Container cloud access control method and device based on eBPF

Abstract

The invention relates to the technical field of cloud computing, and provides an eBPF-based container cloud access control method and device, and the method comprises the steps: intercepting an access request of an access subject through an eBPF; identifying a subject identifier of the access subject and an object identifier of an accessed object based on the access request; based on the subject identifier and the object identifier, determining a subject metric value and an object metric value representing credibility, and determining an access control strategy between the access subject and the accessed object, and when the subject metric value is equal to a subject reference value and the object metric value is equal to an object reference value, determining that the access subject and the accessed object are accessed. And determining to execute the access request under the condition that the access subject receives the access request and the access request satisfies an access control strategy between the access subject and the accessed object. According to the method, the security of the container cloud is ensured from two aspects of confidentiality and integrity through the steps.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to an eBPF-based container cloud access control method and device. Background Art

[0002] At present, in the container cloud system, the access between the subject and the object is implemented by Selinux and AppArmor based on the LSM (Linux Security Modules) framework, which are two mandatory access controls. Specifically, the access to the object resources (object resources are instantiations of system resources) is controlled by setting arbitration functions in the source code of kernel resource access. These resources include files, inode nodes, processes, network sockets, etc. However, Selinux and AppArmor are mainly used to control the access rights of processes to system resources to enhance the confidentiality of the container cloud system, that is, they mainly focus on access control, but lack integrity verification during the access process, which may lead to the risk of being attacked by using unknown or tampered applications / software and files.

[0003] The terms used in the present invention are explained as follows: Container cloud: cloud resources based on containers. The typical implementation technology of containers is Docker. A container instance is a process. The application running in the container instance is a subprocess of the container instance process. The container instance relies on the container image.

[0004] Subject and object: Subject and object. Subject usually refers to the entity that can initiate an operation, such as a user, process, thread, or system service. In an operating system, subjects usually refer to programs or users that can perform actions; objects are the objects of subject operations, which can be files, directories, network resources, database records, etc. Objects are passive, containing data or resources, waiting to be accessed by subjects. Summary of the invention

[0005] The present invention provides an eBPF-based container cloud access control method and device to solve the technical problem of lack of integrity verification when accessing the host and object in the container cloud system in the prior art.

[0006] The present invention provides a container cloud access control method based on eBPF, comprising the following steps.

[0007] The access request of the access subject is intercepted through eBPF.

[0008] The subject identifier of the access subject and the object identifier of the accessed object are identified based on the access request.

[0009] Based on the subject identifier and the object identifier, determine the subject measurement value and the object measurement value that characterize the credibility, and determine the access control policy between the access subject and the accessed object. When the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object, determine to execute the access request.

[0010] The subject reference value and the object reference value are initial values ​​obtained by performing credibility measurement on each access subject and each accessed object in the container cloud when the container cloud is created and started.

[0011] According to a container cloud access control method based on eBPF provided by the present invention, an access request of an access subject is intercepted through eBPF, including: intercepting the access request of the access subject through a hook function of eBPF, wherein the hook function is used to monitor the system call behavior corresponding to the subject's access request to intercept the access request.

[0012] According to a container cloud access control method based on eBPF provided by the present invention, based on the subject identifier and the object identifier, a subject measurement value and an object measurement value representing the credibility are determined, including: based on the subject identifier, the object identifier and the trusted software protocol stack preset in the eBPF, calling a trusted platform module to perform credibility measurement on the access subject and the accessed object to obtain the subject measurement value and the object measurement value.

[0013] According to a container cloud access control method based on eBPF provided by the present invention, based on the subject identifier and the object identifier, a subject measurement value and an object measurement value representing the credibility are determined, and an access control policy between the access subject and the accessed object is determined. When the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object, it is determined to execute the access request, including the following modules.

[0014] Based on the subject identifier and the object identifier, a subject measurement value and an object measurement value representing the credibility are determined.

[0015] The subject measurement value is compared with the subject reference value, and the object measurement value is compared with the object reference value.

[0016] When the subject measurement value is equal to the subject reference value, and the object measurement value is equal to the object reference value, an access control policy between the access subject and the accessed object is obtained based on the subject identifier and the object identifier.

[0017] If the access request satisfies the access control policy, it is determined to execute the access request.

[0018] According to a container cloud access control method based on eBPF provided by the present invention, based on the subject identifier and the object identifier, a subject measurement value and an object measurement value representing the credibility are determined, and an access control policy between the access subject and the accessed object is determined. When the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object, it is determined to execute the access request, including the following modules.

[0019] Based on the subject identifier and the object identifier, an access control policy between the access subject and the accessed object is obtained.

[0020] In the case that the access request satisfies the access control policy, a subject measurement value and an object measurement value representing the credibility are determined based on the subject identifier and the object identifier.

[0021] The subject measurement value is compared with the subject reference value, and the object measurement value is compared with the object reference value.

[0022] When the subject metric value is equal to the subject reference value, and the object metric value is equal to the object reference value, it is determined to execute the access request.

[0023] According to a container cloud access control method based on eBPF provided by the present invention, before determining the subject measurement value and the object measurement value, and determining the access control policy, it also includes: authenticating the access subject based on the subject identifier, and refusing to execute the access request if the identity authentication fails.

[0024] The present invention also provides a container cloud access control device based on eBPF, comprising the following modules.

[0025] The access request interception module is used to intercept the access request of the access subject through eBPF.

[0026] The subject-object identification module is used to identify the subject identification of the access subject and the object identification of the accessed object based on the access request.

[0027] An execution determination module is used to determine the subject measurement value and the object measurement value representing the credibility based on the subject identifier and the object identifier, and determine the access control policy between the access subject and the accessed object, and determine to execute the access request when the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object.

[0028] The subject reference value and the object reference value are initial values ​​obtained by performing credibility measurement on each access subject and each accessed object in the container cloud when the container cloud is created and started.

[0029] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the program, the eBPF-based container cloud access control method as described above is implemented.

[0030] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the eBPF-based container cloud access control methods described above.

[0031] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the eBPF-based container cloud access control methods described above.

[0032] In the eBPF-based container cloud access control method and device provided by the present invention, since the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object, it is determined to execute the access request, otherwise the access request is rejected, that is, the security of the container cloud is guaranteed from the two aspects of confidentiality and integrity. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 This is one of the flow charts of the eBPF-based container cloud access control method provided by the present invention.

[0035] Figure 2 It is a schematic diagram of the implementation principle of the eBPF-based container cloud access control method provided by the present invention.

[0036] Figure 3 This is the second flow chart of the eBPF-based container cloud access control method provided by the present invention.

[0037] Figure 4This is the third flow chart of the eBPF-based container cloud access control method provided by the present invention.

[0038] Figure 5 It is a schematic diagram of the container cloud initialization process before intercepting the access request of the access subject in the eBPF-based container cloud access control method provided by the present invention.

[0039] Figure 6 It is a structural schematic diagram of the eBPF-based container cloud access control device provided by the present invention.

[0040] Figure 7 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] The container cloud access control method based on eBPF in an embodiment of the present invention is as follows: Figure 1 and Figure 2 As shown, the following steps S110 to S130 are included.

[0043] Step S110: The access request of the access subject is intercepted by the extended Berkeley Packet Filter (eBPF), and the access request includes the access behavior of the access subject (for example, read or write). Specifically, eBPF can intercept and monitor various system calls and behaviors of the container, such as: the container's access to the file system, including operations such as opening, reading, writing and closing files. For example: monitoring system calls such as sys_open, sys_read, sys_write and sys_close; monitoring communication behaviors between containers, including communication behaviors such as mutual access between containers and potential privilege escalation attacks.

[0044] Step S120: Identify the subject identifier of the access subject and the object identifier of the accessed object based on the access request. Specifically, the access request contains relevant information of the access subject and the accessed object, namely, the subject identifier and the object identifier. For example, if a process B in container A wants to access (read or write) a file D in container C, the access subject is process B, whose subject identifier is the process ID, and the accessed object is file D, whose object identifier is the file ID.

[0045] Step S130: Based on the subject identifier and the object identifier, determine the subject measurement value and the object measurement value representing the credibility, and determine the access control policy between the access subject and the accessed object, and determine to execute the access request when the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object. The subject reference value and the object reference value are the initial values ​​obtained by performing credibility measurement on each access subject and each accessed object in the container cloud when the container cloud is created and started.

[0046] On the one hand, determine the subject metric value and object metric value that characterize the credibility, that is, the essence of credibility metric is to calculate the hash value of the access subject and the accessed object respectively. The access subject and the accessed object can be located respectively through the subject identifier and the object identifier. For example: if the access subject is a process, the process itself is located through the process ID, and the metric value of the access subject is obtained by hashing the process itself. The accessed object is a file, and the file itself is located through the file ID, and the metric value of the accessed object is obtained by hashing the file itself. After calculating their respective metric values, they are compared with their respective benchmark values. If the comparison results are equal, it means that the access subject and the accessed object both meet the integrity requirements of the container cloud, avoiding the access subject and the accessed object from being tampered with during the operation of the container cloud, thereby avoiding the risk of being attacked by using the tampered subject and object. On the other hand, if the access request satisfies the access control policy between the access subject and the accessed object, it means that the access request meets the confidentiality requirements of the container cloud, thereby ensuring the security of the container cloud from both confidentiality and integrity.

[0047] It should be noted that: Reference Figure 2 , the access control policy can be set according to the security level of each container in the container cloud. When the container cloud is created, the security level of each container has been set. Different containers have different security levels. The higher the security level of the container, the higher the security level of the corresponding access subject and the accessed object. That is, the higher the security level of the container, the higher the security level of its image layer, configuration file, storage volume and log information. The access control policy between the access subject and the accessed object includes: the access subject with a high security level can only read the accessed object with a low security level, the accessed object with a low security level can only write to the access subject with a high security level, and the subject and object with the same security level can read and write to each other. The setting of this access control policy can prevent the leakage of sensitive information in the container cloud. For example: if the process of a container with a high security level wants to read files in a container with a low security level, it complies with the access control policy. If the process of a container with a high security level wants to write files in a container with a low security level, it does not comply with the access control policy.

[0048] In the eBPF-based container cloud access control method of this embodiment, since the subject measurement value is equal to the subject baseline value, the object measurement value is equal to the object baseline value, and the access request satisfies the access control policy between the access subject and the accessed object, it is determined to execute the access request, otherwise the access request is refused to execute, that is, the security of the container cloud is guaranteed from both confidentiality and integrity aspects.

[0049] In some embodiments, step S110 specifically includes: intercepting the access request of the access subject through the hook function of eBPF, wherein the hook function is used to monitor the system call behavior corresponding to the access request of the subject to intercept the access request. In this embodiment, the system call behavior corresponding to the access request of the subject can be monitored in real time through the hook function in eBPF to ensure the interception of the access request.

[0050] In some embodiments, in step S130, based on the subject identifier and the object identifier, a subject measurement value and an object measurement value representing the credibility are determined, including: based on the subject identifier, the object identifier and the trusted software protocol stack preset in the eBPF, calling a trusted platform module to perform credibility measurement on the access subject and the accessed object to obtain the subject measurement value and the object measurement value.

[0051] Specifically, the trusted platform module is a platform for credibility measurement that is independent of the container cloud. It can be a dedicated hardware encryption chip. The trusted software protocol stack is a protocol stack that complies with the calls of the hardware encryption chip. The ePBF transmits the subject identifier and the object identifier to the hardware encryption chip through the trusted software protocol stack. The hardware encryption chip queries the corresponding access subject and accessed object based on the subject identifier and the object identifier, thereby measuring the access subject and the accessed object to obtain the subject measurement value and the object measurement value.

[0052] In this embodiment, the trusted platform module is a platform for credibility measurement that is independent of the container cloud. In particular, when the trusted platform module is a hardware encryption chip, it itself has high security. By using it to measure the credibility of the access subject and the accessed object, the obtained subject measurement value and object measurement value have high reliability and accuracy.

[0053] In some embodiments, Figure 3 As shown, the step S130 specifically includes the following steps.

[0054] Step S310: Based on the subject identifier and the object identifier, determine the subject measurement value and the object measurement value that represent the credibility. Specifically, through the subject identifier, the object identifier and the trusted software protocol stack preset in the eBPF, call the trusted platform module to perform credibility measurement on the access subject and the accessed object, that is, calculate the hash value of the access subject and the accessed object through the trusted platform module, so as to obtain the subject measurement value and the object measurement value.

[0055] Step S320: Compare the subject measurement value with the subject reference value, and compare the object measurement value with the object reference value, that is, compare whether the subject measurement value is equal to the subject reference value, and compare whether the object measurement value is equal to the object reference value.

[0056] Step S330: Determine whether the subject measurement value is equal to the subject benchmark value, and whether the object measurement value is equal to the object benchmark value. If the subject measurement value is equal to the subject benchmark value, and the object measurement value is equal to the object benchmark value, execute step S340; otherwise, execute step S370.

[0057] Step S340: Based on the subject identifier and the object identifier, obtain the access control policy between the access subject and the accessed object, that is, when the subject measurement value is equal to the subject reference value and the object measurement value is equal to the object reference value, it means that the access subject and the accessed object have not been tampered with, the integrity requirements are met, and the confidentiality verification continues.

[0058] Step S350: Determine whether the access request satisfies the access control policy, if so, execute step S360, otherwise, execute step S370.

[0059] Step S360: determining to execute the access request, that is, determining to execute the access request when the access request satisfies the access control policy.

[0060] Step S370: refusing to execute the access request, that is, refusing to execute the access request if the access request does not satisfy the access control policy.

[0061] In this embodiment, integrity verification is performed first, and confidentiality verification is performed only when the subject measurement value is equal to the subject baseline value, and the object measurement value is equal to the object baseline value. That is, when the subject measurement value is not equal to the subject baseline value, or the object measurement value is not equal to the object baseline value, the access request is rejected and confidentiality verification is no longer performed, so as to avoid wasting computing resources in the container cloud.

[0062] In some embodiments, Figure 4 As shown, the step S130 specifically includes the following steps.

[0063] Step S410: Based on the subject identifier and the object identifier, an access control policy between the access subject and the accessed object is obtained.

[0064] Step S420: Determine whether the access request satisfies the access control policy. If the access request satisfies the access control policy, execute step S430; otherwise, execute step S470.

[0065] Step S430: Based on the subject identifier and the object identifier, determine the subject measurement value and the object measurement value representing the credibility. That is, if the access request satisfies the access control policy, it means that the access request meets the confidentiality requirement, so integrity verification continues.

[0066] Step S440: Compare the subject measurement value with the subject reference value, and compare the object measurement value with the object reference value.

[0067] Step S450: Determine whether the subject measurement value is equal to the subject benchmark value, and whether the object measurement value is equal to the object benchmark value. If the subject measurement value is equal to the subject benchmark value, and the object measurement value is equal to the object benchmark value, execute step S460; otherwise, execute step S470.

[0068] Step S460: Determine to execute the access request, that is, when the subject measurement value is equal to the subject reference value, and the object measurement value is equal to the object reference value, determine to execute the access request.

[0069] Step S470: refusing to execute the access request, that is, refusing to execute the access request when the subject measurement value is not equal to the subject reference value, or when the object measurement value is not equal to the object reference value.

[0070] In this embodiment, confidentiality verification is performed first, and integrity verification is performed only when the access request satisfies the access control policy. That is, when the access request does not satisfy the access control policy, the access request is rejected and integrity verification is no longer performed, thereby avoiding wasting computing resources in the container cloud and avoiding calling the trusted platform module for credibility measurement, further saving computing resources.

[0071] In some embodiments, before determining the subject measurement value and the object measurement value, and determining the access control policy, it also includes: authenticating the access subject based on the subject identifier, and refusing to execute the access request if the authentication fails. The authentication confirms whether the access subject is a legitimate subject registered in the container cloud, avoids illegal subjects from accessing the container cloud, and further improves the security of access to the container cloud.

[0072] In practical applications, in step S110, before the access request of the access subject is intercepted by eBPF, an initialization process is also included, as shown in detail. Figure 5 As shown, it includes: powering on the container cloud system; loading the trusted platform module; measuring the BIOS and BOOT Loader operating system (i.e., the operating system of the container cloud) through the trusted platform module; starting the operating system kernel; loading the eBPF program, which is the program that implements the method of the above embodiment; initializing the benchmark value (library), that is, calling the trusted platform module to perform the credibility measurement operation on each access subject and each accessed object in the container cloud to obtain the corresponding subject benchmark value and object benchmark value.

[0073] The eBPF-based container cloud access control device provided by the present invention is described below. The eBPF-based container cloud access control device described below and the eBPF-based container cloud access control method described above can refer to each other.

[0074] The container cloud access control device based on eBPF in the embodiment of the present invention is as follows: Figure 6 As shown, it includes the following modules.

[0075] The access request interception module 610 is used to intercept the access request of the access subject through eBPF.

[0076] The subject-object identification module 620 is used to identify the subject identifier of the access subject and the object identifier of the accessed object based on the access request.

[0077] An execution determination module 630 is used to determine the subject measurement value and the object measurement value representing the credibility based on the subject identifier and the object identifier, and determine the access control policy between the access subject and the accessed object, and determine to execute the access request when the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object.

[0078] The subject reference value and the object reference value are initial values ​​obtained by performing credibility measurement on each access subject and each accessed object in the container cloud when the container cloud is created and started.

[0079] In some embodiments, the access request interception module 610 is specifically used to intercept the access request of the access subject through the hook function of eBPF, and the hook function is used to monitor the system call behavior corresponding to the access request of the subject to intercept the access request.

[0080] In some embodiments, the execution determination module 630 is used to call the trusted platform module to perform credibility measurement on the access subject and the accessed object based on the subject identifier, object identifier and the trusted software protocol stack preset in the eBPF to obtain the subject measurement value and the object measurement value.

[0081] In some embodiments, the execution determination module 630 specifically includes the following modules.

[0082] The measurement value determination module is used to determine the subject measurement value and the object measurement value representing the credibility based on the subject identifier and the object identifier.

[0083] The measurement value comparison module is used to compare the subject measurement value with the subject reference value, and compare the object measurement value with the object reference value.

[0084] The access control policy acquisition module is used to acquire the access control policy between the access subject and the accessed object based on the subject identifier and the object identifier when the subject measurement value is equal to the subject reference value and the object measurement value is equal to the object reference value.

[0085] The access request determination execution module is used to determine the execution of the access request when the access request satisfies the access control policy.

[0086] In some embodiments, the execution determination module 630 specifically includes the following modules.

[0087] The access control policy acquisition module is used to acquire the access control policy between the access subject and the accessed object based on the subject identifier and the object identifier.

[0088] The metric value determination module is used to determine the subject metric value and the object metric value representing the credibility based on the subject identifier and the object identifier when the access request satisfies the access control policy.

[0089] The measurement value comparison module is used to compare the subject measurement value with the subject reference value, and compare the object measurement value with the object reference value.

[0090] The access request determination execution module is used to determine the execution of the access request when the subject measurement value is equal to the subject reference value and the object measurement value is equal to the object reference value.

[0091] In some embodiments, the eBPF-based container cloud access control device also includes: an identity authentication module, which is used to authenticate the access subject based on the subject identifier before determining the subject measurement value and the object measurement value, and determining the access control policy, and refuse to execute the access request if the identity authentication fails.

[0092] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7 As shown, the electronic device may include: a processor 710, a communications interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communications interface 720, and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the container cloud access control method based on eBPF, and the method includes the following steps.

[0093] The access request of the access subject is intercepted through eBPF.

[0094] The subject identifier of the access subject and the object identifier of the accessed object are identified based on the access request.

[0095] Based on the subject identifier and the object identifier, determine the subject measurement value and the object measurement value that characterize the credibility, and determine the access control policy between the access subject and the accessed object. When the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object, determine to execute the access request.

[0096] The subject reference value and the object reference value are initial values ​​obtained by performing credibility measurement on each access subject and each accessed object in the container cloud when the container cloud is created and started.

[0097] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0098] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the eBPF-based container cloud access control method provided by the above methods, and the method includes the following steps.

[0099] The access request of the access subject is intercepted through eBPF.

[0100] The subject identifier of the access subject and the object identifier of the accessed object are identified based on the access request.

[0101] Based on the subject identifier and the object identifier, determine the subject measurement value and the object measurement value that characterize the credibility, and determine the access control policy between the access subject and the accessed object. When the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object, determine to execute the access request.

[0102] The subject reference value and the object reference value are initial values ​​obtained by performing credibility measurement on each access subject and each accessed object in the container cloud when the container cloud is created and started.

[0103] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the eBPF-based container cloud access control method provided by the above methods is implemented, and the method includes the following steps.

[0104] The access request of the access subject is intercepted through eBPF.

[0105] The subject identifier of the access subject and the object identifier of the accessed object are identified based on the access request.

[0106] Based on the subject identifier and the object identifier, determine the subject measurement value and the object measurement value that characterize the credibility, and determine the access control policy between the access subject and the accessed object. When the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object, determine to execute the access request.

[0107] The subject reference value and the object reference value are initial values ​​obtained by performing credibility measurement on each access subject and each accessed object in the container cloud when the container cloud is created and started.

[0108] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0109] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0110] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A container cloud access control method based on eBPF, characterized in that: include: Intercept the access request of the access subject through eBPF; Identifying a subject identifier of the access subject and an object identifier of the accessed object based on the access request; Based on the subject identifier and the object identifier, determine the subject measurement value and the object measurement value representing the credibility, and determine the access control policy between the access subject and the accessed object, and when the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object, determine to execute the access request; The subject reference value and the object reference value are initial values ​​obtained by performing credibility measurement on each access subject and each accessed object in the container cloud when the container cloud is created and started.

2. The container cloud access control method based on eBPF according to claim 1 is characterized in that: Intercepting an access request of an access subject through eBPF includes: intercepting the access request of the access subject through a hook function of eBPF, wherein the hook function is used to monitor the system call behavior corresponding to the access request of the subject to intercept the access request.

3. The container cloud access control method based on eBPF according to claim 1 is characterized in that: Based on the subject identifier and the object identifier, determining a subject measurement value and an object measurement value representing credibility includes: Based on the subject identifier, object identifier and the trusted software protocol stack preset in the eBPF, the trusted platform module is called to perform credibility measurement on the access subject and the accessed object to obtain the subject measurement value and the object measurement value.

4. The container cloud access control method based on eBPF according to claim 1 is characterized in that: Based on the subject identifier and the object identifier, determining a subject measurement value and an object measurement value representing the credibility, and determining an access control policy between the access subject and the accessed object, and when the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object, determining to execute the access request, including: Based on the subject identifier and the object identifier, determining a subject measurement value and an object measurement value representing credibility; Comparing the subject measurement value with the subject reference value, and comparing the object measurement value with the object reference value; When the subject measurement value is equal to the subject reference value, and the object measurement value is equal to the object reference value, obtaining an access control policy between the access subject and the accessed object based on the subject identifier and the object identifier; If the access request satisfies the access control policy, it is determined to execute the access request.

5. The container cloud access control method based on eBPF according to claim 1 is characterized in that: Based on the subject identifier and the object identifier, determining a subject measurement value and an object measurement value representing the credibility, and determining an access control policy between the access subject and the accessed object, and when the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object, determining to execute the access request, including: Based on the subject identifier and the object identifier, obtaining an access control policy between the access subject and the accessed object; In the case where the access request satisfies the access control policy, determining a subject measurement value and an object measurement value representing credibility based on the subject identifier and the object identifier; Comparing the subject measurement value with the subject reference value, and comparing the object measurement value with the object reference value; When the subject metric value is equal to the subject reference value, and the object metric value is equal to the object reference value, it is determined to execute the access request.

6. The container cloud access control method based on eBPF according to any one of claims 1 to 5, characterized in that: Before determining the subject measurement value and the object measurement value, and determining the access control policy, the method further includes: authenticating the access subject based on the subject identifier, and refusing to execute the access request if the identity authentication fails.

7. A container cloud access control device based on eBPF, characterized in that: include: An access request interception module is used to intercept the access request of the access subject through eBPF; A subject-object identification module, used to identify the subject identification of the access subject and the object identification of the accessed object based on the access request; an execution determination module, configured to determine, based on the subject identifier and the object identifier, a subject measurement value and an object measurement value representing the credibility, and determine an access control policy between the access subject and the accessed object, and to determine to execute the access request when the subject measurement value is equal to the subject reference value, the object measurement value is equal to the object reference value, and the access request satisfies the access control policy between the access subject and the accessed object; The subject reference value and the object reference value are initial values ​​obtained by performing credibility measurement on each access subject and each accessed object in the container cloud when the container cloud is created and started.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the eBPF-based container cloud access control method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the eBPF-based container cloud access control method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the eBPF-based container cloud access control method according to any one of claims 1 to 6 is implemented.

Images