Network access method, device, equipment and medium

Abstract

The embodiment of the invention relates to a network access method and device, equipment and a medium, and the method comprises the steps: obtaining a network access request of a target container group, the target container group belongs to a target working group, and the target working group comprises at least one container group with the same function of a target application program; determining a target network access strategy corresponding to the target working group; and if it is determined that a target access object corresponding to the network access request is matched with the target network access strategy, executing an access operation between a target container group corresponding to the network access request and the target access object, the target access object comprises at least one of an external network object, an interactive object of a target container group outside the container arrangement platform and an internal object of the container arrangement platform. According to the technical scheme, network access management with finer granularity and different isolation degrees in the application program is realized, the actual access requirements of different container groups can be met, and the security of network access can be guaranteed.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a network access method, device, equipment and medium. Background Art

[0002] In cloud computing scenarios, cloud service providers of Model as a Service (MaaS) can provide large models as services to users. Users hope that their model-related tasks can be run in an isolated network environment. A task can include one or more container groups. The relevant technology can achieve unified static network isolation outside the application, but this isolation method has very low security when external network access is allowed, and cannot meet the actual external access network access requirements when external network access is not allowed, and needs to be improved. Summary of the invention

[0003] In order to solve the above technical problems, the present disclosure provides a network access method, device, equipment and medium.

[0004] The present disclosure provides a network access method, the method comprising:

[0005] Obtaining a network access request of a target container group, wherein the target container group belongs to a target workgroup, and the target workgroup includes at least one container group of the same function of a target application;

[0006] Determine a target network access policy corresponding to the target workgroup;

[0007] If it is determined that the target access object corresponding to the network access request matches the target network access policy, an access operation between the target container group corresponding to the network access request and the target access object is performed, wherein the target access object includes at least one of an external network object, an interactive object of the target container group outside the container orchestration platform, and an internal object of the container orchestration platform.

[0008] The present disclosure also provides a network access device, the device comprising:

[0009] an acquisition module, configured to acquire a network access request of a target container group, wherein the target container group belongs to a target workgroup, and the target workgroup includes at least one container group of the same function of a target application;

[0010] A determination module, used to determine a target network access policy corresponding to the target workgroup;

[0011] An execution module is configured to execute an access operation between the target container group corresponding to the network access request and the target access object if it is determined that the target access object corresponding to the network access request matches the target network access policy, wherein the target access object includes at least one of an external network object, an interactive object of the target container group outside the container orchestration platform, and an internal object of the container orchestration platform.

[0012] An embodiment of the present disclosure also provides an electronic device, which includes: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement the network access method provided by the embodiment of the present disclosure.

[0013] The embodiment of the present disclosure further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the network access method provided by the embodiment of the present disclosure.

[0014] The technical solution provided by the embodiment of the present disclosure has the following advantages over the prior art: the network access solution provided by the embodiment of the present disclosure obtains the network access request of the target container group, wherein the target container group belongs to the target workgroup, and the target workgroup includes at least one container group of the same function of the target application; determines the target network access policy corresponding to the target workgroup; if it is determined that the target access object corresponding to the network access request matches the target network access policy, then performs the access operation between the target container group corresponding to the network access request and the target access object, wherein the target access object includes at least one of an external network object, an interactive object of the target container group outside the container orchestration platform, and an internal object of the container orchestration platform. With the above technical solution, for the network access request of the target container group in the target workgroup of the target application, access is allowed when the network access policy corresponding to the target workgroup matches the target access object corresponding to the target access request, by dividing the container groups with the same function in the same application into corresponding workgroups, and setting different network access policies for different workgroups, since the network access policy can control the access of external network objects, interactive objects and / or internal objects, a more fine-grained network access management with different isolation degrees within the application is realized, which can not only meet the actual access needs of different container groups, but also ensure the security of network access. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0016] Figure 1 A flowchart of a network access method provided in some embodiments of the present disclosure;

[0017] Figure 2 A schematic diagram of a network access process provided for some embodiments of the present disclosure;

[0018] Figure 3 A schematic diagram of another network access process provided for some embodiments of the present disclosure;

[0019] Figure 4 A schematic diagram of a network access method provided for some embodiments of the present disclosure;

[0020] Figure 5 A schematic diagram of a control plane architecture provided for some embodiments of the present disclosure;

[0021] Figure 6 A schematic diagram of the structure of a network access device provided in some embodiments of the present disclosure;

[0022] Figure 7 A schematic diagram of the structure of an electronic device provided for some embodiments of the present disclosure. DETAILED DESCRIPTION

[0023] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0024] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0025] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0026] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0027] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0028] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0029] In cloud computing scenarios such as container orchestration platforms, it is possible to achieve unified static network isolation outside the application. However, in this isolation method, in order to ensure the normal use of the application, it is necessary to set the access range for the entire application according to the maximum access range required by the container group in the application. For example, if there is a container group in the application that needs to access the external network, the entire application needs to be allowed to access the external network, and the security of the application is very low. Alternatively, in order to ensure the security of the application, the application can be prohibited from accessing the external network, but at this time, the container group in the application that actually has the need for external network access cannot run normally, and the application cannot run normally either. Alternatively, the entire application can be allowed to access the external network, and the container groups within the application can communicate in an encrypted manner. However, the additional overhead of this method is too large, which affects the normal operation of the application.

[0030] In summary, there is an urgent need for a method to improve the security of application network access while ensuring the normal operation of the application.

[0031] In order to solve the above problems, the embodiments of the present disclosure provide a network access method, which is introduced below in conjunction with specific embodiments.

[0032] Figure 1 This is a flowchart of a network access method provided by some embodiments of the present disclosure. The method can be executed by a network access device or a system for managing network access to a target application. The device can be implemented by software and / or hardware and can generally be integrated in an electronic device. Figure 1 As shown, the method includes:

[0033] Step 101: Obtain a network access request of a target container group, wherein the target container group belongs to a target workgroup, and the target workgroup includes at least one container group of the same function of a target application.

[0034] Among them, the target application can be an application (Application, APP) where the target workgroup is located, and the target application can contain one or more workgroups (Workerset). The application can be a distributed application in Model as a Service, and the application can also be an application deployed based on Custom Resource Definition (CRD). Optionally, the application can be an application that performs related data processing based on a generative model, or the application can be an application that performs model training based on a generative model. This embodiment does not limit the type of the generative model. For example, the generative model can include one or more of a graph-to-text model, a graph reasoning model, a text-to-graph model, a text-to-text model, and a large language model. The large language model can be a processing model based on natural language. The large language model can learn the rules and structure of natural language, understand the meaning of natural language, and generate coherent text with correct grammar and semantics based on the understood meaning.

[0035] The target workgroup may be the workgroup where the target container group is located. The target workgroup may only include the target container group, or the target workgroup may include the target container group and one or more container groups having the same function as the target container group. The workgroup may be a collection of container groups divided according to the functions of the container groups. The workgroup may be the minimum unit for network access policy management in the embodiment of the present disclosure. For example, a workgroup may be a workgroup with a text map function. It can be understood that if the application is used to implement a task and the task includes multiple subtasks, a container group in a workgroup in the application may be used to implement the same subtask. The target container group may be the container group currently performing network access. The target container group may be the initiator of the network access or the recipient of the network access, which is not limited in this embodiment. The container group may be the minimum scheduling and management unit in the container technology. The network access request may be a request for network access between the container group and the outside of the container group. The network access request may be initiated by the target container group to the outside of the target container group, or the network access request may be initiated by the outside of the target container group to the target container group, which is not limited in this embodiment.

[0036] In some embodiments of the present disclosure, the target application includes multiple workgroups corresponding to multiple functions, and each workgroup includes at least one container group of the same function. In this embodiment, if the target application corresponds to a task, the implementation of the task can be achieved through the collaboration of multiple subtasks, and the subtasks can correspond to functions. The target application can correspond to multiple functions, each function corresponds to a workgroup, and the target application can correspond to multiple workgroups. In addition, each workgroup includes one or more container groups. Figure 2A schematic diagram of a network access process provided by some embodiments of the present disclosure, such as Figure 2 As shown, the visual language model application can correspond to the dialogue management function, the decoding drive function, and the filling drive function. The dialogue management function can be implemented by the dialogue management container group in the dialogue management working group, the decoding drive function can be implemented by the decoding drive container group in the decoding drive working group, and the filling drive function can be implemented by the filling function container group in the filling drive working group.

[0037] It can be understood that the composition structure of the container group in the same application is relatively complex. These container groups can communicate with each other, but the network access requirements of each container group are not the same. For the container groups in the same application, one or more container groups can be divided into corresponding work groups according to the functions of each container group, and the container groups included in a work group are container groups with the same functions. In the embodiment of the present disclosure, the target container group in the target application generates a network access demand during operation, and the target container group can generate and send a network access request, and the network access device obtains the network access request. Alternatively, a network access request for the target container group can be generated in the network, and the network access device obtains the network access request.

[0038] like Figure 2 As shown, the control plane of the virtual private cloud can interact with the data plane of the virtual private cloud (Virtual Private Cloud, VPC) in region 1 and the data plane of the virtual private cloud in region 2. A data plane can be understood as a cluster. The visual language model application of custom resources can be deployed in the data plane of the virtual private cloud in region 1 and the data plane of the virtual private cloud in region 2, respectively. In the data plane of the virtual private cloud in region 1, the visual language model application includes three different workgroups, and the container groups corresponding to the three workgroups can be dialogue processing container groups, decoding driver container groups, and pre-filled driver container groups, respectively. The dialogue processing container group can be used to receive requests from outside the data plane, and connect to the external network to download images or connect to the internal network for resource statistics. The decoding driver container group or the pre-filled container group can receive requests from the dialogue processing container group and perform token processing.

[0039] Step 102: Determine the target network access policy corresponding to the target workgroup.

[0040] The target network access policy may be a network access policy based on which the target workgroup performs network access, and the target network access policy may represent the network access scope of the container group in the target workgroup.

[0041] In the disclosed embodiment, for container groups, container groups with different functions may have corresponding network access requirements, and thus different workgroups may have corresponding network access policies. There are many methods for the network access device to determine the target network access policy, which are not limited in this embodiment. For example, the network access device can obtain the relationship between the workgroup and the network access policy manually configured by the administrator, and query the relationship according to the target workgroup to determine the target network access policy corresponding to the target workgroup. Alternatively, in the case where the workgroup is configured with a network isolation tag, the network access device can determine the target network access policy according to the network isolation tag.

[0042] In some embodiments of the present disclosure, before determining the target network access policy, the network access device may add a corresponding network isolation tag for the workgroup. Specifically, the network access method also includes: in response to the creation operation of the target application, adding corresponding network isolation tags for multiple workgroups included in the target application based on the network isolation relationship library.

[0043] Among them, the creation operation can be an operation to create a target application, and the creation operation can also include the initialization creation of a network access policy. The network access policy is used to define the network access scope or network isolation scope of a workgroup, and can specifically limit the access object by setting the received entry access scope and the sent exit access scope. The access object may include at least one of an external network object, an interactive object of a target container group outside the container orchestration platform, and an internal object of the container orchestration platform. The network access policy can be understood as a network access standard, and the network access policy may include: the Internet Protocol (IP) address and port (Port) of the network request for network access initiated by the container group, and / or the Internet Protocol address and port of the network access received by the container group, etc.

[0044] Optionally, the network isolation relationship library includes multiple network access policies and multiple network isolation tags with a mapping relationship, and each network access policy has a mapping relationship with a network isolation tag. The network isolation tag can be used to identify the network isolation level. In this embodiment, the network isolation relationship library can be a database that records network isolation relationships. The network access policies recorded in the network isolation relationship library can be set according to user needs, etc., and this embodiment does not impose any restrictions. A network isolation relationship can be a mapping relationship between a network access policy and a network isolation tag, and the network access policy and the network isolation tag can be one-to-one corresponding.

[0045] Optionally, the network isolation tag includes multiple levels, and network isolation tags of different levels correspond to network access policies of different isolation degrees. The higher the level, the higher the isolation degree of the corresponding network access policy. Among them, the level can be the level divided inside the network isolation tag. The isolation degree can characterize the isolation degree between the container group and the access object in the network environment. The number of the multiple levels can be set according to the network environment, user needs, etc., and this embodiment does not limit it.

[0046] For example, the multiple levels may include low level, intermediate level, sub-high level, and highest level. Among them, the network access policy corresponding to the low level may be that there is no network isolation, that is, the container group in the task group can arbitrarily access each other with network resources; the network access policy corresponding to the intermediate level can control the access to the external network objects in the external network of the control plane, the interactive objects of the target container group outside the container orchestration platform, and the internal objects of the container orchestration platform; the network access policy corresponding to the sub-high level can control the access to the interactive objects of the target container group outside the container orchestration platform and the internal objects of the container orchestration platform; the network access policy corresponding to the highest level can control the access to the internal objects of the container orchestration platform, or can access the container group with the same namespace as the container group in the cluster and the same application to which it belongs. The network access policy corresponding to the highest level is the most stringent network access policy, which can be understood as the backplane isolation policy.

[0047] In this embodiment, the user can perform a creation operation on the target application, and the network access device creates the target application in response to the creation operation. And in the process of dynamically creating the target application, the network access device can assign a unique application identifier (app-id) to the target, and this embodiment does not limit the specific creation method of the target application. In addition, the network access device can also initialize the creation of the network isolation relationship library in response to the creation operation, and display the network isolation relationship library to the management personnel. The management personnel can determine the network access policy adapted to each workgroup in the network isolation relationship library, and perform a label adding operation on the workgroup according to the network isolation label corresponding to the network access policy. The network isolation device adds the network isolation label to the corresponding workgroup in response to the label adding operation. Among them, the label adding operation can be an operation of adding a network isolation label, and this embodiment does not limit the label adding operation.

[0048] For example, for a distributed application in Model as a Service, you can set corresponding network access policies for different workgroups in the distributed application, thereby effectively reducing the attack surface of network attacks. If the distributed application includes workgroup A, workgroup B, and workgroup C. The network access policy adapted to workgroup A determined by the administrator can be access to external network objects, the network access policy adapted to workgroup B can be access to interactive objects, and the network access policy adapted to workgroup C can be accepting network access sent by container groups in workgroups A and B. Figure 2 For example, in the data plane of the region 2 virtual private cloud, the network access policy of the workgroup where the dialog processing container group is located is to be able to access external network objects, interactive objects, and internal objects. And the network access policy of the decoding driver container group and the pre-filled driver container group is to access internal objects.

[0049] In the above scheme, when creating a target application, the network isolation label of each workgroup in the target application is determined, and the network access policy corresponding to each workgroup is briefly represented by the label, thereby achieving efficient configuration of the network access policy.

[0050] In some embodiments of the present disclosure, determining a target network access policy corresponding to a target workgroup includes: obtaining a target network isolation tag corresponding to the target workgroup, and determining the network access policy corresponding to the target network isolation tag as the target network access policy.

[0051] Among them, the target network isolation tag may be a network isolation tag corresponding to the target workgroup, and the target network isolation tag may be used to identify the network isolation level corresponding to the target workgroup.

[0052] In this embodiment, the network access device can determine the target network isolation tag configured by the target workgroup, and query the network isolation relationship library according to the target network isolation tag to determine the target network access policy corresponding to the target network access policy. Thus, the network access policy corresponding to the workgroup is accurately and efficiently determined based on the network isolation tag, and the network access policy can be reused multiple times based on the network isolation tag, saving the human resources consumed by repeatedly setting the same network access policy.

[0053] Step 103: If it is determined that the target access object corresponding to the network access request matches the target network access policy, an access operation is performed between the target container group corresponding to the network access request and the target access object, wherein the target access object includes at least one of an external network object, an interactive object of the target container group outside the container orchestration platform, and an internal object of the container orchestration platform.

[0054] Among them, the target access object may be an object that performs network interaction with the target container group. In some embodiments of the present disclosure, the target access object includes an entry access object or an exit access object. Among them, the entry access object may be an object that initiates a network access request. The exit access object may be an object that receives a network access request, and the exit access object may be understood as an object being accessed. The access operation may be an access operation between the target container group and the target access object. The access operation may include an operation of the target container group accessing the target access object, and may also include an operation of the target access object accessing the target container group. The external network (Extranet) object may be an object located in an external network, and the external network may be a network outside the container orchestration platform where the target container group is located. The external network may be understood as the Internet or an open network that allows public access, and the external network is also called an external network.

[0055] The interactive object of the target container group outside the container orchestration platform may be an object that does not belong to the management scope of the container orchestration platform where the target container group is located, but can interact with the target container group in some way. For example, the interactive object may include resources, servers or databases outside the container orchestration platform that are in the same virtual local area network (Virtual Private Cloud, VPC) as the target container group. The interactive object may be an object pre-divided for the target container group outside the container orchestration platform. For example, the interactive object may be an object in a specific intranet outside the container orchestration platform. This embodiment does not limit the functions implemented by the interactive object. For example, the interactive object can be used to implement audit services, video on demand (VOD) and other services. Based on the interactive object, the scope of access can be controlled while achieving network access to objects outside the container orchestration platform.

[0056] The internal object of the container orchestration platform may be an object located in the internal network (Intranet) of the container orchestration platform, and the internal network may be a network environment constructed in the container orchestration platform. This embodiment does not limit the internal object. For example, Figure 3 A schematic diagram of another network access process provided by some embodiments of the present disclosure, the internal object can be Figure 3 The target container group can interact with the model proxy.

[0057] In the disclosed embodiment, after determining the target network access policy, the network access device can perform the access operation between the target container group and the target access object according to the network location of the target access object corresponding to the network access request, if the network location matches the target network access policy. If the network location does not match the target network access policy, the access operation between the target container group and the target access object is rejected.

[0058] In some embodiments of the present disclosure, determining whether a target access object corresponding to a network access request matches a target network access policy includes: matching object information of the target access object corresponding to the network access request with entry access information and exit access information included in the target network access policy; if the matching result is that the entry access information or the exit access information includes the object information of the target access object, determining that the target access object matches the target network access policy.

[0059] Among them, the object information can be used to record the network location of the target access object, and the object information may include the Internet Protocol address, port, etc. of the network location of the target access object. The ingress access information can be used to record the receiving scope of the target container group when receiving network access, which can be understood as the scope of external access that the target container group can receive. The egress access information can be used to record the access scope of the target container group when conducting external network access, which can be understood as the scope of external access that the target container group can initiate.

[0060] In this embodiment, the network access device can determine the object information of the target access object according to the network access request. If the network access request is received by the target container group, the object information is matched with the entry access information. If the entry access information contains the object information, it is determined that the target access object successfully matches the target network access policy. If the entry access information does not contain the object information, it is determined that the target access object fails to match the target network access policy. If the network access request is sent by the target container group, the object information is matched with the exit access information. If the exit access information contains the object information, it is determined that the target access object successfully matches the target network access policy. If the exit access information does not contain the object information, it is determined that the target access object fails to match the target network access policy.

[0061] In the above scheme, for different scenarios of initiating network access requests and receiving network access requests for the target container group, it is determined whether the target access object matches the corresponding network access policy through the corresponding access information, so that the network access method can cover various network scenarios of initiating requests and receiving requests.

[0062] In some embodiments of the present disclosure, an access operation between a target container group and a target access object corresponding to a network access request is performed, including: when the network access request comes from an entry access object, the network access request is sent to the target container group to perform the access operation of the entry access object; when the network access request comes from the target container group, the network access request is sent to the exit access object to perform the access operation of the target container group.

[0063] In this embodiment, after determining that the entry access information includes the object information of the target access object, if the network access request is sent from the entry access object to the target container group, the network access request is sent to the target container group to implement the entry access object to the target container group access operation. After determining that the exit access information includes the object information of the target access object, if the network access request is sent from the target container group to the exit access object, the network access request is sent to the exit access object to implement the target container group to the exit access object operation. Thus, the access operation is implemented when the network access policy allows the network access.

[0064] like Figure 3 As shown, the graph-generated text application and the text-generated graph application can be deployed through custom resources. The deployed graph-generated text application, text-generated graph application and other applications can receive the traffic sent by the model proxy or send traffic to the model proxy, and the model proxy can be a control plane. The graph-generated text application can include a graph-generated text workgroup and its corresponding reasoning workgroup, and the graph-generated text workgroup includes a graph-generated text container group, and the reasoning workgroup includes multiple reasoning container groups. The text-generated graph application can include a text-generated graph workgroup and its corresponding reasoning workgroup, and the text-generated graph workgroup includes a text-generated graph container group, and the reasoning workgroup includes multiple reasoning container groups. In addition, other custom resource applications or deployed applications can be used to provide headless reasoning services, and the other custom resource applications or deployed applications include a reasoning workgroup, and the reasoning workgroup includes multiple reasoning container groups, and the reasoning container group can directly receive traffic from the model proxy. In addition, if there are multiple applications, the container groups between different applications do not communicate directly, for example, the container group in the graph-generated text application does not communicate directly with the container group in the text-generated graph application, that is, there is network isolation between the two container groups.

[0065] and, Figure 3The network isolation labels corresponding to the Chinese-Chinese ...

[0066] The network access scheme provided by the embodiment of the present disclosure obtains the network access request of the target container group, wherein the target container group belongs to the target workgroup, and the target workgroup includes at least one container group of the same function of the target application; determines the target network access policy corresponding to the target workgroup; if it is determined that the target access object corresponding to the network access request matches the target network access policy, then performs the access operation between the target container group corresponding to the network access request and the target access object, wherein the target access object includes at least one of an external network object, an interactive object of the target container group outside the container orchestration platform, and an internal object of the container orchestration platform. Adopting the above technical scheme, for the network access request of the target container group in the target workgroup of the target application, access is allowed when the network access policy corresponding to the target workgroup matches the target access object corresponding to the target access request, by dividing the container groups with the same function in the same application into corresponding workgroups, and setting different network access policies for different workgroups, since the network access policy can control the access of external network objects, interactive objects and / or internal objects, a more fine-grained network access management with different isolation degrees is realized within the application, which can not only meet the actual access needs of different container groups, but also ensure the security of network access. In addition, by making network access control finer than the application and coarser than the container group, the security of the network access process is efficiently guaranteed while meeting the normal network access needs of the application with appropriate granularity, and the network security of the target application is improved based on smaller resource overhead.

[0067] In the disclosed embodiment, corresponding network access policies are set for different workgroups of the same application. However, because different workgroups need to communicate with each other. For example, if there are workgroup A and workgroup B in the application, the network access policy of workgroup A includes access to external network objects, and workgroup B does not have this access right, but workgroup B can communicate with workgroup A, although theoretically workgroup B can access external network objects through workgroup A. However, from an engineering perspective, only when workgroup A and workgroup B are both compromised can controlled external network access be performed, which improves the security of network access compared to related technologies. In addition, in response to this situation, the network access device can limit the access operation of workgroup A through network detection and other methods, thereby further reducing the risks generated by network access.

[0068] In some embodiments of the present disclosure, the network access method further includes: performing network access detection and / or label anomaly detection on a container group to be detected of a target application, wherein the container group to be detected belongs to a work group to be detected, and the work group to be detected corresponds to a network access policy that supports access to external network objects and interactive objects.

[0069] The detection program may be used to detect whether there is an abnormality in the container group to be detected. The work group to be detected may be a work group including the container group to be detected. The container group to be detected may be a container group to be subjected to network access detection and / or label abnormality detection, and the container group to be detected may be a container group authorized to perform network access with external network objects and interactive objects.

[0070] Network access detection can be used to detect whether there is abnormal access in the network access process of the container group to be detected. This embodiment does not limit the abnormal access. For example, the abnormal access may include one or more of access to an abnormal Internet Protocol address, access to an abnormal port, and access to an abnormal resource. Taking the abnormal access as an access network to an abnormal resource as an example, the network access detection can determine whether the resource type transmitted during the access process belongs to the target type. The target type can be the resource type of the resource transmitted during the actual operation of the container group to be detected. The actual operation can be understood as the operation of the container group to be detected without security anomalies. This embodiment does not limit the resource type. For example, the resource type can include pictures, videos, audio, etc. Taking the container group to be detected as a visual language model container group as an example, the target type corresponding to the visual language model container group can be a picture type. Through the network access detection, it can be detected whether there is an abnormality in the traffic sent and / or received by the container group to be detected.

[0071] In this embodiment, the network access device can perform a network access detection on the container group to be tested through a detection program. If the network access detection fails, a network access abnormality warning is issued. Specifically, taking the detection of access to abnormal resources as an example, the network access device can detect whether the resource type of the transmission resources during the actual operation of the container group to be tested belongs to the target type. If so, it is determined that the container group to be tested has passed the network access detection. Otherwise, it is determined that the container group to be tested has not passed the network access detection, and a corresponding warning is issued. For example, the target type corresponding to the visual language model container group can be a picture type. If the resource type of the resource transmitted by the visual language model container group is not a picture type, it is determined that the container group has not passed the network access detection.

[0072] Label anomaly detection can be used to detect whether the access range corresponding to the network isolation label of the work group to be detected matches the target access range. The target access range can be the network range that the container group to be detected in the work group to be detected actually needs to access during operation. This label anomaly detection can be used to perform closer detection for the work group to be tested that supports access to external network objects and / or interactive objects.

[0073] In this embodiment, the network access device can perform label anomaly detection on the container group to be tested through a detection program. If the network access detection fails, a label anomaly warning is issued. Specifically, the network access device can detect whether the access range of the network isolation label corresponding to the container group to be tested belongs to the target access range. If so, it is determined that the container group to be tested passes the label anomaly detection. Otherwise, it is determined that the container group to be tested does not pass the label anomaly detection and a corresponding warning is issued. For example, for a container group that implements pure reasoning, access to internal objects can meet the access requirements for the normal operation of the container group to be tested, so the corresponding target access range can be an internal object. If the access range corresponding to the network isolation label includes interactive objects or external network objects, it is determined that the container group to be tested does not pass the label anomaly detection. Thus, it is determined through detection whether the working group to be tested adds network isolation labels according to its actual needs.

[0074] Optionally, the network access device may also detect and analyze the traffic data sent by the container group to be tested through a data loss protection program.

[0075] Figure 4 A schematic diagram of a network access method provided by some embodiments of the present disclosure, such as Figure 4As shown, first, the network isolation relationship library of the target application is initialized. Specifically, the network isolation relationship library can be pre-set with the correspondence between the network access policy and the network isolation tag, and the network isolation tag can include the levels of low level, intermediate level, sub-high level, high level, etc. Further, in the target application, the corresponding network isolation tag is added to the work group in the target application, so as to realize the configuration of the corresponding network for different work groups. Further, after the target application is deployed, the network access policy of each work group in the target application takes effect. Specifically, the container group to be detected in the application is detected by the detection program, and the detection includes: network access detection of the container group corresponding to the intermediate network isolation tag and the sub-high level network isolation tag; detection of whether the intermediate network isolation tag and the sub-high level network isolation tag are incorrectly identified on the work group to be detected; logging the operation of the network isolation tag, and regularly automatically or manually detecting the log. Further, the application is terminated, and the termination of the application can be understood as the destruction of the application.

[0076] In the above scheme, network access detection is used to focus on detecting the network behavior of container groups in workgroups with loose network isolation, and to promptly trace the risks after the container group is breached. Through label anomaly detection, the network isolation labels of workgroups are effectively and dynamically detected, reducing the probability of abuse of network isolation labels with loose network isolation. In addition, changes and adjustments of network isolation labels are recorded in security logs, so that changes in network isolation labels can be traced back.

[0077] Next, the network access method in the embodiment of the present disclosure is further described by a specific example. The application of the network access method can provide corresponding services based on the control plane. Figure 5 A schematic diagram of the control plane architecture provided for some embodiments of the present disclosure. The data plane model can be used as a service to implement model as a service. The data plane can mainly undertake large models from various model suppliers, and then use these models to provide services such as reasoning and fine-tuning. In essence, model as a service is platform as a service (PaaS).

[0078] Among them, the data plane relies on Infrastructure as a Service (IaaS), and the data plane can have a corresponding software stack. The software stack can be scheduled and deployed as a service container group on the governed cloud server (Elastic Compute Service, ECS) node. In response to the user's scheduling, it will be scheduled accordingly according to the scheduler. Figure 5There are multiple user container groups (User Pod) and service container groups (Service Pod) in the Elastic Compute Service Virtual Machine (ECS VM).

[0079] Usually, the tasks related to Model as a Service can be divided into reasoning tasks and training tasks (for example, dynamic fine-tuning tasks), etc. And there are three roles in this task: cloud service provider, model provider, and user.

[0080] Specifically, a cloud service provider provides cloud services (for example, infrastructure as a service or platform as a service) to serve entities of different model suppliers. Model suppliers own large models and use cloud service providers to build their own entities for services such as reasoning tasks. Users are entities that run applications provided by cloud service providers and model suppliers. Users have corresponding network environment isolation requirements for model suppliers and cloud service providers. Specifically, when a user obtains a model as a service from a cloud service provider, the user hopes that his or her tasks can run in an isolated network environment such as a security sandbox. The security sandbox can achieve security enhancements in terms of computing, networking, storage, etc. The security sandbox can be designed based on a protection mechanism for privacy or confidential computing, and the network access method provided in the embodiments of the present disclosure can be applied to the security sandbox.

[0081] In some embodiments of the present disclosure, the network access method may include: first, for a distributed application of model as a service, setting corresponding network access policies for different workgroups in the application, thereby effectively reducing the attack surface. For example, if the application includes three workgroups, workgroup A, workgroup B, and workgroup C. Workgroup A can access external network objects, workgroup B can access interactive objects, and workgroup C can receive network access from workgroup A and workgroup B. Specifically, multiple network access policies can be pre-defined, and when different workgroups are configured before the application is started, the workgroups are marked with corresponding network isolation tags. Corresponding network access policies are provided for different network isolation tags.

[0082] Furthermore, the container groups in the workgroups with the intermediate network isolation tags and the container groups in the workgroups with the next higher network isolation tags are more closely checked. Specifically, it is possible to check whether the container groups have abnormal traffic and check the traffic of the container groups through the data loss prevention program.

[0083] Furthermore, in the container orchestration platform, it is detected whether the workgroup of each application program has added a network isolation tag according to the corresponding requirements of the workgroup. If an abnormal network isolation tag is found, a timely alarm is processed for the network isolation tag.

[0084] The network access solution provided by the embodiment of the present disclosure sets a more fine-grained network access policy for the workgroup in an application on the basis of network isolation between container groups of different applications, so that the application has higher network security when it is running normally. In addition, while meeting the requirements of model-as-a-service in the update and iteration dimensions, it still provides a higher level of network isolation protection, protects user data from leaking out of the security sandbox, and improves network security.

[0085] Figure 6 This is a schematic diagram of the structure of a network access device provided in some embodiments of the present disclosure. The device can be implemented by software and / or hardware and can generally be integrated into an electronic device. Figure 6 As shown, the device comprises:

[0086] An acquisition module 601 is used to acquire a network access request of a target container group, wherein the target container group belongs to a target workgroup, and the target workgroup includes at least one container group of the same function of a target application;

[0087] A determination module 602 is used to determine a target network access policy corresponding to the target workgroup;

[0088] An execution module 603 is used to execute an access operation between the target container group corresponding to the network access request and the target access object if it is determined that the target access object corresponding to the network access request matches the target network access policy, wherein the target access object includes at least one of an external network object, an interactive object of the target container group outside the container orchestration platform, and an internal object of the container orchestration platform.

[0089] In some embodiments of the present disclosure, the target application includes multiple workgroups corresponding to multiple functions, each of the workgroups includes at least one container group with the same function, and the network access device further includes:

[0090] An adding module is used to add corresponding network isolation tags for multiple workgroups included in the target application based on a network isolation relationship library in response to a creation operation of the target application.

[0091] In some embodiments of the present disclosure, the network isolation relationship library includes a plurality of network access policies and a plurality of network isolation tags having a mapping relationship, and each of the network access policies has a mapping relationship with one of the network isolation tags.

[0092] In some embodiments of the present disclosure, the network isolation tag includes multiple levels, and network isolation tags of different levels correspond to network access policies with different isolation levels. The higher the level, the higher the isolation level of the corresponding network access policy.

[0093] In some embodiments of the present disclosure, the determination module 602 specifically includes:

[0094] A target network isolation tag corresponding to the target workgroup is obtained, and a network access policy corresponding to the target network isolation tag is determined as the target network access policy.

[0095] In some embodiments of the present disclosure, determining that the target access object corresponding to the network access request matches the target network access policy includes:

[0096] Matching the object information of the target access object corresponding to the network access request with the ingress access information and egress access information included in the target network access policy;

[0097] If the matching result is that the ingress access information or the egress access information includes the object information of the target access object, it is determined that the target access object matches the target network access policy.

[0098] In some embodiments of the present disclosure, the target access object includes an entry access object or an exit access object, and the performing of the access operation between the target container group corresponding to the network access request and the target access object includes:

[0099] When the network access request comes from the entry access object, sending the network access request to the target container group to perform an access operation on the entry access object;

[0100] When the network access request comes from the target container group, the network access request is sent to the egress access object to perform an access operation on the target container group.

[0101] In some embodiments of the present disclosure, the network access device further includes:

[0102] A detection module is used to perform network access detection and / or label anomaly detection on the container group to be detected of the target application, wherein the container group to be detected belongs to a work group to be detected, and the work group to be detected corresponds to a network access policy that supports access to external network objects and interactive objects.

[0103] The network access device provided in the embodiments of the present disclosure can execute the network access method provided in any embodiment of the present disclosure, and has the corresponding functional modules and beneficial effects of the execution method.

[0104] An embodiment of the present disclosure provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned network access method when executed by a processor.

[0105] Figure 7 A schematic diagram of the structure of an electronic device provided for some embodiments of the present disclosure.

[0106] The following specific reference Figure 7 , which shows a schematic diagram of the structure of an electronic device 700 suitable for implementing the embodiment of the present disclosure. The electronic device 700 in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0107] like Figure 7 As shown, the electronic device 700 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 are also stored. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0108] Typically, the following devices may be connected to the I / O interface 705: an input device 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 708 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 709. The communication device 709 may allow the electronic device 700 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7 The electronic device 700 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0109] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 709, or installed from the storage device 708, or installed from the ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the network access method of the embodiment of the present disclosure are executed.

[0110] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0111] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0112] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0113] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains a network access request of a target container group, wherein the target container group belongs to a target workgroup, and the target workgroup includes at least one container group of the same function of a target application; determines a target network access policy corresponding to the target workgroup; if it is determined that a target access object corresponding to the network access request matches the target network access policy, performs an access operation between the target container group corresponding to the network access request and the target access object, wherein the target access object includes at least one of an external network object, an interactive object of the target container group outside a container orchestration platform, and an internal object of the container orchestration platform.

[0114] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0115] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0116] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0117] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0118] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0119] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0120] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0121] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0122] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A network access method, characterized in that: include: Obtaining a network access request of a target container group, wherein the target container group belongs to a target workgroup, and the target workgroup includes at least one container group of the same function of a target application; Determine a target network access policy corresponding to the target workgroup; If it is determined that the target access object corresponding to the network access request matches the target network access policy, an access operation between the target container group corresponding to the network access request and the target access object is performed, wherein the target access object includes at least one of an external network object, an interactive object of the target container group outside the container orchestration platform, and an internal object of the container orchestration platform.

2. The method according to claim 1, characterized in that The target application includes a plurality of workgroups corresponding to a plurality of functions, each of the workgroups includes at least one container group of the same function, and the method further includes: In response to the creation operation of the target application, corresponding network isolation tags are added to the multiple workgroups included in the target application based on the network isolation relationship library.

3. The method according to claim 2, characterized in that The network isolation relationship library includes a plurality of network access policies and a plurality of network isolation tags having a mapping relationship, and each of the network access policies has a mapping relationship with one of the network isolation tags.

4. The method according to claim 2, characterized in that: The network isolation tag includes multiple levels. Network isolation tags of different levels correspond to network access policies with different isolation levels. The higher the level, the higher the isolation level of the corresponding network access policy.

5. The method according to claim 2, characterized in that: Determining a target network access policy corresponding to the target workgroup includes: A target network isolation tag corresponding to the target workgroup is obtained, and a network access policy corresponding to the target network isolation tag is determined as the target network access policy.

6. The method according to claim 1, characterized in that Determining that the target access object corresponding to the network access request matches the target network access policy includes: Matching the object information of the target access object corresponding to the network access request with the ingress access information and egress access information included in the target network access policy; If the matching result is that the ingress access information or the egress access information includes the object information of the target access object, it is determined that the target access object matches the target network access policy.

7. The method according to claim 1, characterized in that The target access object includes an entry access object or an exit access object, and the performing of the access operation between the target container group corresponding to the network access request and the target access object includes: When the network access request comes from the entry access object, sending the network access request to the target container group to perform an access operation on the entry access object; When the network access request comes from the target container group, the network access request is sent to the egress access object to perform an access operation on the target container group.

8. The method according to claim 1, characterized in that: The method further comprises: A network access detection and / or label anomaly detection is performed on the container group to be detected of the target application, wherein the container group to be detected belongs to a work group to be detected, and the work group to be detected corresponds to a network access policy that supports access to external network objects and interactive objects.

9. A network access device, characterized in that: include: an acquisition module, configured to acquire a network access request of a target container group, wherein the target container group belongs to a target workgroup, and the target workgroup includes at least one container group of the same function of a target application; A determination module, used to determine a target network access policy corresponding to the target workgroup; An execution module is configured to execute an access operation between the target container group corresponding to the network access request and the target access object if it is determined that the target access object corresponding to the network access request matches the target network access policy, wherein the target access object includes at least one of an external network object, an interactive object of the target container group outside the container orchestration platform, and an internal object of the container orchestration platform.

10. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the network access method described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the network access method described in any one of claims 1 to 8.

Images