Mirror image deployment protection method and device, equipment and storage medium
By performing encrypted digest verification of the mirror in containerized deployment, the security risks caused by unchecked images in cloud-native scenarios are solved, and high security of mirror deployment is achieved.
Patent Information
- Application Number
- CN202411684859.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-22
- Publication Date
- 2025-03-14
AI Technical Summary
In cloud native scenarios, the containerized image deployed is not verified, which poses a major security risk.
By determining the candidate image and candidate image digest based on the current configuration file of the target containerized environment and encrypting these digests, a candidate encryption digest and a encryption digest to be verified are generated. Then, by comparing the target image name, the encryption digest to be verified and the candidate image storage file meets the image deployment conditions, if so, mirror deployment is performed.
It effectively improves the security of mirror deployment, prevents mirrors from being tampered with or illegally deployed, and enhances the security protection capabilities of the system.
Smart Images
Figure CN119621077A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present application relate to the field of computer technology, in particular to the field of distributed technology, and specifically to a protection method, apparatus, device and storage medium for mirror deployment. Background Art
[0002] With the continuous development and evolution of cloud platform technology, new security risks and challenges have been brought about in cloud-native scenarios. While developing cloud-native technology, it is necessary to simultaneously consider related security issues.
[0003] Currently, applications are deployed in a containerized manner after being put into the cloud. This deployment method requires the application to be made into an image, and then the image is pushed to the image warehouse. During deployment, the image is pulled from the image warehouse to the host machine and the image is run. Currently, no verification is performed on the image in this process, which poses a great security risk. Summary of the invention
[0004] The present application provides a method, apparatus, device and storage medium for protecting image deployment to improve the security of image deployment.
[0005] According to one aspect of the present application, a method for protecting image deployment is provided, the method comprising:
[0006] Determine candidate images and candidate image summaries based on current configuration files in the target containerized environment;
[0007] Encrypting the candidate image digest to obtain a candidate encrypted digest, and determining and saving a candidate image storage file according to the candidate image name of the candidate image and the candidate encrypted digest;
[0008] When an image deployment instruction is identified, a target image name of the image to be deployed and an image digest to be verified are determined, and the image digest to be verified is encrypted to obtain an encrypted digest to be verified;
[0009] If the target image name, the encrypted digest to be verified, and the candidate image storage file meet the image deployment conditions, the image to be deployed is deployed.
[0010] According to another aspect of the present application, a protection device for mirror deployment is provided, the device comprising:
[0011] An image determination module, used to determine a candidate image and a candidate image summary according to a current configuration file in a target containerized environment;
[0012] A file determination module, configured to encrypt the candidate image digest to obtain a candidate encrypted digest, and determine and save a candidate image storage file according to the candidate image name of the candidate image and the candidate encrypted digest;
[0013] A digest encryption module is used to determine the target image name of the image to be deployed and the image digest to be verified when an image deployment instruction is identified, and to encrypt the image digest to be verified to obtain an encrypted digest to be verified;
[0014] The image deployment module is used to deploy the image to be deployed if the target image name, the encrypted summary to be verified and the candidate image storage file meet the image deployment conditions.
[0015] According to another aspect of the present application, an electronic device is provided, the electronic device comprising:
[0016] one or more processors;
[0017] A memory for storing one or more programs;
[0018] When the one or more programs are executed by the one or more processors, the one or more processors implement any one of the image deployment protection methods provided in the embodiments of the present application.
[0019] According to another aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, any one of the image deployment protection methods provided in the embodiments of the present application is implemented.
[0020] The present application determines the candidate image and the candidate image digest according to the current configuration file in the target containerized environment; encrypts the candidate image digest to obtain the candidate encrypted digest, and determines and saves the candidate image storage file according to the candidate image name and the candidate encrypted digest of the candidate image; when the image deployment instruction is identified, determines the target image name and the image digest to be verified of the image to be deployed, and encrypts the image digest to be verified to obtain the encrypted digest to be verified; if the target image name, the encrypted digest to be verified and the candidate image storage file meet the image deployment conditions, the image to be deployed is deployed. The above technical solution uses the encrypted digest to verify the image during the deployment process, which can effectively improve the security of image deployment. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] Figure 1 It is a flowchart of a protection method for mirror deployment provided according to Embodiment 1 of the present application;
[0022] Figure 2 It is a flowchart of a protection method for mirror deployment provided according to Embodiment 2 of the present application;
[0023] Figure 3 It is a structural schematic diagram of a mirror-deployed protection device provided according to Embodiment 3 of the present application;
[0024] Figure 4 It is a structural diagram of an electronic device that implements the protection method of mirror deployment of an embodiment of the present application. DETAILED DESCRIPTION
[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.
[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0027] In addition, it should be noted that the collection, storage, use, processing, transmission, provision and disclosure of relevant data such as the current configuration file and candidate image summary involved in the technical solution of this application are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0028] Embodiment 1
[0029] Figure 1 This is a flowchart of a method for protecting image deployment according to the first embodiment of the present application. This embodiment is applicable to the case of performing anti-tampering verification on the image during the deployment process, which can be performed by a protection device for image deployment. The protection device for image deployment can be implemented in the form of hardware and / or software, and the protection device for image deployment can be configured in a computer device, such as a server. Figure 1 As shown, the method includes:
[0030] S110: Determine a candidate image and a candidate image summary according to a current configuration file in the target containerized environment.
[0031] The target containerized environment refers to the specific containerized platform or environment for image deployment. It is an environment that includes container operation and management and is used to run applications or services. The current configuration file refers to a file containing information such as system configuration, parameters, and image settings. In a containerized environment, this file can be a file that describes the deployment environment and is mainly used to specify the name, version, and other information of the image. A candidate image refers to a container image that can be selected as a target image during the deployment process. The candidate image digest refers to the hash value of the image content; it is a unique identifier generated based on the content of the image to ensure that the image maintains consistency and integrity at all times; the candidate image digest is an encrypted hash value of the candidate image content, which is used to verify whether the image has been tampered with.
[0032] Exemplarily, in the image making stage, a candidate image is made according to a current configuration file in the target containerized environment, and after the candidate image is made, a hash value of the candidate image is generated, and the hash value is used as a candidate image summary of the candidate image.
[0033] In an optional implementation, an embodiment of the present application can be applied to a protection system for image deployment, which system includes at least an image building device, a file server, an image warehouse cluster, an image deployment cluster and a management and control device; the image building device is respectively communicated with the file server and the image warehouse cluster; the management and control device is respectively communicated with the file server, the image warehouse cluster and the image deployment cluster.
[0034] Among them, the image building device refers to the device or system used to build container images; through this device, developers can package applications, services and their dependencies into container images, which will be used for deployment later. File server refers to a system that centrally stores files; in this system, image building devices and control devices can upload, download or manage files (such as image names, encrypted summaries, etc.). Image warehouse cluster refers to a distributed system composed of multiple image warehouses, which is used to store and manage container images; various versions of images are stored in the warehouse for image deployment clusters and other devices to call. Image deployment cluster refers to a cluster system composed of multiple computing nodes (servers), which is responsible for deploying and running applications or services in the image. Control device refers to the system responsible for managing and coordinating the entire image building, storage, and deployment process; it usually includes monitoring, configuration management, and task scheduling functions.
[0035] Optionally, during the image creation phase, the image building device determines the candidate image and the candidate image digest according to the current configuration file in the target containerized environment.
[0036] S120: Encrypt the candidate image digest to obtain a candidate encrypted digest, and determine and save the candidate image storage file according to the candidate image name and the candidate encrypted digest of the candidate image.
[0037] Among them, the candidate image name refers to the name of the container image to be selected for deployment, usually including the name and version number of the image; it identifies the specific version of the container image. The candidate encrypted digest refers to the summary information generated by applying an encryption algorithm to the candidate image digest, which is used to enhance data security, ensure the legitimacy of the image and prevent tampering. The candidate image storage file refers to a storage file containing the candidate image name and the candidate image encrypted digest; this file is usually saved to the file system or database for verification during deployment; it is used to confirm whether the image meets expectations and has not been tampered with.
[0038] Optionally, the candidate image digest is encrypted by the image building device to obtain a candidate encrypted digest, and a candidate image storage file is determined according to the candidate image name and the candidate encrypted digest of the candidate image; the candidate image storage file is pushed to the file server, and the candidate image is pushed to the image warehouse cluster.
[0039] S130: When an image deployment instruction is identified, determine the target image name of the image to be deployed and the image digest to be verified, and encrypt the image digest to be verified to obtain the encrypted digest to be verified.
[0040] The target image name refers to the name of the image to be deployed, which specifies the image to be deployed in the containerized environment; the target image name usually includes the image name and tag or version number. The image digest to be verified refers to the summary value of the image to be deployed, which is usually the hash value of the image content; before the image is deployed, the image to be deployed needs to be verified to ensure that it has not been tampered with. The encrypted digest to be verified refers to the digest value generated after the image digest to be verified is encrypted; before the image is deployed, it is compared with the encrypted digest of the candidate image to verify the integrity of the image to be deployed.
[0041] Optionally, the image to be deployed is obtained from the image repository through the management and control device, and the target image name of the image to be deployed and the image digest to be verified are determined, and the image digest to be verified is encrypted to obtain the encrypted digest to be verified.
[0042] It should be noted that the encryption method for the candidate image digest and the image digest to be verified is preset. In actual use, the required encryption method can be dynamically set according to actual needs.
[0043] S140: If the target image name, the encrypted digest to be verified, and the candidate image storage file meet the image deployment conditions, the image to be deployed is deployed.
[0044] Among them, the image deployment conditions refer to a set of conditions for verifying the legitimacy, integrity and consistency of the image; in this case, the image deployment conditions include: the target image name must match the candidate image, the encrypted digest of the image to be verified is consistent with the digest in the candidate image storage file, and both meet the requirements for secure deployment.
[0045] Optionally, the control device determines whether the target image name, the encrypted digest to be verified, and the candidate image storage file meet the image deployment conditions; if they do, an image deployment request is issued to deploy the image to be deployed in the image deployment cluster; if not, the image deployment request is intercepted.
[0046] The embodiment of the present application determines the candidate image and the candidate image digest according to the current configuration file in the target containerized environment; encrypts the candidate image digest to obtain the candidate encrypted digest, and determines and saves the candidate image storage file according to the candidate image name and the candidate encrypted digest of the candidate image; when the image deployment instruction is identified, determines the target image name and the image digest to be verified of the image to be deployed, and encrypts the image digest to be verified to obtain the encrypted digest to be verified; if the target image name, the encrypted digest to be verified and the candidate image storage file meet the image deployment conditions, the image to be deployed is deployed. The above technical solution uses the encrypted digest to verify the image during the deployment process, which can effectively improve the security of image deployment.
[0047] Embodiment 2
[0048] Figure 2 It is a flowchart of a protection method for image deployment provided in accordance with the second embodiment of the present application. Based on the technical solutions of the above embodiments, this embodiment refines "if the target image name, the encrypted digest to be verified and the candidate image storage file meet the image deployment conditions, the image to be deployed is deployed" into "using the target image name as an index, determining the target encrypted digest from the candidate image storage file; if the encrypted digest to be verified and the target encrypted digest meet the image deployment conditions, the image to be deployed is deployed". It should be noted that for the parts not described in detail in the embodiments of the present application, please refer to the relevant statements of other embodiments.
[0049] like Figure 2 As shown, the method includes:
[0050] S210: Determine a candidate image and a candidate image summary according to a current configuration file in the target containerized environment.
[0051] S220: Encrypt the candidate image digest to obtain a candidate encrypted digest, and determine and save the candidate image storage file according to the candidate image name and the candidate encrypted digest of the candidate image.
[0052] Optionally, determining and saving the candidate image storage file according to the candidate image name and the candidate encryption digest of the candidate image may be to construct the candidate image storage file with the candidate image name as the candidate file name and the candidate encryption digest as the candidate file content; and saving the candidate image storage file to the file server.
[0053] The candidate file name refers to the name of the file using the candidate image name so as to store files related to the image in the file server. The candidate file content refers to the encrypted summary of the candidate image, which is stored as a file and used to verify the legitimacy and consistency of the image.
[0054] S230: When an image deployment instruction is identified, determine the target image name of the image to be deployed and the image digest to be verified, and encrypt the image digest to be verified to obtain the encrypted digest to be verified.
[0055] In an optional implementation, when the image deployment instruction is identified, the candidate image storage file is obtained from the file server, and the candidate image storage file is saved in the target database in the form of a character string.
[0056] Specifically, in the image deployment phase, the candidate image storage file is downloaded from the file server through the management and control device, and the file content of the candidate image storage file is read; the candidate image name and the candidate encryption summary are saved in the target database.
[0057] S240: Using the target image name as an index, determine the target encryption digest from the candidate image storage file.
[0058] Optionally, the target image name is used as an index by the management and control device to determine a target encryption digest corresponding to the target image name from a target database.
[0059] Furthermore, if the target image name cannot be queried from the target database, the deployment request is intercepted.
[0060] S250: If the encrypted digest to be verified and the target encrypted digest meet the image deployment conditions, the image to be deployed is deployed.
[0061] Optionally, a consistency check is performed on the encryption digest to be verified and the target encryption digest; if the consistency check passes, the image to be deployed is deployed.
[0062] Specifically, the encryption digest to be verified and the target encryption digest are checked for consistency through the control device; if the consistency check passes, an image deployment instruction is issued to deploy the image to be deployed in the image deployment cluster.
[0063] Furthermore, when the consistency check fails, the image deployment instruction is intercepted and the image deployment risk instruction is fed back to the user.
[0064] Among them, consistency check refers to the integrity verification and consistency check of the image file; this usually includes hash value verification of the image content, version consistency check, correctness of the file structure, etc.; by comparing the original encrypted hash value of the image and the current encrypted hash value, the system can verify whether the image is consistent with the expected version; if the verification fails, it means that the image may be damaged or inconsistent. Intercepting image deployment instructions means that before the image deployment request reaches the image deployment cluster, the system checks it and blocks the execution of the instruction if necessary. Image deployment risk instructions are warnings or notifications generated by the system to remind users that there are potential risks in the image and recommend further measures.
[0065] It can be understood that by consistency checking, potential risks caused by inconsistent or problematic image deployment can be avoided, and by intercepting image deployment and providing risk instructions, the system can detect problems at an early stage and effectively protect the user system from being affected.
[0066] The embodiment of the present application determines the candidate image and the candidate image digest according to the current configuration file in the target containerized environment; encrypts the candidate image digest to obtain the candidate encrypted digest, and determines and saves the candidate image storage file according to the candidate image name and the candidate encrypted digest of the candidate image; when the image deployment instruction is identified, determines the target image name and the image digest to be verified of the image to be deployed, and encrypts the image digest to be verified to obtain the encrypted digest to be verified; determines the target encrypted digest from the candidate image storage file with the target image name as an index; if the encrypted digest to be verified and the target encrypted digest meet the image deployment conditions, the image to be deployed is deployed. The above technical solution uses the encrypted digest to verify the image during the deployment process, which can effectively improve the security of image deployment.
[0067] Embodiment 3
[0068] Figure 3 This is a schematic diagram of the structure of a protective device for image deployment provided in the third embodiment of the present application, which can be applied to the situation of anti-tampering verification of images during deployment. The protective device for image deployment can be implemented in the form of hardware and / or software, and the protective device for image deployment can be configured in a computer device, such as a server. Figure 3 As shown, the device comprises:
[0069] An image determination module 310 is used to determine a candidate image and a candidate image summary according to a current configuration file in a target containerized environment;
[0070] The file determination module 320 is used to encrypt the candidate image digest to obtain the candidate encrypted digest, and determine and save the candidate image storage file according to the candidate image name and the candidate encrypted digest of the candidate image;
[0071] The digest encryption module 330 is used to determine the target image name of the image to be deployed and the image digest to be verified when the image deployment instruction is identified, and encrypt the image digest to be verified to obtain the encrypted digest to be verified;
[0072] The image deployment module 340 is used to deploy the image to be deployed if the target image name, the encrypted digest to be verified and the candidate image storage file meet the image deployment conditions.
[0073] The embodiment of the present application determines the candidate image and the candidate image digest according to the current configuration file in the target containerized environment; encrypts the candidate image digest to obtain the candidate encrypted digest, and determines and saves the candidate image storage file according to the candidate image name and the candidate encrypted digest of the candidate image; when the image deployment instruction is identified, determines the target image name and the image digest to be verified of the image to be deployed, and encrypts the image digest to be verified to obtain the encrypted digest to be verified; if the target image name, the encrypted digest to be verified and the candidate image storage file meet the image deployment conditions, the image to be deployed is deployed. The above technical solution uses the encrypted digest to verify the image during the deployment process, which can effectively improve the security of image deployment.
[0074] Optionally, the image deployment module 340 includes:
[0075] A digest determination unit, used to determine a target encryption digest from a candidate image storage file using the target image name as an index;
[0076] The image deployment unit is used to deploy the image to be deployed if the encryption digest to be verified and the target encryption digest meet the image deployment conditions.
[0077] Optional, mirror deployment unit, specifically used for:
[0078] Perform consistency check on the encrypted digest to be checked and the target encrypted digest;
[0079] If the consistency check passes, the image to be deployed is deployed.
[0080] Optionally, the image deployment unit is also used to:
[0081] If the consistency check fails, the image deployment instruction is intercepted and the image deployment risk instruction is fed back to the user.
[0082] Optionally, the file determination module 320 is specifically configured to:
[0083] The candidate image storage file is constructed with the candidate image name as the candidate file name and the candidate encryption digest as the candidate file content;
[0084] Save the candidate image storage file to the file server.
[0085] Optionally, the device further includes a file holding module, which is used to:
[0086] When an image deployment instruction is identified, a candidate image storage file is obtained from a file server, and the candidate image storage file is saved in a target database in the form of a character string.
[0087] The image deployment protection device provided in the embodiment of the present application can execute the image deployment protection method provided in any embodiment of the present application, and has the corresponding functional modules and beneficial effects for executing each image deployment protection method.
[0088] Embodiment 4
[0089] Figure 4 It is a structural diagram of an electronic device 410 that implements the protection method of the mirror image deployment of an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.
[0090] like Figure 4 As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In RAM413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, ROM412 and RAM413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.
[0091] Multiple components in the electronic device 410 are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device 410 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0092] Processor 411 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. Processor 411 executes the various methods and processes described above, such as the protection method for image deployment.
[0093] In some embodiments, the protection method for image deployment may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the protection method for image deployment described above may be performed. Alternatively, in other embodiments, the processor 411 may be configured as a protection method for image deployment in any other appropriate manner (e.g., by means of firmware).
[0094] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0095] The computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable mirror-deployed protection device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.
[0096] In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0097] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).
[0098] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0099] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.
[0100] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.
[0101] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.
Claims
1. A protection method for image deployment, characterized in that: include: Determine candidate images and candidate image summaries based on current configuration files in the target containerized environment; Encrypting the candidate image digest to obtain a candidate encrypted digest, and determining and saving a candidate image storage file according to the candidate image name of the candidate image and the candidate encrypted digest; When an image deployment instruction is identified, a target image name of the image to be deployed and an image digest to be verified are determined, and the image digest to be verified is encrypted to obtain an encrypted digest to be verified; If the target image name, the encrypted digest to be verified, and the candidate image storage file meet the image deployment conditions, the image to be deployed is deployed.
2. The method according to claim 1, characterized in that If the target image name, the encrypted digest to be verified, and the candidate image storage file meet the image deployment condition, then deploying the image to be deployed includes: Using the target image name as an index, determining a target encryption digest from the candidate image storage file; If the encrypted digest to be verified and the target encrypted digest meet the image deployment condition, the image to be deployed is deployed.
3. The method according to claim 2, characterized in that If the encrypted digest to be verified and the target encrypted digest meet the image deployment condition, deploying the image to be deployed includes: Performing a consistency check on the encrypted digest to be checked and the target encrypted digest; If the consistency check passes, the image to be deployed is deployed.
4. The method according to claim 3, characterized in that The method further comprises: In the case where the consistency check fails, the image deployment instruction is intercepted, and the image deployment risk instruction is fed back to the user.
5. The method according to claim 1, characterized in that The step of determining and saving a candidate image storage file according to the candidate image name and the candidate encryption digest of the candidate image includes: Constructing a candidate image storage file using the candidate image name as a candidate file name and the candidate encryption digest as candidate file content; The candidate image storage file is saved in a file server.
6. The method according to claim 5, characterized in that In the case where an image deployment instruction is identified, the method further includes: The candidate image storage file is obtained from the file server, and the candidate image storage file is saved in a target database in the form of a character string.
7. A mirror-deployed protection device, characterized in that: include: An image determination module, used to determine a candidate image and a candidate image summary according to a current configuration file in a target containerized environment; A file determination module, configured to encrypt the candidate image digest to obtain a candidate encrypted digest, and determine and save a candidate image storage file according to the candidate image name of the candidate image and the candidate encrypted digest; A digest encryption module is used to determine the target image name of the image to be deployed and the image digest to be verified when an image deployment instruction is identified, and to encrypt the image digest to be verified to obtain an encrypted digest to be verified; The image deployment module is used to deploy the image to be deployed if the target image name, the encrypted summary to be verified and the candidate image storage file meet the image deployment conditions.
8. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the image deployment protection method as described in any one of claims 1-6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the protection method for image deployment as described in any one of claims 1 to 6 is implemented.
10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the image deployment protection method according to any one of claims 1 to 6.