Layered security isolation method and device based on cloud native architecture and computer equipment

Abstract

The invention relates to a hierarchical security isolation method and device based on a cloud native architecture and computer equipment. The method comprises the steps of performing resource isolation on a storage layer and a computing layer in the bottom layer, performing communication isolation on a network layer in the bottom layer, deploying a plurality of security platforms for the application layer, performing application isolation on applications in the application layer based on the plurality of security platforms, and configuring a plurality of container security groups for the container layer, and performing service isolation on each service of the application based on the plurality of container security groups, thereby improving the security and stability of the cloud native architecture.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a layered security isolation method, apparatus, computer device, computer-readable storage medium, and computer program product based on a cloud-native architecture. Background Art

[0002] Cloud Native is a method of building and running applications that takes advantage of the elasticity and distributed nature of cloud computing. Cloud Native Security is actually a security approach for cloud native applications and infrastructure. It covers the entire life cycle from application development to deployment and operation, and aims to ensure the security of data, applications, and infrastructure in cloud native environments.

[0003] Cloud-native applications are built on core technologies such as containers, microservices, and serverless computing. These technologies bring high flexibility and scalability to applications, but also introduce new security challenges. As cloud-native applications continue to increase, security issues have become more prominent. It is difficult to obtain effective nodes for issues such as secure isolation of containers and secure communication between services, and it is impossible to ensure the secure operation of cloud-native architectures. Summary of the invention

[0004] The embodiments of the present application provide a layered security isolation method, apparatus, computer equipment, computer-readable storage medium, and computer program product based on a cloud-native architecture, which can ensure the secure operation of the cloud-native architecture.

[0005] On the one hand, the present application provides a layered security isolation method based on a cloud native architecture, wherein the cloud native architecture includes a bottom layer, an application layer, and a container layer, and the method includes:

[0006] Performing resource isolation on the storage layer and the computing layer in the bottom layer, and performing communication isolation on the network layer in the bottom layer;

[0007] Deploy multiple security platforms on the application layer, and perform application isolation on the applications in the application layer based on the multiple security platforms;

[0008] A plurality of container security groups are configured for the container layer, and service isolation is performed on each service of the application based on the plurality of container security groups.

[0009] On the other hand, the present application also provides a layered security isolation device based on a cloud native architecture, wherein the cloud native architecture includes a bottom layer, an application layer, and a container layer, and the device includes:

[0010] A bottom layer isolation module, used to perform resource isolation on the storage layer and computing layer in the bottom layer, and to perform communication isolation on the network layer in the bottom layer;

[0011] An application isolation module, used to deploy multiple security platforms on the application layer, and perform application isolation on the applications in the application layer based on the multiple security platforms;

[0012] The service isolation module is used to configure multiple container security groups for the container layer and isolate the services of the application based on the multiple container security groups.

[0013] On the other hand, the present application also provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0014] Perform resource isolation on the storage layer and the computing layer in the bottom layer, and perform communication isolation on the network layer in the bottom layer;

[0015] Deploy multiple security platforms on the application layer, and perform application isolation on the applications in the application layer based on the multiple security platforms;

[0016] A plurality of container security groups are configured for the container layer, and service isolation is performed on each service of the application based on the plurality of container security groups.

[0017] On the other hand, the present application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0018] Perform resource isolation on the storage layer and the computing layer in the bottom layer, and perform communication isolation on the network layer in the bottom layer;

[0019] Deploy multiple security platforms on the application layer, and perform application isolation on the applications in the application layer based on the multiple security platforms;

[0020] A plurality of container security groups are configured for the container layer, and service isolation is performed on each service of the application based on the plurality of container security groups.

[0021] On the other hand, the present application also provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0022] Perform resource isolation on the storage layer and the computing layer in the bottom layer, and perform communication isolation on the network layer in the bottom layer;

[0023] Deploy multiple security platforms on the application layer, and perform application isolation on the applications in the application layer based on the multiple security platforms;

[0024] A plurality of container security groups are configured for the container layer, and service isolation is performed on each service of the application based on the plurality of container security groups.

[0025] The above-mentioned layered security isolation method, apparatus, computer equipment, computer-readable storage medium and computer program product based on cloud-native architecture, by performing resource isolation on the storage layer and computing layer in the bottom layer of the cloud-native architecture and communication isolation on the network layer in the bottom layer, deploying multiple security platforms on the application layer, performing application isolation on the applications in the application layer based on the multiple security platforms, and configuring multiple container security groups on the container layer, performing service isolation on each service of the application based on the multiple container security groups, can thereby perform security isolation on the bottom layer, application layer and container layer of the cloud-native architecture in a layered decoupling manner, thereby ensuring secure isolation between containers and secure communication between services in the cloud-native architecture, thereby effectively ensuring the safe operation of the cloud-native architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 This is an application environment diagram of a layered security isolation method based on a cloud native architecture in one embodiment;

[0028] Figure 2 It is a flowchart of a layered security isolation method based on cloud native architecture in one embodiment;

[0029] Figure 3 The following is a schematic diagram of the architecture of a layered security isolation method based on a cloud native architecture in one embodiment;

[0030] Figure 4 A schematic diagram of an isolation policy configuration interface in one embodiment;

[0031] Figure 5 is a schematic diagram of a network monitoring interface in one embodiment;

[0032] Figure 6 It is a structural block diagram of a layered security isolation device based on a cloud native architecture in one embodiment;

[0033] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0035] The layered security isolation method based on cloud native architecture provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the cloud server 104 through the network. The data storage system can store the data that the cloud server 104 needs to process. The data storage system can be integrated on the cloud server 104, or it can be placed on the cloud or other network servers. The cloud native architecture is deployed on the terminal 102, and the cloud native architecture runs on the cloud server 104. The cloud native architecture includes the bottom layer, the application layer and the container layer. The cloud server 104 performs resource isolation on the storage layer and the computing layer in the bottom layer, and performs communication isolation on the network layer in the bottom layer. The cloud server 104 deploys multiple security platforms for the application layer, and performs application isolation on the applications in the application layer based on multiple security platforms. The cloud server 104 configures multiple container security groups for the container layer, and performs service isolation on each service of the application based on multiple container security groups. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The cloud server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0036] In one embodiment, Figure 2 As shown, a layered security isolation method based on a cloud native architecture is provided. The cloud native architecture includes a bottom layer, an application layer, and a container layer. The method is applied to a computer device (computer device such as Figure 1 The terminal or server in the example is used to illustrate, including the following steps:

[0037] Step 202, performing resource isolation on the storage layer and computing layer in the bottom layer, and performing communication isolation on the network layer in the bottom layer.

[0038] The cloud-native architecture includes the physical layer, virtualization layer, platform layer, and application layer. The bottom layer is also called the physical layer.

[0039] The physical layer includes all hardware resources, such as servers, storage devices, network devices and other infrastructure. The virtualization layer is responsible for abstracting physical resources and converting them into virtual resources, thereby improving resource utilization and flexibility. The platform layer provides an operating environment that allows developers to quickly develop, deploy and manage applications. The application layer is software applications that meet various business needs.

[0040] The bottom layer includes the storage layer, computing layer and network layer, which together constitute the basic operating environment of the computer system.

[0041] The storage layer is an important part of the computer system, used to store data and files. The storage layer can be devices such as hard disk arrays and tape libraries, or virtualized storage solutions such as cloud storage. The performance and reliability of the storage layer directly affect the data storage capacity and data security of the computer system.

[0042] The computing layer is the core part of the computer system, including hardware components such as processors and memory. The processor is responsible for performing computing tasks, and the memory is used to temporarily store data and instructions to ensure that the computer can run various programs and applications efficiently. The performance and stability of the computing layer have an important impact on the overall performance of the computer system.

[0043] The network layer is a key part of the computer system's communication with the outside world, including network access devices such as network interface cards and routers. The network layer is responsible for handling the transmission and reception of data packets, ensuring that the computer can communicate with other devices or networks. The stability and security of the network layer is crucial to the data transmission and remote access of the computer system.

[0044] Specifically, the storage layer in the bottom layer includes all hardware resources, and the computer device can divide the storage layer and computing layer in the bottom layer into multiple isolation domains respectively, so that each isolation domain includes a part of the hardware resources, thereby isolating all the hardware resources of the storage layer through multiple isolation domains.

[0045] The network layer in the bottom layer includes network access devices such as network interface cards and routers. Computer equipment divides the network layer into multiple isolation domains. Each isolation domain includes a part of network access devices. All network access devices in the network layer are isolated through multiple isolation domains, so that each isolation domain uses its own network access device to communicate with the outside world, thereby realizing communication isolation between isolation domains.

[0046] In this embodiment, by isolating resources of the storage layer and computing layer in the bottom layer and isolating communications of the network layer in the bottom layer, the stability and operating performance of the bottom layer components can be guaranteed, thereby ensuring the overall operation of the cloud native architecture.

[0047] Step 204: deploy multiple security platforms on the application layer, and perform application isolation on the applications in the application layer based on the multiple security platforms.

[0048] Specifically, the application layer may have multiple applications. The computer device deploys multiple security platforms at the application layer, each security platform is used to process the relevant data of an application, so that the construction of multiple applications in the application layer is isolated from each other, forming application isolation.

[0049] Step 206: Configure multiple container security groups for the container layer, and perform service isolation for each service of the application based on the multiple container security groups.

[0050] Specifically, the container layer has multiple containers, each of which can handle one service. The computer device configures multiple container security groups at the container layer, configures one container security group for each container, so that one container security group manages one service, and multiple services are isolated from each other through security containers.

[0051] The above-mentioned layered security isolation method based on cloud native architecture includes a bottom layer, an application layer and a container layer. By isolating resources in the storage layer and the computing layer in the bottom layer of the cloud native architecture and isolating communication in the network layer in the bottom layer, deploying multiple security platforms in the application layer, isolating applications in the application layer based on multiple security platforms, and configuring multiple container security groups in the container layer. Based on multiple container security groups, service isolation is performed on each service of the application. In this way, the bottom layer, application layer and container layer of the cloud native architecture can be securely isolated in a layered decoupling manner, thereby ensuring secure isolation between containers and secure communication between services in the cloud native architecture, thereby effectively ensuring the safe operation of the cloud native architecture.

[0052] In one embodiment, communication isolation is performed on the network layer in the bottom layer, including:

[0053] Multiple networks are allocated to the network layer in the bottom layer, and communication isolation is performed based on the multiple networks.

[0054] Specifically, the computer device divides the network layer in the bottom layer into multiple isolation domains and allocates a network to each isolation domain, so that the application or service in each isolation domain uses the network in the isolation domain to which it belongs for internal communication and communication with the outside of the isolation domain, thereby realizing communication isolation between multiple isolation domains.

[0055] In one embodiment, a private network (Virtual Private Cloud, VPC) is allocated to each isolation domain, and applications or services in each isolation domain use the private network in the isolation domain to which it belongs for internal or external communication.

[0056] In this embodiment, multiple networks are allocated to the network layer in the bottom layer, and communication isolation is performed based on the multiple networks, so that the communication security and communication stability of the network layer can be improved through communication isolation.

[0057] In one embodiment, service isolation includes access isolation; configuring a container security group for the container layer, and performing service isolation on each service of the application based on the container security group, including:

[0058] For each application in the container layer, a container security group is configured for each service of the targeted application; an access port is set for the corresponding service based on each container security group, and access to each service is isolated through each access port.

[0059] Specifically, for each application in the container layer, the computer device determines the service corresponding to each application and configures a container security group for each server. For each service, an access port is set for the service based on the container security group of the service to isolate the access ports used by each service and reduce data exposure caused by each service using the same port for communication.

[0060] like Figure 3 As shown, it is an architectural diagram of a layered security isolation method based on a cloud native architecture in one embodiment. Private network 1 and private network 2 are provided at the network layer. Private network 1 includes a security platform, a service grid port, and a container security group, and private network 2 includes a security platform, a service grid port, and a container security group. The security platform in private network 1 is used to maintain the operating environment of the services in private network 1, and the security platform in private network 1 is used to maintain the operating environment of the services in private network 2.

[0061] The security platform is deployed in a federated cluster mode within a private network to avoid cluster access across private networks and reduce data exposure to the network layer. At the same time, the security platform performs real-time detection of service network activities, asset components, images, container runtimes, etc., and reinforces the security of the application layer to ensure the security and stability of the operating environment.

[0062] When services in private network 1 and services in private network 2 need to communicate, they can communicate through the service mesh port of private network 1 and the service mesh port of private network 2, thereby achieving communication isolation on the network.

[0063] When the services managed by container security group 1 in VPC 1 and the services managed by container security group 1 in VPC 2 need to call each other, this can be achieved through container security group 1 in VPC 1 and container security group 1 in VPC 2.

[0064] When the services managed by container security group 2 in private network 1 and the services managed by container security group 2 in private network 2 need to call each other, this can be achieved through container security group 2 in private network 1 and container security group 2 in private network 2, making the calls between services more secure.

[0065] It is understandable that the service in private network 1 and the service in private network 2 may be different services under the same application, or may be services of different applications.

[0066] In this embodiment, for each application in the container layer, a container security group is configured for each service of the application, an access port is set for the corresponding service based on each container security group, and access to each service is isolated through each access port, which can improve the security of access between services in the container layer.

[0067] In one embodiment, the method further comprises:

[0068] Display the isolation policy configuration interface; in response to the policy configuration operation triggered in the isolation policy configuration interface, obtain the configuration information generated by the policy configuration operation; in response to the policy configuration completion operation triggered in the isolation policy configuration interface, display the network isolation policy generated based on the policy configuration information in the isolation policy configuration interface.

[0069] Specifically, the computer device displays an isolation policy configuration interface, and displays a policy configuration control on the isolation policy configuration interface. A user can trigger the policy configuration control to configure the network isolation policy.

[0070] The computer device responds to the triggering operation on the policy configuration control and displays the isolation policy configuration interface in the editing state. The user can edit the relevant configuration information in the isolation policy configuration interface in the editing state. The computer device responds to the configuration operation triggered in the isolation policy configuration interface in the editing state and obtains the configuration information generated by the configuration operation. The configuration information may include the identifier, namespace, entry, port number of the entry, exit and port number of the exit of the network isolation policy. Among them, the identifier can be the name of the network isolation policy.

[0071] After the configuration is completed, the user can trigger the policy configuration completion operation in the isolation policy configuration interface in the editing state. In response to the policy configuration completion operation, the computer device generates a network isolation policy according to the configuration information and displays the generated network isolation policy in the isolation policy configuration interface.

[0072] like Figure 4As shown, it is a schematic diagram of the isolation policy configuration interface in one embodiment. The user can click the "Add Network Policy" policy configuration control to display the editable isolation policy configuration interface, in which the configuration information such as name, namespace, inlet, inlet port number, outlet and outlet port number can be edited. After editing, click OK to generate the network isolation policy, and the generated network isolation policy will be displayed in this interface.

[0073] In one embodiment, a search control may also be displayed in the isolation policy configuration interface. By clicking the search control, candidate network isolation policies may be searched, so that users may directly select the network isolation policy they want to use from pre-configured candidate network isolation policies without having to configure it themselves.

[0074] In one embodiment, by clicking the search control, you can search for at least one of the following information: name, namespace, inlet, inlet port number, outlet, and outlet port number. You can select the configuration information you want to use from the existing configuration information without having to fully configure it yourself, thereby increasing the speed of network isolation policy configuration.

[0075] In one embodiment, the computer device displays isolation types of multiple network isolation policies in response to a type selection operation triggered in the isolation policy configuration interface. In response to a selection operation from multiple isolation types, the isolation type selected by the selection operation is determined. In response to a policy configuration operation triggered in the isolation policy configuration interface, configuration information for the selected isolation type generated by the policy configuration operation is obtained. In response to a policy configuration completion operation triggered in the isolation policy configuration interface, a network isolation policy for the selected isolation type is generated based on the configuration information for the selected isolation type.

[0076] In this embodiment, a visual isolation policy configuration interface is improved, and in response to a policy configuration operation triggered in the isolation policy configuration interface, configuration information generated by the policy configuration operation is obtained. In response to a policy configuration completion operation triggered in the isolation policy configuration interface, a network isolation policy generated based on the policy configuration information is displayed in the isolation policy configuration interface, which can intuitively display the user's network isolation policy configuration process and the final generated network isolation policy. In addition, the self-configuration function provided to users through this interface makes the configuration of the network isolation policy more flexible and can adapt to different development scenarios.

[0077] In one embodiment, the network isolation policy includes a port number, and the method further includes:

[0078] Display the network monitoring interface. In the network monitoring interface, the network activities of each service that accesses the network through the port number are displayed.

[0079] Specifically, the computer device displays a network monitoring interface, determines each service that accesses the network through a port number, and detects the network activity of each service in real time. In the network monitoring interface, the network activity of each service that accesses the network through a port number is displayed.

[0080] like Figure 5 In the network monitoring interface shown, computer device services 1, 2, and 3 are connected to ports corresponding to the same port number, and the computer device can detect network activities of service 1, service 2, and service 3. For example, network activity 1, network activity 2, and network activity 3.

[0081] In this embodiment, by displaying the network activities of each service that accesses the network through the port number in the network monitoring interface, the security status of each service can be more intuitively presented and visualized.

[0082] In one embodiment, the method further comprises:

[0083] Detect the security value of the network activity of each service; when the security value of at least one service is lower than the preset threshold, it indicates that there is a security risk in the network activity of at least one service, and mark the network activity with security risk on the network monitoring interface.

[0084] Specifically, the computer device may obtain the activity information of the network activity of each service, and calculate the security value of the network activity according to the activity information. The security value is used to characterize the security status of the network activity.

[0085] The computer device obtains a preset threshold and determines whether there is a service with a security value lower than the preset threshold. When the security value of the service is lower than the preset threshold, it indicates that there is a security risk in the network activity of the service, and the network activity with the security risk is marked on the network monitoring interface.

[0086] In one embodiment, services with potential security risks may be marked on a network monitoring interface.

[0087] For example, network activities or services that pose security risks are marked with red lines in the network monitoring interface.

[0088] In this embodiment, the security value of the network activity of each service is detected. When the security value of at least one service is lower than a preset threshold, it indicates that there is a security risk in the network activity of at least one service. The network activities with security risks are marked on the network monitoring interface, so that the network activities and services with security risks can be presented intuitively, thereby handling these risks more quickly and improving security and stability.

[0089] In one embodiment, a layered security isolation method based on a cloud native architecture is provided, wherein the cloud native architecture includes a bottom layer, an application layer, and a container layer. The method is applied to a computer device, including:

[0090] Isolate resources between the storage layer and computing layer in the bottom layer;

[0091] For each application in the container layer, configure a container security group for each service of the targeted application;

[0092] Set access ports for corresponding services based on each container security group, and isolate access to each service through each access port;

[0093] Deploy multiple security platforms at the application layer, and isolate applications in the application layer based on multiple security platforms;

[0094] Configure multiple container security groups at the container layer and isolate the services of the application based on multiple container security groups.

[0095] Displaying an isolation policy configuration interface, and in response to a policy configuration operation triggered on the isolation policy configuration interface, obtaining configuration information generated by the policy configuration operation;

[0096] In response to a policy configuration completion operation triggered on the isolation policy configuration interface, displaying a network isolation policy generated based on the policy configuration information on the isolation policy configuration interface;

[0097] Display the network monitoring interface, in which the network activities of each service connected to the network through the port number are displayed;

[0098] The security value of the network activity of each service is detected. When the security value of at least one service is lower than the preset threshold, it indicates that there is a security risk in the network activity of at least one service, and the network activity with the security risk is marked on the network monitoring interface.

[0099] In this embodiment, the services in the cloud native environment that divide the isolation domain at the bottom layer, deploy the security platform at the same time, and isolate the container ports can improve the corresponding security capabilities and ensure the security and stability of the services in this environment. Port-level isolation is implemented for applications, and container security groups are created. Through visual operations, management is standardized, manual operation errors are reduced, and the degree of automation is improved.

[0100] In this embodiment, visualized network activity monitoring and isolation policy configuration are more intuitive and effective. Through visualized operation, management is standardized, manual operation errors are reduced, the degree of automation is improved, and the security of the service is improved.

[0101] In addition, combining container port isolation with service mesh unifies the business access ports of various products, reduces the exposure of service communications, enhances the security and stability of cloud services, and greatly reduces maintenance and management costs.

[0102] In addition, the container security group is combined with the security platform to achieve application-based management and control, and establish real-time monitoring of the comprehensive security platform for this application, and can flexibly implement isolation capabilities of different granularities.

[0103] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0104] Based on the same inventive concept, the embodiment of the present application also provides a layered security isolation device based on cloud native architecture for implementing the layered security isolation method based on cloud native architecture involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more embodiments of the layered security isolation device based on cloud native architecture provided below can be referred to the limitations of the layered security isolation method based on cloud native architecture above, and will not be repeated here.

[0105] In one embodiment, Figure 6 As shown, a layered security isolation device 600 based on a cloud native architecture is provided. The cloud native architecture includes a bottom layer, an application layer, and a container layer. The device includes: a bottom layer isolation module 602, an application isolation module 604, and a service isolation module 606. Among them:

[0106] The bottom layer isolation module 602 is used to perform resource isolation on the storage layer and computing layer in the bottom layer, and to perform communication isolation on the network layer in the bottom layer.

[0107] The application isolation module 604 is used to deploy multiple security platforms on the application layer and perform application isolation on the applications in the application layer based on the multiple security platforms.

[0108] The service isolation module 606 is used to configure multiple container security groups for the container layer and perform service isolation for each service of the application based on the multiple container security groups.

[0109] By isolating resources at the storage layer and computing layer in the bottom layer of the cloud native architecture and isolating communications at the network layer in the bottom layer, deploying multiple security platforms at the application layer, isolating applications in the application layer based on multiple security platforms, configuring multiple container security groups at the container layer, and isolating services of applications based on multiple container security groups, the bottom layer, application layer, and container layer of the cloud native architecture can be securely isolated through layered decoupling, thereby ensuring secure isolation between containers and secure communication between services in the cloud native architecture, thereby effectively ensuring the safe operation of the cloud native architecture.

[0110] In one embodiment, the bottom layer isolation module 602 is further used to allocate multiple networks to the network layer in the bottom layer and perform communication isolation based on the multiple networks.

[0111] In this embodiment, multiple networks are allocated to the network layer in the bottom layer, and communication isolation is performed based on the multiple networks, so that the communication security and communication stability of the network layer can be improved through communication isolation.

[0112] In one embodiment, the service isolation module 606 is also used to configure a container security group for each service of each application in the container layer; set an access port for the corresponding service based on each container security group, and isolate access to each service through each access port.

[0113] In this embodiment, for each application in the container layer, a container security group is configured for each service of the application, an access port is set for the corresponding service based on each container security group, and access to each service is isolated through each access port, which can improve the security of access between services in the container layer.

[0114] In one embodiment, the apparatus further comprises:

[0115] Display module, used to display the isolation policy configuration interface;

[0116] A configuration module, configured to obtain configuration information generated by a policy configuration operation in response to a policy configuration operation triggered on an isolation policy configuration interface;

[0117] The display module is also used to respond to the policy configuration completion operation triggered on the isolation policy configuration interface, and display the network isolation policy generated based on the policy configuration information in the isolation policy configuration interface.

[0118] In this embodiment, a visual isolation policy configuration interface is improved, and in response to a policy configuration operation triggered in the isolation policy configuration interface, configuration information generated by the policy configuration operation is obtained. In response to a policy configuration completion operation triggered in the isolation policy configuration interface, a network isolation policy generated based on the policy configuration information is displayed in the isolation policy configuration interface, which can intuitively display the user's network isolation policy configuration process and the final generated network isolation policy. In addition, the self-configuration function provided to users through this interface makes the configuration of the network isolation policy more flexible and can adapt to different development scenarios.

[0119] In one embodiment, the network isolation strategy includes a port number, and the display module is also used to display a network monitoring interface. In the network monitoring interface, the network activities of each service that accesses the network through the port number are displayed.

[0120] In this embodiment, by displaying the network activities of each service that accesses the network through the port number in the network monitoring interface, the security status of each service can be more intuitively presented and visualized.

[0121] In one embodiment, the display module is also used to detect the security value of the network activity of each service; when the security value of at least one service is lower than a preset threshold, it indicates that there is a security risk in the network activity of at least one service, and the network activity with the security risk is marked on the network monitoring interface.

[0122] In this embodiment, the security value of the network activity of each service is detected. When the security value of at least one service is lower than a preset threshold, it indicates that there is a security risk in the network activity of at least one service. The network activities with security risks are marked on the network monitoring interface, so that the network activities and services with security risks can be presented intuitively, thereby handling these risks more quickly and improving security and stability.

[0123] Each module in the above-mentioned layered security isolation device based on cloud native architecture can be implemented in whole or in part through software, hardware and their combination. Each of the above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0124] In one embodiment, a computer device is provided, which may be a terminal or a server. Taking a server as an example, its internal structure diagram may be as follows: Figure 7As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store security isolation data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a layered security isolation method based on a cloud native architecture is implemented.

[0125] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0126] The embodiment of the present application also provides a computer-readable storage medium. One or more non-volatile computer-readable storage media containing computer-executable instructions, when the computer-executable instructions are executed by one or more processors, the processors execute the steps of the layered security isolation method based on the cloud native architecture.

[0127] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the steps of a layered security isolation method based on a cloud-native architecture.

[0128] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0129] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0130] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0131] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A layered security isolation method based on cloud native architecture, characterized in that: The cloud native architecture includes a bottom layer, an application layer, and a container layer. The method includes: Performing resource isolation on the storage layer and the computing layer in the bottom layer, and performing communication isolation on the network layer in the bottom layer; Deploy multiple security platforms on the application layer, and perform application isolation on the applications in the application layer based on the multiple security platforms; A plurality of container security groups are configured for the container layer, and service isolation is performed on each service of the application based on the plurality of container security groups.

2. The method according to claim 1, characterized in that The communication isolation of the network layer in the bottom layer includes: A plurality of networks are allocated to the network layer in the bottom layer, and communication isolation is performed based on the plurality of networks.

3. The method according to claim 1, characterized in that The service isolation includes access isolation; configuring a container security group for the container layer and performing service isolation on each service of the application based on the container security group includes: For each application in the container layer, configure a container security group for each service of the application; An access port is set for a corresponding service based on each container security group, and access to each service is isolated through each access port.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Display the isolation policy configuration interface; In response to a policy configuration operation triggered on the isolation policy configuration interface, obtaining configuration information generated by the policy configuration operation; In response to a policy configuration completion operation triggered in the isolation policy configuration interface, a network isolation policy generated based on the policy configuration information is displayed in the isolation policy configuration interface.

5. The method according to claim 4, characterized in that The network isolation strategy includes a port number, and the method further includes: A network monitoring interface is displayed, in which network activities of various services accessing the network through the port number are displayed.

6. The method according to claim 5, characterized in that The method further comprises: detecting a security value of network activity of each of said services; When the security value of at least one service is lower than a preset threshold, it indicates that the network activity of the at least one service has a potential safety hazard, and the network activity with the potential safety hazard is marked on the network monitoring interface.

7. A layered security isolation device based on cloud native architecture, characterized in that: The cloud native architecture includes a bottom layer, an application layer, and a container layer, and the device includes: A bottom layer isolation module, used to perform resource isolation on the storage layer and computing layer in the bottom layer, and to perform communication isolation on the network layer in the bottom layer; An application isolation module, used to deploy multiple security platforms on the application layer, and perform application isolation on the applications in the application layer based on the multiple security platforms; The service isolation module is used to configure multiple container security groups for the container layer and perform service isolation for each service of the application based on the multiple container security groups.

8. A computer device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the computer program is executed by the processor, the processor is caused to perform the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images