Security container management method and device, storage medium and electronic equipment

Abstract

The invention discloses a secure container management method and device, a storage medium and electronic equipment, and the method comprises the steps: operating a secure container, intercepting at least one to-be-executed system command of a system user to the secure container, carrying out the trusted command inspection processing of the to-be-executed system command, and obtaining a trusted command inspection result; and performing execution management and control processing on the to-be-executed system command in the security container based on the credible command check result to obtain a security container execution management and control result, and sending the security container execution management and control result to the system user.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a secure container management method, device, storage medium and electronic device. Background Art

[0002] With the development of cloud computing, cloud infrastructure has become an important part of the infrastructure of many enterprises and users. Some enterprises even host all their projects in the public cloud environment. With the expansion of the volume of development and operation projects based on cloud computing infrastructure, the concept of cloud native has quietly entered people's sight and gradually grown. Containers are the system foundation for cloud native. Under the wave of cloud native, more and more system services use containers, which can enable cloud service platforms to build full-stack cloud native competitiveness from top to bottom. Summary of the invention

[0003] This specification provides a secure container management method, device, storage medium and electronic device, and the technical solution is as follows:

[0004] In a first aspect, this specification provides a secure container management method, the method comprising:

[0005] Running the secure container, intercepting the system using at least one to-be-executed system command of the secure container by the user, performing a trusted command check process on the to-be-executed system command, and obtaining a trusted command check result;

[0006] Based on the trusted command check result, execution control processing is performed on the to-be-executed system command in the secure container to obtain a secure container execution control result;

[0007] The secure container execution control result is sent to the system user.

[0008] In a second aspect, this specification provides a secure container management device, the device comprising:

[0009] An execution check module is used to run a secure container, intercept at least one system command to be executed by a user of the secure container, perform a trusted command check on the system command to be executed, and obtain a trusted command check result;

[0010] An execution control module, configured to perform execution control processing on the to-be-executed system command in the secure container based on the trusted command check result, and obtain a secure container execution control result;

[0011] The result sending module is used to send the security container execution management and control results to the system user.

[0012] In a third aspect, the present specification provides a computer storage medium, wherein the computer storage medium stores at least one instruction, wherein the instruction is suitable for being loaded by a processor and executing the method steps of one or more embodiments of the present specification.

[0013] In a fourth aspect, the present specification provides a computer program product, wherein the computer program product stores at least one instruction, wherein the instruction is suitable for being loaded by a processor and executing the method steps of one or more embodiments of the present specification.

[0014] In a fifth aspect, the present specification provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps of one or more embodiments of the present specification.

[0015] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least:

[0016] In one or more embodiments of the present specification, a secure container is run, at least one system command to be executed by a user of the system in the secure container is intercepted, a trusted command check is performed on the system command to be executed to obtain a trusted command check result, and based on the trusted command check result, execution control is performed on the system command to be executed in the secure container to obtain a secure container execution control result and sent to the user. By intercepting the system command to be executed and performing a trusted check on it, and controlling the execution of the command based on the check result, trusted command control based on the secure container is implemented. Based on the secure container, the kernel can be simulated in user space and system call commands can be finely controlled, thereby solving the defects brought about by the use of host intrusion detection systems and bastion hosts in related technologies. In the secure container, not only the execution of unauthorized or malicious commands is prevented, but also it is ensured that only commands that have been trusted and verified can be run. In addition, by generating and displaying detailed secure container execution control results to system users, the transparency of operations is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in this specification or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a scenario diagram of a secure container management system provided in this specification;

[0019] Figure 2 It is a flowchart of a secure container management method provided in this specification;

[0020] Figure 3 This is a flowchart of a trusted command check provided in this manual;

[0021] Figure 4 This is a flowchart of a trusted command check provided in this manual;

[0022] Figure 5 This is a flowchart of a command selection provided in this manual;

[0023] Figure 6 It is a flowchart of a trusted command cache set provided in this specification;

[0024] Figure 7 It is a structural schematic diagram of a secure container management device provided in this specification;

[0025] Figure 8 It is a structural diagram of an execution inspection module provided in this specification;

[0026] Fig. 9 It is a structural diagram of an execution control module provided in this specification;

[0027] Fig.10 It is a structural schematic diagram of an electronic device provided in this manual. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in this specification to clearly and completely describe the technical solutions in this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0029] In the description of this specification, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In the description of this specification, it should be noted that, unless otherwise clearly specified and limited, "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. For those of ordinary skill in the art, the specific meanings of the above terms in this specification can be understood in specific circumstances. In addition, in the description of this specification, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are an "or" relationship.

[0030] In related technologies, under the wave of cloud native, more and more service systems use containers. In order to ensure the security and reliability of these containers, host-based intrusion detection system (HIDS) and bastion host technology can usually be used to intercept malicious system commands. However, using HIDS technology and bastion host technology to intercept commands cannot ensure the security of system call control, has poor risk isolation capabilities, has false alarms, and has high resource overhead and performance limitations;

[0031] For example, HIDS technology has the following limitations:

[0032] a. Limited system call control: HIDS usually analyzes and reports system calls after they have occurred, rather than blocking potentially unsafe calls in advance.

[0033] b. Only provides host-level isolation: HIDS mainly protects the entire host level and has limited isolation capabilities between containers.

[0034] c. Portability and consistency issues: HIDS may have different security policy implementations on different host machines, lacking uniformity.

[0035] d. High privilege requirements: HIDS needs to run on the host machine and requires higher privileges to monitor system activities.

[0036] e. False positive risk: HIDS may misinterpret legitimate behavior as malicious activity, resulting in unnecessary alerts.

[0037] f. Performance overhead: HIDS may need to consume more resources to monitor and analyze system activities, thus affecting system performance.

[0038] g. Complex security management: HIDS usually requires independent management and configuration, which increases the complexity of security management.

[0039] h. Difficult integration: As an independent system, HIDS may not be tightly integrated with modern container orchestration systems.

[0040] For example, the bastion host technology has the following limitations:

[0041] a. Limited isolation capabilities: The bastion host mainly controls access permissions at the network level and does not provide isolation at the operating system kernel level.

[0042] b. Coarse-grained control: The bastion host usually provides session-based command control rather than fine-grained control at the system call level.

[0043] c. Decentralized policy implementation: Each bastion host session may need to configure security policies independently, making unified management more difficult.

[0044] d. Higher resource consumption: The bastion host may consume more computing resources because it proxies all access and control.

[0045] e. Limited portability: The bastion host relies on a specific network architecture and may not be suitable for all container environments and cloud platforms.

[0046] f. Automation and scalability challenges: The security controls of the bastion host may be more difficult to manage programmatically, which is not conducive to automation and dynamic expansion of containers in large-scale cloud environments. g. Audit complexity: Although the bastion host provides session records, it may lack detailed logs and audit functions at the system call level.

[0047] The present specification is described in detail below with reference to specific embodiments.

[0048] See also Figure 1 , is a scenario diagram of a secure container management system provided in this specification. Figure 1 As shown, the secure container management system may include at least a client cluster and a service platform 100 .

[0049] The client cluster may include at least one client, such as Figure 1 As shown, it specifically includes client 1 corresponding to user 1, client 2 corresponding to user 2, ..., client n corresponding to user n, where n is an integer greater than 0.

[0050] Each client in the client cluster can be an electronic device with communication function, including but not limited to: wearable device, handheld device, personal computer, tablet computer, vehicle-mounted device, smart phone, computing device or other processing device connected to wireless modem, etc. Electronic devices can be called different names in different networks, such as: user equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, cellular phone, cordless phone, personal digital assistant (PDA), electronic device in 5G network or future evolution network, etc.

[0051] The service platform 100 can be a separate server device, such as a rack-mounted, blade, tower, or cabinet-mounted server device, or a workstation, mainframe computer, or other hardware device with strong computing power; it can also be a server cluster composed of multiple servers, and the servers in the service cluster can be composed in a symmetrical manner, wherein each server has equivalent functions and status in the transaction link, and each server can provide services to the outside independently, and the independent service can be understood as not requiring the assistance of other servers.

[0052] In one or more embodiments of the present specification, the service platform 100 may establish a communication connection with at least one client in the client cluster, and complete the data interaction in the secure container management process based on the communication connection.

[0053] It should be noted that the service platform 100 and at least one client in the client cluster establish a communication connection through a network for interactive communication, wherein the network can be a wireless network or a wired network, the wireless network includes but is not limited to a cellular network, a wireless local area network, an infrared network or a Bluetooth network, and the wired network includes but is not limited to Ethernet, a universal serial bus (USB) or a controller local area network. In one or more embodiments of the specification, technologies and / or formats including HyperText Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data (such as a target compressed package) exchanged through the network. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec), etc. can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0054] The secure container management system embodiment provided in this specification and the secure container management method in one or more embodiments belong to the same concept. The execution subject corresponding to the secure container management method involved in one or more embodiments of the specification can be an electronic device, and the electronic device can be a secure container host. The execution subject corresponding to the secure container management method involved in one or more embodiments of the specification can also be an electronic device corresponding to the client, which is determined based on the actual application environment. The implementation process of the secure container management system embodiment can be detailed in the following method embodiment, which will not be repeated here.

[0055] based on Figure 1 The scenario diagram is shown, and the secure container management method provided by one or more embodiments of this specification is introduced in detail below.

[0056] See also Figure 2 , a flowchart of a secure container management method is provided for one or more embodiments of the present specification, the method can be implemented by a computer program and can be run on a secure container management device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application. The secure container management device can be an electronic device, for example, the electronic device can be a secure container host.

[0057] Specifically, the secure container management method includes:

[0058] S102: Run the secure container, intercept the system using at least one to-be-executed system command of the secure container by the user, perform a trusted command check process on the to-be-executed system command, and obtain a trusted command check result;

[0059] Container: Application packaging technology encapsulated in a standard format and running on a standard operating system environment.

[0060] Secure container: Compared with ordinary containers, the main difference of secure containers is that each container runs in a separate virtual machine, has an independent operating system kernel, and secure isolation of the virtualization layer. Based on the secure isolation of the virtualization layer, the operating system of the virtual machine and the host machine are independent of each other, preventing applications from directly accessing host resources, thereby providing additional protection between container hosts and between containers.

[0061] In a secure container application scenario, the implementation of a secure container requires the collaboration of multiple parties, such as the high-level container runtime on the host side and the secure container runtime. Among them, the secure container runtime: a program that creates and runs containers based on images obtained online, responsible for the entire life cycle of the container from pulling images to starting and then terminating;

[0062] Specifically, in the high-level container runtime (the container runtime is divided into the low-level container runtime, the high-level container runtime, and the sandbox or virtualization level runtime), API interfaces and features related to shared image formats, image management, and shared images are provided. The high-level container runtime receives instructions related to images and containers through the upper-level interface of the container runtime. The high-level container runtime sends instructions related to creating and running secure containers to the secure container runtime through the container runtime interface. The secure container runtime can use the host machine (of the secure container) to run the virtual machine kernel thread technology to create and run secure containers based on the images obtained online, and is responsible for the entire life cycle of the secure container from pulling images to starting and then terminating. The host machine (of the secure container) runs the virtual machine kernel thread technology, which allows the kernel threads in the virtual machine to run on the host machine like ordinary user-mode processes. Its core is the precise shared mapping of memory and cross-virtual machine thread synchronization. User mode means that the process runs in the user address space, and the executed code is checked by the processor and can only access the virtual addresses of the pages accessible in the user mode specified in the page table entries that map its address space. By using the host machine to run the virtual machine kernel thread technology, you can use the idle computing resources on the host machine, provide the virtual machine's internal information and system interface to realize the communication pipeline.

[0063] System users can be understood as system accounts, service accounts or administrator accounts that have the right to initiate and manage commands within containers. This account is used to run and manage system processes, services or applications. System users can be understood as any user who uses system resources, such as system programs, applications, application services, etc. User account subjects can use system resources based on demand to initiate system commands to be executed. System users usually have some specific permissions that allow them to perform system-level operations, but these permissions are usually not as extensive as the permissions of super users (such as root).

[0064] Furthermore, after running the secure container based on the above method, the host machine can intercept at least one system command to be executed by the system user for the secure container, perform a trusted command check on the system command to be executed, and obtain a trusted command check result;

[0065] Exemplarily, a command interception agent can be deployed in a secure container. The command interception agent serves as a pre-processor for the execution of system user commands. All system user commands must pass through the agent, and the agent decides whether to allow the execution of system user commands based on preset rules.

[0066] Exemplarily, a command interception hook function may be deployed, and the command interception hook function may be deployed for a container interface, and the system commands to be executed in and out of the secure container may be intercepted by the command interception hook function;

[0067] Optionally, after the interception system uses at least one to-be-executed system command of the user to the secure container, a trusted command check mechanism is triggered, and a preset security detection item is used to check the trusted command of the to-be-executed system command to obtain a trusted command check result, which may indicate whether the command is safe and whether it can be executed;

[0068] The trusted command check result can confirm the credibility of the command. The preset security detection items include but are not limited to one or more fitting of command source verification items, trusted command format verification items, standard command parameter comparison items, security rule verification items, etc.;

[0069] S104: performing execution control processing on the to-be-executed system command in the secure container based on the trusted command check result, and obtaining a secure container execution control result;

[0070] According to the trusted command check result of the previous step, decide whether to execute the pending system command initiated by the system user. If the pending system command is considered safe, continue to execute it; if the pending system command is considered dangerous, risk command control can be performed on the pending system command to complete the execution control processing of the pending system command and generate the execution control result of the secure container;

[0071] Risk command control includes but is not limited to modifying pending system commands, restricting the execution of pending system commands, or completely preventing the execution of pending system commands.

[0072] In an illustrative manner, after the execution control processing is completed, a secure container execution control result is generated, which includes but is not limited to one or more fittings of information such as whether the command is executed, execution status information and result information, and execution control details of any modifications or restrictions on the command due to security reasons.

[0073] In a feasible implementation manner, the performing execution control processing on the to-be-executed system command in the secure container based on the trusted command check result to obtain the secure container execution control result includes:

[0074] If the trusted command check result is a command execution allowed type, the system command to be executed is executed in the secure container, the command execution content for the system command to be executed is obtained, and the command execution content is used as the secure container execution control result;

[0075] In an illustrative manner, when the trusted command check result is a command execution allowed type, the system command to be executed will actually be executed inside the secure container. After the system command to be executed is executed, the command output is captured inside the secure container, including the data returned by the command, the execution status, and any standard output or error output. The command output reflects the specific result and process of the command execution. The output content of the executed command is recorded and used as the "secure container execution control result."

[0076] If the trusted command check result is a command execution rejection type, the system command to be executed is rejected within the secure container, and a command execution failure result is generated for the system command to be executed, and the command execution failure result is used as the secure container execution control result.

[0077] For example, when the trusted command check result is a command execution rejection type, the system command to be executed will not be executed in the secure container, but measures will be taken to prevent the command from running, generating a command execution failure result indicating that the command was not executed. The command execution failure result can usually include an error message or status code, a clear indication that the command was rejected for security reasons, related security prompts or explanations, etc., and the command execution failure result is recorded as a "secure container execution control result";

[0078] S106: Sending the security container execution control result to the system user.

[0079] Feedback the results of secure container execution control to the system user who initiated the command. For example, this can be done through logging, security alerts, or directly displaying messages on the user interface.

[0080] Sending secure container execution control results to system users can ensure that system users understand the execution status of the system execution commands they initiated, as well as any adjustments or blocks to command execution due to security considerations.

[0081] In one or more embodiments of the present specification, a secure container is run, at least one system command to be executed by a user of the system in the secure container is intercepted, a trusted command check is performed on the system command to be executed to obtain a trusted command check result, and based on the trusted command check result, execution control is performed on the system command to be executed in the secure container to obtain a secure container execution control result and sent to the user. By intercepting the system command to be executed and performing a trusted check on it, and controlling the execution of the command based on the check result, trusted command control based on the secure container is implemented. Based on the secure container, the kernel can be simulated in the user space and the system call command can be finely controlled, thereby solving the defects caused by the use of host intrusion detection systems and bastion hosts in related technologies. In the secure container, not only the execution of unauthorized or malicious commands is prevented, but also it is ensured that only commands that have been trusted and verified can be run. In addition, by generating and displaying detailed secure container execution control results to system users, the transparency of operations is improved.

[0082] See also Figure 3 , Figure 3 This is a flow chart of a trusted command check proposed in one or more embodiments of this specification. The interception system uses the user to execute at least one system command to be executed in the secure container, performs a trusted command check on the system command to be executed, and obtains a trusted command check result. The following implementation method can be referred to:

[0083] S202: In a user space corresponding to the secure container, intercepting, by a command control agent, at least one system command to be executed by a user of the secure container;

[0084] User space refers to the memory area where user processes run in the operating system. Compared with kernel space, user space is used to execute user-level programs and applications. In a container environment, user space refers to the environment in which applications run inside a container.

[0085] After the secure container is running, system users can execute system commands on the secure container.

[0086] A command execution check mechanism is implemented inside the secure container. A command interception agent is used to intercept at least one system command to be executed by the system user on the secure container. The command interception agent: The agent will act as an intermediary. In the command path between the system user and the container operating system, at least one system command to be executed in the secure container must pass through it so as to review and control these commands. Further, the command control agent uses the pre-acquired command execution rule set to perform trusted command check processing on the system command to be executed, and obtains the trusted command check result. For details, please refer to S204 and S206;

[0087] Optionally, the command control agent can intercept all system calls through a hook mechanism. These hook functions can be inserted at various stages of command execution to ensure that all commands must pass the agent's check before execution.

[0088] Optionally, the command control agent can intercept and check the system commands to be executed input by the system user by wrapping the Shell or command line interface (CLI).

[0089] S204: Using the command execution rule set, the command control agent detects the command execution decision type of the to-be-executed system command; the command execution decision type includes a command execution permission type and a command execution rejection type;

[0090] In a feasible implementation, the security server configures the command execution rules on the rule management platform in advance. The command execution rules include rule parameters such as command type, parameter mode, source user information, command name, execution time, etc.

[0091] The rule management platform provides the following functions for the security server:

[0092] 1. Ability to create, edit and delete rules

[0093] 2. Storage and retrieval capabilities of rules

[0094] 3. API interface for other systems to query rule capabilities

[0095] B2: Obtain the command execution rule set from the rule management platform;

[0096] For example, after a security engineer adds command execution rules based on security requirements on the rule management platform, such as defining which commands are allowed to be executed, the command execution rules are sent to the host machine through the rule distribution channel. At this time, the host machine completes obtaining the command execution rules from the rule management platform and saves the command execution rules to the command execution rules.

[0097] A command execution rule set includes multiple command execution rules. A rule set is a set of rules that define which commands are allowed to be executed and which commands should be rejected. These rules are formulated by the security server based on security policies, historical security events, system security requirements, and other factors.

[0098] B4: triggering a command execution check mode for the command control agent based on the command execution rule set within the secure container.

[0099] Then, the (secure container) host activates the command control agent in the secure container, and the command control agent triggers the command execution check mode based on the command execution rule set. Subsequently, in the command execution check mode, the command execution rule set is used to detect the command execution decision type of the system command to be executed. Each command to be executed will be evaluated to see whether it meets the "command execution allowed type" or the "command execution denied type", and this evaluation classification is based on the criteria defined in the rule set.

[0100] S206: Generate a trusted command check result based on the command execution decision type of the system command to be executed.

[0101] Based on the decision type in step S204, the command control agent will generate a detailed inspection result, namely a trusted command inspection result. The trusted command inspection result indicates whether each system command to be executed has obtained execution permission.

[0102] The trusted command check result includes, but is not limited to, one or more of command details, execution permission status, and related security warnings or recommendations.

[0103] In a specific implementation scenario, for example, to allow users to execute the ls command on a secure container and prohibit the execution of the vim command, the execution method can be used

[0104] (1) The security server configures command execution rules on the rule management platform in advance to define the commands allowed to be executed in the container. The rules may include command name, parameter mode, user information, etc.

[0105] like:

[0106] allow ls command

[0107] deny vim command

[0108] (2) Sending rules to the host through the rule distribution channel to complete the acquisition of command execution rules from the rule management platform;

[0109] It is pushed to the host machine through the distribution function of the rule management platform, and then loaded into the configuration file rules.txt (equivalent to the command execution rule set) on the host machine.

[0110] (3) The system executes using user commands

[0111] After the secure container is running, the user can execute commands on the secure container, such as executing the vim command and the ls command.

[0112] (4) In the user space corresponding to the secure container, the command control agent intercepts the system using the user to execute at least one system command to be executed in the secure container.

[0113] (5) command execution check, using a command execution rule set to detect the command execution decision type of the system command to be executed;

[0114] Command interception proxy (program): Create a proxy capability in the secure container. This proxy program will act as an intermediary, and all command execution must pass through it. At this time, the content of the vim command and the ls command is obtained in the secure container.

[0115] Obtain rule file judgment: Read the rule file and find that the ls command is allowed to be executed and the vim command is denied. Follow up these two rules on the security container.

[0116] (5) Generate a trusted command check result based on the command execution decision type of the system command to be executed, and the command interception agent returns the result

[0117] Based on the above rules, the ls command is allowed to be executed and the result after ls is returned; the vim command is not allowed to be executed, and the failure of executing the vim command is returned to the system user.

[0118] In one or more embodiments of the present specification, the above method can ensure strict control over the execution of commands in the secure container, significantly improve the security of the container environment, prevent the execution of unauthorized or malicious commands, and thus protect system resources and data security. In addition, the automated command review and security rules are combined to achieve an efficient and reliable security control mechanism.

[0119] See also Figure 4 , Figure 4 This is a flow chart of a trusted command check proposed in one or more embodiments of this specification. The following implementations can be referred to for executing the interception of at least one system command to be executed by the user to the secure container by the command control agent, and for performing trusted command check processing on the system command to be executed by the command control agent using a command execution rule set:

[0120] S3002: In a user space corresponding to the secure container, intercepting, by a command control agent, at least one system command to be executed by a user of the secure container;

[0121] For details, please refer to the method steps in other embodiments of this specification, which will not be repeated here;

[0122] S3004: intercepting all system commands to be executed by the user of the system to the secure container through a command control agent;

[0123] S3006: Performing trusted command check processing on all the to-be-executed system commands by using the command execution rule set through the command control agent;

[0124] It can be understood that a comprehensive command inspection and processing method is adopted. The command control agent uses a command execution rule set to perform trusted command inspection and processing on all system commands to be executed. Every command entering the secure container will be evaluated and inspected by the agent to ensure that they comply with predetermined security standards and policies, thereby providing comprehensive security protection.

[0125] S3008: Select at least one trusted command to be executed and at least one target command to be executed from the system commands to be executed by using a command execution cache mechanism, and perform trusted command check processing on the target command to be executed by using a command execution rule set through the command control agent.

[0126] In order to avoid the burden on system performance, a command execution cache mechanism is introduced in the command control scenario. The command execution cache mechanism is used to classify all system commands to be executed into trusted commands to be executed and target commands to be executed. This is equivalent to first selecting at least one trusted command to be executed and at least one target command to be executed from all commands to be executed. Only the target command to be executed will be further checked and processed by the command control agent using the command execution rule set for trusted commands. The cache mechanism is cleverly used without changing the original system storage architecture. The minimum cost cache mechanism is used to improve efficiency and reduce unnecessary repeated checks, especially for those commands that are frequently executed and verified to be trusted. It can significantly reduce the occupation of system resources and improve the command processing speed.

[0127] In one possible implementation, see Figure 5 , Figure 5 The present invention is a flowchart of command selection, wherein the command execution cache mechanism is used to select at least one trusted command to be executed and at least one target command to be executed from the system commands to be executed, and the following method can be referred to:

[0128] S4002: Determine a trusted command cache set from the command execution cache mechanism;

[0129] Pre-set a cache area for recording command execution and run the command execution cache mechanism, initialize and continuously update a set of known trusted command caches. This set is based on the previous review result cache of historical system execution commands, and then determines the caches corresponding to those trusted commands that have been verified and considered safe, and archives these trusted command caches in a unified trusted command cache set.

[0130] In schematic form, trusted command cache sets are used to quickly identify and process frequently occurring trusted line commands whose security is known, thereby avoiding repeated security checks on them within a valid cache cycle (trusted line command caches are within a certain life cycle), thereby improving overall processing efficiency.

[0131] S4004: Detect whether the system command to be executed matches the predetermined trusted command cache set;

[0132] The system matches new commands to be executed with the trusted command cache set. Through the comparison, it can quickly identify which commands are known and trusted, and directly allow these commands to be executed without further security checks.

[0133] S4006: If there is a first system command to be executed that matches the trusted command cache set, use the first system command to be executed as a trusted command to be executed;

[0134] If the command to be executed matches one or more commands in the trusted row command cache set, it means that the command is trusted, and the matching first system command to be executed is regarded as a "trusted command to be executed" and can be safely executed without further review using the command execution rule set.

[0135] S4008: If there is a second system command to be executed that does not match the trusted command cache set, use the second system command to be executed as the target command to be executed.

[0136] For those second-to-be-executed system commands that cannot find a match in the trusted row command cache set, the second-to-be-executed system commands are considered uncertain or potentially unsafe, and the unmatched second-to-be-executed system commands are marked as "target to-be-executed commands" and require further security checks and processing by the command control agent to determine whether they can be executed safely.

[0137] In this specification, the command execution cache mechanism can efficiently distinguish and process commands, reduce unnecessary security check overhead, and maintain strict control over potentially unsafe commands. It is especially suitable for environments with high command execution frequency and strict performance requirements, and can ensure the system's response speed and processing capabilities while ensuring security.

[0138] In one possible implementation, see Figure 6 , Figure 6 This is a flow chart of a trusted command cache set, specifically:

[0139] S5002: Acquire a historical execution command in an executed state in the secure container, and acquire historical command execution content and historical execution command meta information of the historical execution command;

[0140] The security container collects the executed historical command data, which includes the historical command execution content (such as command output and results) and the historical command execution meta-information (such as execution time, execution user, command source, and other data describing the historical command execution). By analyzing the historical command execution content and historical command execution meta-information, we can gain an in-depth understanding of the command execution background and results, providing comprehensive information support for risk assessment.

[0141] S5004: Based on the historical command execution content and the historical execution command meta-information, a command risk detection model is used to perform execution process risk detection processing on the historical execution command to obtain a command execution risk level for the historical execution command;

[0142] In this specification, a command risk detection model is used to evaluate the potential risk of each historically executed command based on the content and meta-information of historical command execution.

[0143] Specifically, a command risk detection prompt word is generated for the historical command execution content and the historical execution command meta-information; for example, a preset command risk detection prompt word may be used;

[0144] Then, the command risk detection prompt words, the historical command execution content and the historical execution command meta-information are input into the command risk detection big model, and the command risk detection big model is used to perform execution process risk detection processing on the historical execution commands to obtain and output the command execution risk level for the historical execution commands;

[0145] Optionally, the following illustrates a large model training process of a command risk detection large model, as follows:

[0146] C2: Create an initial command risk detection model for command risk detection scenarios based on the basic large language model;

[0147] In a feasible implementation, the initial command risk detection large model can be a model structure composed of at least one model module based on the basic large language model component, and then obtained after model training for the command risk detection scenario. The basic large language model (LLM) is an artificial intelligence content generation model designed to understand and generate human language. The basic large language model is trained on a large amount of data, and the trained task processing large language model can perform a wide range of tasks, including text summarization, task processing, code generation, etc.

[0148] Optionally, the basic large language model can be a common AIGC model, such as the Wenxin Yiyan large model, the Tongyi Qianwen large model, the GPT series large model, etc.

[0149] C4: Obtain command sample data, which includes sample command execution content and sample execution command meta information, and call the expert service to label the command execution risk level label on the command sample data;

[0150] C6: Generate command risk detection prompt words for command sample data, perform at least one round of model training on the initial command risk detection large model based on the command risk detection prompt words and command sample data, determine the predicted command execution risk level of the initial command risk detection large model for the command sample data, determine the comprehensive model loss based on the predicted command execution risk level and the command execution risk level label, and use the comprehensive model loss to adjust model parameters of the initial command risk detection large model until the initial command risk detection large model completes model training to obtain the command risk detection large model.

[0151] During the model forward propagation training process, the initial command risk detection model performs execution process risk detection on the sample execution command based on the sample command execution content and sample execution command meta information, and obtains the predicted command execution risk level for the sample execution command;

[0152] During the model back-propagation training process, the loss calculation function is used to calculate the comprehensive model loss based on the predicted command execution risk level and the command execution risk level label, and the comprehensive model loss is used to adjust the model parameters until the initial command risk detection large model meets the model end training conditions, thereby ending the model training and obtaining the command risk detection large model.

[0153] Optionally, the loss calculation function may adopt a cross entropy loss calculation function, a hinge loss calculation function, a contrast loss calculation function, a Euclidean distance loss calculation function, etc. in the related technology;

[0154] Optionally, the model training end condition of the model may include, for example, the value of the loss function is less than or equal to a preset loss function threshold, the number of iterations reaches a preset number threshold, etc. The specific model training end condition can be determined based on actual conditions and is not specifically limited here.

[0155] S5006: If the command execution risk level is less than the risk level threshold, the historical execution command is added to a trusted command cache set.

[0156] In an illustrative manner, the command execution risk level of the command is compared with a preset risk level threshold. If the command execution risk level of the command is greater than or equal to the risk level threshold, the historical execution command is discarded.

[0157] If the command execution risk level of a command is lower than the risk level threshold, it indicates that the historical execution command is relatively safe and can be added to the trusted command cache set, realizing automatic learning and adaptation to new security environments. By continuously updating the trusted command cache set, trusted and untrusted commands can be more effectively identified and processed, thereby improving processing efficiency and security.

[0158] In a feasible implementation manner, the adding the historical execution command to the trusted command cache set may be: determining a trusted command execution environment of the historical execution command, and adding the historical execution command and the trusted command execution environment to the trusted command cache set;

[0159] Further, after the first to-be-executed system command is used as a trusted to-be-executed command in S4006, the following method may also be referred to:

[0160] A2: Obtaining a target command execution environment for the trusted command to be executed;

[0161] After executing S4006 and treating the first to-be-executed system command as a trusted to-be-executed command, a target command execution environment where the trusted to-be-executed command is to be executed is identified and acquired. The target command execution environment includes one or more of the system version, network configuration, context instruction information, and secure container runtime.

[0162] The purpose of obtaining the target command execution environment is to ensure that the trusted command to be executed will be executed in an environment that meets its expected security requirements, thereby preventing security issues caused by environmental differences.

[0163] A4: If the target command execution environment matches the trusted command execution environment, a secure container execution control result of the command allowed execution type for the trusted command to be executed is generated;

[0164] If it is determined that the target command execution environment matches the trusted command execution environment of the trusted command, the system will generate a result indicating that the command can be executed safely, that is, the security container execution control result of the command allowed execution type. This matching check ensures that environmental factors do not pose a threat to the security of command execution.

[0165] A6: If the target command execution environment does not match the trusted command execution environment, a secure container execution control result of a command rejection type is generated for the trusted command to be executed.

[0166] If it is found that the target command execution environment does not match the expected execution environment of the trusted command (that is, the trusted command execution environment), a result indicating that the command should not be executed will be generated, that is, the secure container execution control result of the command execution rejection type. This is based on security considerations to prevent security risks that may be caused by executing commands in inappropriate environments.

[0167] Indicatively, the above approach, based on a detailed environment matching and result generation mechanism, can more intelligently process command execution requests, ensuring that even trusted commands are only executed in an environment that meets their security presets, which not only improves the security of the system, but also optimizes resource usage and avoids potential problems caused by environment mismatch. This implements an in-depth security defense strategy that is suitable for application scenarios with extremely high security requirements.

[0168] In one or more embodiments of this specification, the above method is adopted to implement a dynamic learning and adaptation strategy, which can continuously optimize its security strategy and command processing flow by continuously collecting and analyzing the data of historical execution commands. In addition, it can not only improve security, but also flexibly adjust according to changes in the actual operating environment, ensure that security measures always match current security threats, and achieve rapid response and effective defense against security threats.

[0169] In one or more embodiments of this specification, the provided secure container management method simulates the kernel in user space and finely controls the system calls in the container, thereby solving some core shortcomings of traditional HIDS and bastion host solutions. Specifically, it is manifested in the following aspects:

[0170] (1) Compared with traditional HIDS solutions:

[0171] a. Accurate system call control: By intercepting and processing system calls in user space, secure containers can verify and intercept commands before they are executed, thus overcoming the limitation that HIDS can usually only analyze after the call occurs.

[0172] b. Container-level isolation: The secure container provides a virtual kernel environment for each container, achieving stronger isolation capabilities that are not limited to the host level and can more effectively prevent cross-container attacks.

[0173] c. Cross-platform consistency: The secure container ensures that system calls within the container are highly consistent on different host machines, solving the portability problem of HIDS.

[0174] d. No host-level permissions required: Since the secure container operates inside the container and is isolated from the host kernel, it does not need to obtain a high level of permissions on the host, reducing permission requirements.

[0175] e. Reduce false positives: Secure containers can accurately control and monitor system calls, thereby effectively reducing the occurrence of false positives.

[0176] f. Performance overhead may be lower: The secure container intercepts system calls directly in user space, which may have better performance than the need for HIDS to analyze large amounts of active data on the host.

[0177] g. Simplified security management: Secure containers can integrate security policies into the container deployment process, thereby simplifying the security management process.

[0178] h. Better compatibility and integration: Secure containers are naturally suitable for modern container orchestration systems, such as Kubernetes, and are easy to integrate.

[0179] (2) Compared with the bastion host solution:

[0180] a. Deeper isolation: Secure containers use a lightweight user-mode kernel to isolate containers, providing deeper isolation capabilities than bastion hosts.

[0181] b. Fine-grained control: Secure containers can perform detailed checks and restrictions before process execution by performing fine-grained control at the system call level.

[0182] c. Unified policy application: Secure containers allow for unified application of security policies at the container platform level, without the need for independent configuration in each session of the bastion host.

[0183] d. Performance and resource efficiency: Security containers provide isolation while remaining lightweight and resource efficient, making them more efficient than bastion hosts.

[0184] e. Portability and flexibility: Secure containers can be seamlessly integrated with modern container orchestration platforms to support applications across different environments and clouds.

[0185] f. Easier to automate and scale: Security controls in secure containers are easy to manage through code, supporting large-scale and dynamic expansion.

[0186] g. Audit and transparency: Secure containers can provide detailed logs and audits of system calls, improving transparency and the ability to audit security incidents.

[0187] Furthermore, the provided secure container management method is used, and the trusted command control method based on the secure container allows only expected commands to be executed, achieving the following outstanding effects compared with related technologies:

[0188] 1. Outstanding user space kernel simulation: The secure container innovatively implements a lightweight kernel in user space, which intercepts and processes all system calls issued by the container process. This approach is in stark contrast to the traditional HIDS system running on the host kernel, which needs to respond after the system call occurs.

[0189] 2. Outstanding fine-grained access control: Security containers provide more sophisticated control methods than traditional HIDS and bastion hosts, allowing access control and command execution verification at the system call level. This means that security policies can be implemented for each system call, not just at the command level.

[0190] 3. Outstanding integration of isolation and security policies: Secure containers simplify security configuration and management by integrating security policies into the container deployment process. This integration allows isolation policies to take effect immediately when the container is initialized, ensuring continuous protection from startup to operation.

[0191] 4. Outstanding cross-platform consistency guarantee: The design of the secure container ensures consistent system call behavior on different hosts, which is critical for containerized applications running in multiple environments. It makes up for the consistency challenges that traditional HIDS may encounter when deployed across platforms.

[0192] 5. Outstanding performance optimization: By intercepting and executing system calls directly in user space, secure containers minimize performance overhead. Compared with HIDS that need to perform analysis in the host operating system kernel, this approach may bring better performance.

[0193] 6. Outstanding audit and transparency improvement: The secure container can record detailed log information of system calls, providing higher operational transparency and easy-to-trace audit capabilities, which helps security monitoring and incident response.

[0194] 7. Outstanding container orchestration system integration: Security containers are tightly integrated with modern container orchestration systems (such as Kubernetes) and can be easily deployed and managed in these systems, which helps to automate and expand security controls.

[0195] The following will be combined Figure 7 , the secure container management device provided in this specification is introduced in detail. It should be noted that, Figure 7 The secure container management device shown in the drawings is used to execute the Figure 1 to Figure 6 For the convenience of explanation, only the relevant parts of this specification are shown. For specific technical details not disclosed, please refer to the drawings of this specification. Figure 1 to Figure 6 The embodiment shown.

[0196] See also Figure 7 , which shows a schematic diagram of the structure of the secure container management device of this specification. The secure container management device 1 can be implemented as all or part of the device through software, hardware or a combination of both. According to some embodiments, the secure container management device 1 includes an execution inspection module 11, an execution control module 12 and a result sending module 13, which are specifically used to:

[0197] An execution check module 11 is used to run a secure container, intercept at least one system command to be executed by a user in the secure container, perform a trusted command check on the system command to be executed, and obtain a trusted command check result;

[0198] An execution control module 12 is used to perform execution control processing on the to-be-executed system command in the secure container based on the trusted command check result to obtain a secure container execution control result;

[0199] The result sending module 13 is used to send the secure container execution management and control result to the system user.

[0200] In a possible implementation, Figure 8 As shown, the execution inspection module 11 includes:

[0201] An interception unit 111 is used to intercept, in a user space corresponding to the secure container, at least one system command to be executed by a user of the secure container through a command control agent;

[0202] The detection unit 112 is used to perform a trusted command check process on the to-be-executed system command by using the command execution rule set through the command control agent to obtain a trusted command check result.

[0203] In a feasible implementation manner, the detection unit 112 is used to:

[0204] The command control agent uses a command execution rule set to detect the command execution decision type of the system command to be executed; the command execution decision type includes a command execution permission type and a command execution rejection type;

[0205] A trusted command check result is generated based on the command execution decision type of the system command to be executed.

[0206] In a feasible implementation manner, the detection unit 112 is used to:

[0207] Obtain command execution rule sets from the rule management platform;

[0208] A command execution check mode for a command control agent is triggered within the secure container based on the command execution rule set.

[0209] In a feasible implementation manner, the detection unit 112 is used to:

[0210] Intercept all system commands to be executed by the user of the secure container through a command control agent, and perform trusted command check processing on all the system commands to be executed by the command control agent using a command execution rule set; or

[0211] The system uses a command control agent to intercept all system commands to be executed by the user for the secure container, and adopts a command execution cache mechanism to select at least one trusted command to be executed and at least one target command to be executed from the system commands to be executed, and the command control agent adopts a command execution rule set to perform trusted command check processing on the target command to be executed.

[0212] In a feasible implementation manner, the detection unit 112 is used to:

[0213] Determine a trusted command cache set from a command execution cache mechanism;

[0214] Detecting whether the to-be-executed system command matches the predetermined trusted command cache set;

[0215] If there is a first system command to be executed that matches the trusted command cache set, taking the first system command to be executed as a trusted command to be executed;

[0216] If there is a second system command to be executed that does not match the trusted command cache set, the second system command to be executed is used as the target command to be executed.

[0217] In a feasible implementation manner, the detection unit 112 is used to:

[0218] Acquire a historical execution command in an executed state in the secure container, and acquire historical command execution content and historical execution command meta information of the historical execution command;

[0219] Based on the historical command execution content and the historical command execution meta-information, a command risk detection model is used to perform execution process risk detection processing on the historical execution command to obtain a command execution risk level for the historical execution command;

[0220] If the command execution risk level is less than the risk level threshold, the historical execution command is added to a trusted command cache set.

[0221] In a feasible implementation manner, the detection unit 112 is used to:

[0222] After taking the first system command to be executed as a trusted command to be executed, it also includes: obtaining the target command execution environment of the trusted command to be executed, and if the target command execution environment matches the trusted command execution environment, generating a secure container execution control result of a command allowed execution type for the trusted command to be executed; if the target command execution environment does not match the trusted command execution environment, generating a secure container execution control result of a command denied execution type for the trusted command to be executed.

[0223] In a possible implementation, Fig. 9 As shown, the execution control module 12 includes:

[0224] The execution permission unit 121 is used to execute the system command to be executed in the secure container if the trusted command check result is a command execution permission type, obtain the command execution content for the system command to be executed, and use the command execution content as the secure container execution control result;

[0225] The execution rejection unit 122 is used to reject the execution of the system command to be executed in the security container if the trusted command check result is a command execution rejection type, generate a command execution failure result for the system command to be executed, and use the command execution failure result as the security container execution management result.

[0226] It should be noted that the secure container management device provided in the above embodiment only uses the division of the above functional modules as an example when executing the secure container management method. In actual applications, the above functional distribution can be completed by different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the secure container management device provided in the above embodiment and the secure container management method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0227] The above serial numbers in this specification are for description only and do not represent the advantages or disadvantages of the embodiments.

[0228] In one or more embodiments of the present specification, a secure container is run, at least one system command to be executed by a user of the system in the secure container is intercepted, a trusted command check is performed on the system command to be executed to obtain a trusted command check result, and based on the trusted command check result, execution control is performed on the system command to be executed in the secure container to obtain a secure container execution control result and sent to the user. By intercepting the system command to be executed and performing a trusted check on it, and controlling the execution of the command based on the check result, trusted command control based on the secure container is implemented. Based on the secure container, the kernel can be simulated in the user space and the system call command can be finely controlled, thereby solving the defects caused by the use of host intrusion detection systems and bastion hosts in related technologies. In the secure container, not only the execution of unauthorized or malicious commands is prevented, but also it is ensured that only commands that have been trusted and verified can be run. In addition, by generating and displaying detailed secure container execution control results to system users, the transparency of operations is improved.

[0229] The present specification also provides a computer storage medium, which can store multiple instructions, which are suitable for being loaded and executed by a processor as described above. Figure 1 to Figure 6 The secure container management method of the embodiment shown in the figure can be specifically executed by referring to Figure 1 to Figure 6 The specific description of the illustrated embodiment will not be repeated here.

[0230] The present specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1 to Figure 6 The secure container management method of the embodiment shown in the figure can be specifically executed by referring to Figure 1 to Figure 6 The specific description of the illustrated embodiment will not be repeated here.

[0231] Please refer to Fig.10 , is a block diagram of a structure of an electronic device provided in an embodiment of this specification. The electronic device in this specification may include one or more of the following components: a processor 1010, a memory 1020, an input device 1030, an output device 1040, and a bus 1050. The processor 1010, the memory 1020, the input device 1030, and the output device 1040 may be connected via a bus 1050.

[0232] The processor 1010 may include one or more processing cores. The processor 1010 uses various interfaces and lines to connect various parts in the entire terminal, and executes various functions and processes data of the terminal 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 1020, and calling data stored in the memory 1020. Optionally, the processor 1010 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 1010 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 1010, but may be implemented separately through a communication chip.

[0233] The memory 1020 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 1020 includes a non-transitory computer-readable storage medium. The memory 1020 may be used to store instructions, programs, codes, code sets, or instruction sets.

[0234] The input device 1030 is used to receive input instructions or data, and the input device 1030 includes but is not limited to a keyboard, a mouse, a camera, a microphone, or a touch device. The output device 1040 is used to output instructions or data, and the output device 1040 includes but is not limited to a display device and a speaker. In the embodiment of this specification, the input device 1030 can be a temperature sensor for obtaining the operating temperature of the terminal. The output device 1040 can be a speaker for outputting audio signals.

[0235] In addition, those skilled in the art will appreciate that the structure of the terminal shown in the above drawings does not constitute a limitation on the terminal, and the terminal may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, the terminal also includes a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (WIFI) module, a power supply, a Bluetooth module, and other components, which will not be described in detail here.

[0236] In the embodiments of this specification, the execution subject of each step may be the terminal described above. Optionally, the execution subject of each step is the operating system of the terminal. The operating system may be an Android system, an IOS system, or other operating systems, which is not limited in the embodiments of this specification.

[0237] exist Fig.10 In an electronic device, the processor 1010 can be used to call the program stored in the memory 1020 and execute it to implement the secure container management method as described in the various method embodiments of this specification.

[0238] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0239] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the system commands to be executed and user information involved in this specification are all obtained with full authorization.

[0240] The above disclosure is only the preferred embodiment of this specification, which certainly cannot be used to limit the scope of rights of this specification. Therefore, equivalent changes made according to the claims of this specification are still within the scope covered by this specification.

Claims

1. A secure container management method, the method comprising: Running the secure container, intercepting the system using at least one to-be-executed system command of the secure container by the user, performing a trusted command check process on the to-be-executed system command, and obtaining a trusted command check result; Based on the trusted command check result, execution control processing is performed on the to-be-executed system command in the secure container to obtain a secure container execution control result; The secure container execution control result is sent to the system user.

2. The method according to claim 1, wherein the interception system uses at least one to-be-executed system command of the secure container to perform a trusted command check process on the to-be-executed system command to obtain a trusted command check result, including: In the user space corresponding to the secure container, intercepting, by a command control agent, at least one system command to be executed by a user for the secure container; The command control agent uses a command execution rule set to perform a trusted command check process on the system command to be executed to obtain a trusted command check result.

3. According to the method of claim 2, the step of performing a trusted command check on the to-be-executed system command using a command execution rule set by the command control agent to obtain a trusted command check result comprises: The command control agent uses a command execution rule set to detect the command execution decision type of the system command to be executed; The command execution decision type includes a command execution permission type and a command execution rejection type; A trusted command check result is generated based on the command execution decision type of the system command to be executed.

4. The method according to claim 2, further comprising: Obtain command execution rule sets from the rule management platform; A command execution check mode for a command control agent is triggered within the secure container based on the command execution rule set.

5. The method according to claim 2, wherein the intercepting system uses a command control agent to use at least one system command to be executed by the user to the secure container, and the command control agent uses a command execution rule set to perform a trusted command check on the system command to be executed, comprising: Intercepting all system commands to be executed by the user of the system to the secure container through a command control agent, and performing trusted command check processing on all the system commands to be executed by the command control agent using a command execution rule set; or, The system uses a command control agent to intercept all system commands to be executed by the user for the secure container, and adopts a command execution cache mechanism to select at least one trusted command to be executed and at least one target command to be executed from the system commands to be executed, and the command control agent adopts a command execution rule set to perform trusted command check processing on the target command to be executed.

6. The method according to claim 5, wherein the step of selecting at least one trusted command to be executed and at least one target command to be executed from the system commands to be executed by using a command execution cache mechanism comprises: Determine a trusted command cache set from a command execution cache mechanism; Detecting whether the to-be-executed system command matches the predetermined trusted command cache set; If there is a first system command to be executed that matches the trusted command cache set, taking the first system command to be executed as a trusted command to be executed; If there is a second system command to be executed that does not match the trusted command cache set, the second system command to be executed is used as the target command to be executed.

7. The method according to claim 6, further comprising: Acquire a historical execution command in an executed state in the secure container, and acquire historical command execution content and historical execution command meta information of the historical execution command; Based on the historical command execution content and the historical command execution meta-information, a command risk detection model is used to perform execution process risk detection processing on the historical execution command to obtain a command execution risk level for the historical execution command; If the command execution risk level is less than the risk level threshold, the historical execution command is added to a trusted command cache set.

8. The method according to claim 7, wherein adding the historical execution command to a trusted command cache set comprises: Determine a trusted command execution environment of the historical execution command, and add the historical execution command and the trusted command execution environment to a trusted command cache set; After taking the first system command to be executed as a trusted command to be executed, it also includes: obtaining the target command execution environment of the trusted command to be executed, and if the target command execution environment matches the trusted command execution environment, generating a secure container execution control result of a command allowed execution type for the trusted command to be executed; if the target command execution environment does not match the trusted command execution environment, generating a secure container execution control result of a command denied execution type for the trusted command to be executed.

9. The method according to claim 1, wherein the execution control processing of the to-be-executed system command in the secure container based on the trusted command check result to obtain the secure container execution control result comprises: If the trusted command check result is a command execution allowed type, the system command to be executed is executed in the secure container, the command execution content for the system command to be executed is obtained, and the command execution content is used as the secure container execution control result; If the trusted command check result is a command execution rejection type, the system command to be executed is rejected within the secure container, and a command execution failure result is generated for the system command to be executed, and the command execution failure result is used as the secure container execution control result.

10. A secure container management device, the device comprising: An execution check module is used to run a secure container, intercept at least one system command to be executed by a user of the secure container, perform a trusted command check on the system command to be executed, and obtain a trusted command check result; An execution control module, configured to perform execution control processing on the to-be-executed system command in the secure container based on the trusted command check result, and obtain a secure container execution control result; The result sending module is used to send the security container execution management and control results to the system user.

11. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 9.

12. A computer program product, the computer program product storing at least one instruction, wherein the at least one instruction is loaded by a processor and executes the method steps according to any one of claims 1 to 9.

13. An electronic device comprising: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 9.

Images