the network sidecar container based on the firewall rule; includes: When monitoring the network access request initiated by the business service container, when it is detected that the network access request is an intranet access, obtaining the intranet access request; Parse the intranet access request to obtain the source address information of the business service container, the target intranet server IP address and the port protocol; Based on the intranet access rule, it is determined whether the business service container has access rights, and when it is determined that the business service container has access rights, a communication connection between the business service container and the target intranet server is established based on the port protocol.

4. According to claim 1, a network access control method based on a network sidecar container is characterized in that: The step of: when monitoring the network access request initiated by the business service container, when monitoring that the network access request is a public network access, hijacking the public network access request to the network sidecar container based on the firewall rule; includes: Parse the public network access request to obtain the source address information, service port number and target public network server address information of the business service container; Based on the firewall rules, the target public network server address information in the public network access request is changed to the network sidecar container address information, and the public network access request is hijacked to the network sidecar container; optionally, including: Execute iptables commands based on firewall rules; {iptables-t nat-p datarules-r output-d Network Sidecar Address-j ACCEPT} Among them, iptables is the command prompt, -t nat is the network address translation identifier, -p datarules changes the original data transmission rules, -r output replaces the original data output rules, -d Network Sidecar Address changes the target address of data transmission to the network sidecar container address, and -j ACCEPT uses the changed rules to transmit data.

5. According to a network access control method based on a network sidecar container according to claim 1, it is characterized in that: The step of extracting corresponding server verification information from the server association information according to the protocol type, querying the access whitelist according to the server verification information, and establishing a communication connection with the public network server for data transmission according to the public network access request when the access whitelist contains the server verification information; comprising: When the protocol type in the public network access request is Hypertext Transfer Protocol Security, obtaining the domain name information in the server association information, querying based on the domain name whitelist information in the access whitelist, and when it is found that the domain name whitelist information contains the domain name information, establishing a communication connection with the public network server for data transmission according to the public network access request; When the protocol type in the public network access request is Hypertext Transfer Protocol, obtaining the request header domain name information in the server association information, querying based on the domain name whitelist information in the access whitelist, and when it is found that the domain name whitelist information contains the request header domain name information, establishing a communication connection with the public network server for data transmission according to the public network access request; When the protocol type in the public network access request is the transmission control protocol or the user datagram protocol, obtaining the target server IP address information in the server association information, querying based on the IP whitelist information in the access whitelist, and when it is found that the IP whitelist information contains the target server IP address information, establishing a communication connection with the public network server for data transmission according to the public network access request; The server verification information includes domain name information, request header domain name information and target server IP address information.

6. According to a network access control method based on a network sidecar container according to claim 1, it is characterized in that: The step of extracting corresponding server verification information from the server association information according to the protocol type, and querying the access whitelist according to the server verification information, and when the access whitelist contains the server verification information, establishing a communication connection with the public network server for data transmission according to the public network access request; and further comprising: When it is found that the server verification information is not included in the access whitelist, the communication connection between the network sidecar container and the public network server is prohibited according to the public network access request, and access prohibition prompt information is returned to the business service container.

7. A network access control method based on a network sidecar container according to claim 1, characterized in that: The step of extracting corresponding server verification information from the server association information according to the protocol type, and querying the access whitelist according to the server verification information, and when the access whitelist contains the server verification information, establishing a communication connection with the public network server for data transmission according to the public network access request; and further comprising: Monitor and parse the public network access request that successfully establishes a communication connection with the public network server, and obtain the IP address of the public network server that establishes the communication connection; Counting the access frequency of the network sidecar container to the public network server IP address, and when the access frequency reaches a preset high access frequency, setting the public network server corresponding to the public network server IP address as a verification-free server; The network sidecar container maps the IP address and public port number of the verification-free server according to the business IP address and business port number of the business service container; when the public network server in the public network access request initiated by the business service container is a verification-free server, the network sidecar container does not hijack the public network access request, and the business service container directly establishes a communication connection with the public network server.

8. A network access control method based on a network sidecar container according to claim 1, characterized in that: The step of extracting corresponding server verification information from the server association information according to the protocol type, and querying the access whitelist according to the server verification information, and when the access whitelist contains the server verification information, establishing a communication connection with the public network server for data transmission according to the public network access request; and further comprising: Obtain the communication link established between the network sidecar container and the public network server, and monitor the real-time data transmission volume of each communication sub-link; Obtaining data to be transmitted in the network sidecar container that has established a communication connection with the public network server but has not been transmitted; According to the link utilization rate of each communication sub-link, intelligently assign the communication sub-links to the data to be transmitted for data transmission; optionally, including: Obtaining the real-time transmission data volume and link resource occupancy of the communication sub-link, and performing normalization processing and analysis to obtain a comprehensive evaluation value of the communication sub-link; According to the comprehensive evaluation value of each communication sub-link, for the data to be transmitted with a high priority, the communication sub-link is selected to perform data transmission on the data to be transmitted.

9. A network access control method based on a network sidecar container according to claim 8, characterized in that: The step of obtaining the real-time transmission data volume and link resource occupancy of the communication sub-link, performing normalization processing and analysis, and obtaining a comprehensive evaluation value of the communication sub-link includes: Calculate a comprehensive evaluation value according to the standard remaining bandwidth, standard transmission delay, standard packet loss rate of the communication sub-link and the standard flow table bandwidth of the switch in link transmission; L i =ω1bw si +ω2dl si +ω3r si +ε·SW si Among them, L i is the comprehensive evaluation value of the ith communication sub-link, bw si is the normalized standard residual bandwidth of the ith communication sub-link, ω1 is the bandwidth weight corresponding to the standard residual bandwidth, and dl si is the normalized standard transmission delay of the ith communication sub-link, ω2 is the delay weight corresponding to the standard transmission delay, r si is the normalized standard packet loss rate of the ith communication sub-link, ω3 is the packet loss rate weight corresponding to the standard packet loss rate, ε is a constant, SW si is the standard flow table bandwidth of the switch in the i-th communication sub-link; Among them, bw i is the remaining bandwidth of the ith communication sub-link, is the total bandwidth of the ith communication sub-link, SD i (t) is the amount of data sent by the i-th communication sub-link at time t, SD i (t+Δt) is the amount of data sent after the interval Δt; Among them, bw min is the minimum bandwidth among all communication sub-links; The network sidecar container sends the first latency test information with the container timestamp to the public network server to obtain the container sending time and server receiving time The public network server sends the second delay test information with the server timestamp to the network sidecar container to obtain the server sending time and container receiving time Among them, dl A The total delay of data information transmission between the network sidecar container and the public network server through the i-th communication sub-link, dl i The transmission delay of the ith communication sub-link; Among them, dl max is the maximum transmission delay in all communication sub-links; Get the number of data packets SX sent by the network sidecar container to the public network server through the i-th communication sub-link at time t i (t), measure again after an interval of Δt to obtain the number of packets SX sent at time t+Δt i (t+Δt); Get the number of data packets RX received by the public network server through the i-th communication sub-link at time t i (t), measure again after an interval of Δt to obtain the number of packets RX received at time t+Δt i (t+Δt); Among them, r i is the packet loss rate of the ith communication sub-link; Among them, r max is the maximum packet loss rate in all communication sub-links; Get the flow table bandwidth of the switch in the i-th communication sub-link; in, is the bandwidth occupied by the switch in the i-th communication sub-link to transmit data information, is the bandwidth of the jth sub-data in the data information transmitted by the switch in the i-th communication sub-link. The currently transmitted data information contains a total of m sub-data. c_byte is the number of bytes of the jth sub-data. t_duration j The duration of transmitting the j-th sub-data; Among them, SW i is the flow table bandwidth of the switch in the i-th communication sub-link, SW max is the maximum flow table bandwidth of the switches in all communication sub-links, SW si is the standard flow table bandwidth of the switch in the i-th communication sub-link.

Images