Cloud native asset collection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention relates to the technical field of cloud native, and provides a cloud native asset collection method and device, electronic equipment and a storage medium, when asset collection needs to be carried out on a target cloud native application, attribute information of the target cloud native application deployed in a CNAPP is obtained, collecting development state assets of the target cloud native application in a development stage according to the attribute information, associating the development state assets with the target cloud native application, then collecting runtime assets of the target cloud native application in a running stage, and associating the runtime assets with the target cloud native application according to the development state assets and the attribute information. Therefore, with the target cloud native application as the center, the assets in the whole life cycle of the target cloud native application are automatically collected and associated, and the efficiency of risk management of subsequent safety operation and maintenance, safety operation and the like is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of cloud native technology, and specifically, to a cloud native asset collection method, device, electronic device and storage medium. Background Art

[0002] Cloud native asset collection is a technology used to collect and manage asset information in cloud native environments, which refer to applications and infrastructure built on cloud computing and containerization technologies. Cloud native asset collection technology can help organizations understand the various assets in their cloud native environments, including containers, images, services, network configurations, etc. By collecting and monitoring information about these assets, organizations can better manage and optimize their cloud native environments and improve the reliability and performance of applications.

[0003] The existing cloud-native asset collection methods include dynamically collecting K8S cluster, container image and other asset data through the K8S (Kubernetes) cluster API, and dynamically collecting asset fingerprint information such as processes and ports through container security agents. However, the cloud-native assets collected by these two methods are relatively scattered, and can only be managed as a single asset according to clusters, container images, processes, ports, etc., resulting in low efficiency in subsequent risk management such as security operations and maintenance. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a cloud-native asset collection method, device, electronic device and storage medium, which can collect and associate different assets of cloud-native applications at various stages of their life cycle with cloud-native applications as the center, thereby improving the efficiency of subsequent risk management such as security operation and maintenance and security operations.

[0005] In order to achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0006] In a first aspect, an embodiment of the present application provides a cloud native asset collection method, which is applied to a cloud native application protection platform CNAPP, and the method includes:

[0007] Obtaining attribute information of the target cloud native application deployed in the CNAPP;

[0008] According to the attribute information, the development-state assets of the target cloud native application in the development phase are collected, and the development-state assets are associated with the target cloud native application;

[0009] The runtime assets of the target cloud native application in the running stage are collected, and the runtime assets are associated with the target cloud native application according to the development state assets and the attribute information.

[0010] Optionally, the CNAPP communicates with both the code repository and the image repository, and the attribute information includes code information and image information;

[0011] The step of obtaining the attribute information of the target cloud native application deployed in the CNAPP includes:

[0012] Determine a custom page in the target cloud native application deployed in the CNAPP, wherein the custom page is used to input code repository information and image repository information;

[0013] Obtain code repository information and image repository information of the target cloud native application from the custom page;

[0014] Determine a code repository according to the code repository information, and obtain the code information from the code repository;

[0015] An image repository is determined according to the image repository information, and the image information is obtained from the image repository.

[0016] Optionally, the CNAPP communicates with a code security device, an SCA security device, and a mirror security device; the attribute information includes code information and mirror information, the code security device stores code assets associated with the code information, the SCA security device stores SBOM assets associated with the code information, and the mirror security device stores mirror assets associated with the mirror information and mirror asset information of the mirror assets; the development assets include the code assets, the SBOM assets, and the mirror assets;

[0017] The step of collecting development-state assets of the target cloud-native application in the development phase according to the attribute information and associating the development-state assets with the target cloud-native application includes:

[0018] According to the code information, the code assets associated with the code information are collected from the code security device, and the code assets are associated with the target cloud native application;

[0019] According to the code information, the SBOM assets associated with the code information are collected from the SCA security device, and the SBOM assets are associated with the target cloud native application;

[0020] According to the image information, the image assets and the image asset information associated with the image information are collected from the image security device, and according to the image information and the image asset information, the image assets are associated with the target cloud native application.

[0021] Optionally, the image information includes an image warehouse address and a first tag label, and the image asset information includes a remote warehouse address and a second tag label;

[0022] The step of associating the image asset with the target cloud native application according to the image information and the image asset information includes:

[0023] The remote warehouse address in the image asset information is matched with the image warehouse address in the image information, and the first tag label is matched with the second tag label to associate the image asset with the target cloud native application.

[0024] Optionally, the CNAPP also communicates with a container security device and an API security device, the container security device stores the container assets of the target cloud native application and the asset information of the container assets, and the API security device stores the API assets of the target cloud native application; the attribute information includes image information, the development assets include image assets, and the runtime assets include the container assets and API assets;

[0025] The step of collecting runtime assets of the target cloud native application in the running stage, and associating the runtime assets with the target cloud native application according to the development state assets and the attribute information includes:

[0026] collecting the container asset of the target cloud native application and the asset information of the container asset from the container security device;

[0027] Establishing a mapping relationship between the container asset and the mirror asset according to the asset information of the container asset and the mirror asset information of the mirror asset;

[0028] Associating the image asset with the target cloud native application according to the image information and the image asset information, so as to indirectly associate the container asset with the target cloud native application through the image asset;

[0029] Collecting the API assets of the target cloud native application from the API security device;

[0030] A mapping relationship between the API asset and the container asset is established to associate the API asset with the target cloud native application through the container asset.

[0031] Optionally, the container assets include clusters, Pods, Services, Ingresses, and workloads, and the asset information includes cluster attributes, Pod attributes, Service attributes, Ingress attributes, and workload attributes; the cluster attributes include the cluster identifier of the cluster, the Ingress attributes include the cluster identifier of the cluster to which the Ingress belongs and Service information of the Service associated with the Ingress, the Service attributes include Pod information of the Pod associated with the Service, the workload attributes include Pod information of the Pod associated with the workload, and the Pod attributes include image information of the target cloud native application;

[0032] The step of establishing a mapping relationship between the container asset and the mirror asset according to the asset information of the container asset and the mirror asset information of the mirror asset comprises:

[0033] Establishing a mapping relationship between the Ingress and the cluster according to the cluster identifier of the cluster contained in the cluster attribute and the cluster identifier of the cluster to which the Ingress belongs contained in the Ingress attribute;

[0034] Establishing a mapping relationship between the Service and the Ingress according to the Service information of the Service associated with the Ingress contained in the Ingress attribute;

[0035] A mapping relationship between the Pod and the Service is established according to the Pod information of the Pod associated with the Service contained in the Service attribute, and a mapping relationship between the workload and the Pod is established according to the Pod information of the Pod associated with the workload contained in the workload attribute;

[0036] Establishing a mapping relationship between the Pod and the image asset association according to the image asset information of the image asset and the image information of the target cloud native application included in the Pod attribute;

[0037] Among them, the mapping relationship between the container asset and the image asset includes the mapping relationship between the Ingress and the cluster, the mapping relationship between the Service and the Ingress, the mapping relationship between the Pod and the Service, the mapping relationship between the workload and the Pod, and the mapping relationship between the Pod and the image asset association.

[0038] Optionally, the container asset includes a Service asset, and the Service asset includes API information;

[0039] The step of establishing a mapping relationship between the API asset and the container asset to associate the API asset with the target cloud native application through the container asset includes:

[0040] According to the API information included in the Service asset, a mapping relationship between the API asset and the Service asset is established, so as to indirectly associate the API asset with the target cloud native application through the Service asset.

[0041] In a second aspect, the embodiment of the present application further provides a cloud native asset collection device, which is applied to the cloud native application protection platform CNAPP, and the device includes:

[0042] An information acquisition module, used to obtain attribute information of the target cloud native application deployed in the CNAPP;

[0043] A first asset collection module, configured to collect development-state assets of the target cloud native application in a development phase according to the attribute information, and associate the development-state assets with the target cloud native application;

[0044] The second asset collection module is used to collect runtime assets of the target cloud native application in the running stage, and associate the runtime assets with the target cloud native application according to the development assets and the attribute information.

[0045] In a third aspect, an embodiment of the present application further provides an electronic device, comprising a processor and a memory, wherein the memory is used to store a program, and the processor is used to implement the cloud-native asset collection method in the first aspect when executing the program.

[0046] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the cloud-native asset collection method in the first aspect described above.

[0047] Compared with the prior art, the embodiments of the present application provide a cloud-native asset collection method, device, electronic device and storage medium. When it is necessary to collect assets for a target cloud-native application, the attribute information of the target cloud-native application deployed in the CNAPP is obtained, and the development-state assets of the target cloud-native application in the development stage are collected according to the attribute information, and the development-state assets are associated with the target cloud-native application. Then, the runtime assets of the target cloud-native application in the operation stage are collected, and the runtime assets are associated with the target cloud-native application according to the development-state assets and attribute information. In this way, the assets of the target cloud-native application throughout its life cycle can be automatically collected and associated with the target cloud-native application with the target cloud-native application as the center, thereby improving the efficiency of subsequent risk management such as security operation and maintenance and security operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of an application architecture provided by an embodiment of the present application is shown Figure 1 .

[0049] Figure 2 A schematic diagram of an application architecture provided by an embodiment of the present application is shown Figure 2 .

[0050] Figure 3 The following is a schematic diagram showing a process of a cloud native asset collection method provided in an embodiment of the present application. Figure 1 .

[0051] Figure 4 The following is a schematic diagram showing a process of a cloud native asset collection method provided in an embodiment of the present application. Figure 2 .

[0052] Figure 5 A schematic diagram of a custom page provided in an embodiment of the present application is shown.

[0053] Figure 6 A schematic diagram of an application architecture provided by an embodiment of the present application is shown Figure 3 .

[0054] Figure 7 A schematic diagram of an application architecture provided by an embodiment of the present application is shown Figure 4 .

[0055] Figure 8 An example diagram of the collection results provided in an embodiment of the present application is shown.

[0056] Fig. 9 A block diagram of a cloud-native asset collection device provided in an embodiment of the present application is shown.

[0057] Fig.10 A block diagram of an electronic device provided in an embodiment of the present application is shown.

[0058] Icon: 100 - cloud-native asset collection device; 101 - information acquisition module; 102 - first asset collection module; 103 - second asset collection module; 10 - electronic device; 11 - processor; 12 - memory; 13 - bus. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present application.

[0060] Cloud Native is a distributed cloud based on distributed deployment and unified operation and management, and a set of cloud technology product systems built on technologies such as containers, microservices, and DevOps.

[0061] Cloud native asset collection is a technology that collects and manages asset information in a cloud native environment. Assets in a cloud native environment include containers, images, services, network configurations, etc. By collecting and monitoring information about these assets, organizations can better understand and manage their cloud native environments and improve the reliability and performance of cloud native applications.

[0062] Cloud-native applications are container-based applications that are deployed and managed using a microservice architecture and dynamic orchestration tools. They are highly scalable, elastic, and portable, and can better adapt to the characteristics of cloud environments.

[0063] At present, cloud-native asset collection technologies mainly include K8S cluster API collection and container security client Agent collection.

[0064] K8S cluster API collection refers to obtaining various resource information in the cluster by accessing the API server of the K8S cluster. The K8S cluster provides a set of API interfaces that can be used to query and manage various objects in the cluster, such as Pod, Deployment, Service, etc. By calling these API interfaces, you can obtain detailed information about these objects, including their configuration, status, operating status, etc. This collection method can help organizations understand the various resource conditions in the cluster and monitor and manage them.

[0065] Client Agent collection for container security refers to deploying a client Agent program in each running container to collect information inside the container. The Agent program can monitor the container's running status, network connection, file system, etc., and send the collected information to a centralized management system for analysis and processing. In this way, the security of the container can be monitored in real time, and potential security threats can be discovered and responded to in a timely manner.

[0066] K8S cluster API collection and container security client agent collection can be used in combination to fully understand and manage asset information in the cloud native environment.

[0067] However, the assets collected by these two collection methods are relatively scattered, and can only be managed as a single asset according to clusters, container images, processes, ports, etc., resulting in low efficiency in subsequent risk management such as security operation and maintenance and security operations.

[0068] In order to solve this technical problem, the embodiment of the present application is centered on cloud-native applications, collects and associates different assets of cloud-native applications at various stages of their life cycle, and improves the efficiency of subsequent risk management such as security operation and maintenance and security operations.

[0069] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0070] The asset forms of cloud-native applications at different stages of their life cycle are different. The cloud-native assets in the embodiments of the present application need to cover the entire life cycle of cloud-native applications, including code, SBOM, images, clusters, nodes, namaspace, services, pods, processes, and ports.

[0071] That is, the cloud-native assets in the embodiments of the present application may include application assets, development assets, and runtime assets of cloud-native applications.

[0072] Among them, the application asset is the cloud native application itself, that is, a cloud native application is an application asset. For example, an OA system or a patent system is an application asset.

[0073] Development assets refer to the resources and tools required by cloud-native applications during the development phase, including source code, development documentation, test cases, build scripts, etc. Development assets are mainly used to support the development, testing, and deployment of applications, as well as to assist developers in code writing, debugging, and integration.

[0074] Runtime assets refer to the resources and environment required by cloud-native applications during the running stage, including the application's executable files, dependent libraries, configuration files, static resource files, etc. Runtime assets are mainly used for the deployment and execution of applications in the production environment, including the startup, operation, monitoring, and maintenance of applications.

[0075] The cloud-native asset collection in the embodiments of the present application refers to the collection of assets from various stages of the life cycle of cloud-native applications, including from code repositories, image repositories, K8S clusters and containers.

[0076] The cloud-native asset association in the embodiments of the present application is centered on cloud-native applications and associates different assets of cloud-native applications at various stages of their life cycle. That is, both development assets and runtime assets are associated with application assets, laying the foundation for subsequent security capability association, risk association, and full life cycle situation analysis.

[0077] The cloud native asset collection method provided in the embodiment of the present application is applied to CNAPP (Cloud Native Application Protection Platform). CNAPP helps protect the applications deployed in CNAPP from potential security threats by providing secure access control, authentication and authorization mechanisms. At the same time, CNAPP can also provide log monitoring, vulnerability scanning, security auditing and other functions to help discover and handle security vulnerabilities in applications.

[0078] Please refer to Figure 1 , CNAPP communicates with the code repository, image repository and K8S cluster. CNAPP deploys multiple applications. The code repository is used to store and manage the source code of the application, and the image repository is used to store and manage the image of the application; the K8S cluster is used to manage and run containerized applications. In the K8S cluster, you can define and configure resource objects such as Pods, Services, and Ingress to describe and manage the deployment, network, and access rules of the application.

[0079] For example, Figure 2 As shown, CNAPP is deployed with APP1 and APP2. The code repository is used to store and manage the source code of APP1 and APP2, namely, Code1 and Code2. The image repository is used to store and manage the images of APP1 and APP2, namely, Image1, Image2, etc. The K8S cluster is used to manage and run containerized APP1 and APP2, namely, Service1, Pod3, etc.

[0080] exist Figure 1 and Figure 2 Based on the application architecture shown, please refer to Figure 3 , Figure 3 A schematic diagram of a process of a cloud native asset collection method provided in an embodiment of the present application is shown, which may include the following steps:

[0081] S101, obtaining attribute information of the target cloud native application deployed in CNAPP.

[0082] In this embodiment, the attribute information may include code information and image information of the target cloud native application. The code information may include the code repository address and code branch information of the target cloud native application. The image information may include the image repository address and image metadata of the target cloud native application.

[0083] exist Figure 3 Based on Figure 4 The process of obtaining the attribute information of the target cloud native application deployed in CNAPP in step S101 may include sub-steps S1011 to S1014.

[0084] S1011, determine the custom page in the target cloud native application deployed in CNAPP, where the custom page is used to input code repository information and image repository information.

[0085] In this embodiment, the custom page can be a page developed to facilitate users to specify cloud-native applications (i.e., target cloud-native applications) that require asset collection. Users can implement asset management of the target cloud-native applications by entering basic information, code repository information, and image repository information of the target cloud-native applications on the custom page.

[0086] A custom page may include one or more sub-pages, and different sub-pages are used for users to input different information and can be switched between each other. Figure 5 As shown, the custom page includes a subpage for inputting basic information and a subpage for inputting associated information.

[0087] The basic information may include, but is not limited to, the application name of the target cloud native application (for example, OA system, patent system, etc.), the business department to which it belongs, the version number, etc. The embodiments of the present application do not impose any restrictions on this.

[0088] Figure 5 What is displayed is a subpage for inputting associated information, which may include a code repository information input area and an image repository information input area. Accordingly, the associated information may include code repository information and image repository information.

[0089] Among them, the code repository information may include the connection information and warehouse address of the code repository corresponding to the target cloud native application, and the image repository may include a development environment application image repository and a production environment application image repository. Accordingly, the image repository information may include the connection information and warehouse address of the development environment application image repository corresponding to the target cloud native application, as well as the connection information and warehouse address of the production environment application image repository corresponding to the target cloud native application.

[0090] The development environment application image repository is used to store container images used by developers during the development process. These container images are usually used to build, test, and debug applications, as well as run applications in the development environment. The development environment application image repository can contain multiple versions of container images for different development tasks and needs.

[0091] The production environment application image repository is used to store container images that are deployed and run in the production environment. After development, testing, and verification, these container images are considered stable and reliable versions and are suitable for use in the production environment. The production environment application image repository usually only contains verified image versions to ensure the stability and security of the production environment.

[0092] S1012, obtain the code repository information and image repository information of the target cloud native application from the custom page. S1013, determine the code repository according to the code repository information, and obtain the code information from the code repository.

[0093] S1014, determining an image repository according to the image repository information, and obtaining image information from the image repository.

[0094] In this embodiment, CNAPP can Figure 5 The customized page shown obtains the basic information of the target cloud native application and generates application assets based on the basic information.

[0095] At the same time, CNAPP can also Figure 5 The custom page shown obtains the code repository information and image repository information of the target cloud native application.

[0096] Afterwards, the code repository is connected according to the connection information and repository address of the code repository. After the connection information is verified, the code branch information of the target cloud native application is collected from the code repository, so that the code information of the target cloud native application can be obtained, which includes the code branch information and the code repository address.

[0097] Code branch information refers to the related information between different code branches in the code repository, which may include branch name, creation time, last submission time, merge records, etc.

[0098] At the same time, the development environment application image warehouse is connected according to the connection information and warehouse address of the development environment application image warehouse. After the connection information is verified, the metadata of the development environment application image of the target cloud native application is collected from the development environment application image warehouse. In addition, the production environment application image warehouse is connected according to the connection information and warehouse address of the production environment application image warehouse. After the connection information is verified, the metadata of the production environment application image of the target cloud native application is collected from the production environment application image warehouse.

[0099] In this way, the image information of the target cloud native application can be obtained, which includes the image repository address and image metadata, wherein the image repository address includes the repository address of the development environment application image repository and the repository address of the production environment application image repository, and the image metadata includes the metadata of the development environment application image and the metadata of the production environment application image.

[0100] The metadata of an image may include the image tag, version number, creation time, author, dependencies, etc. Metadata provides descriptions and properties about the image to help users understand the source, purpose, and characteristics of the image. Metadata can also be used to search, filter, and manage images, as well as perform version control and tracking.

[0101] S102: Collect development assets of the target cloud native application in the development phase according to the attribute information, and associate the development assets with the target cloud native application.

[0102] In this embodiment, after obtaining the code information and image information of the target cloud native application through the code repository and the image repository, the development assets of the cloud native application can be collected from the code repository and the image repository respectively according to the code information and the image information, and the development assets can be associated with the application assets.

[0103] Optionally, the development assets may include code assets, SBOM (Software Bill of Materials) assets, and image assets.

[0104] Among them, code assets include the source code and code defect information of the target cloud native application, and SBOM assets include various software components and library files that the target cloud native application depends on. Image assets include images of the target cloud native application, including development environment application images and production environment application images.

[0105] S103: Collect runtime assets of the target cloud native application in the running stage, and associate the runtime assets with the target cloud native application according to the development state assets and attribute information.

[0106] At the same time, the runtime assets of cloud-native applications are collected from the K8S cluster, and the runtime assets are associated with the application assets based on the image information and the collected development assets.

[0107] Optionally, the runtime assets may include container assets and API assets. The container assets may include clusters, pods, workloads, services, ingress, etc.

[0108] Among them, container assets refer to container instances running in a cloud-native environment, including information such as the container's configuration, status, and operating status. API assets refer to API interfaces and related document information in a cloud-native environment, including information such as API definitions, parameters, and return values.

[0109] Taking the OA system as an example, the OA system is an application asset. The development assets may include the source code of the OA system, the SBOM of the OA system, and the container image of the OA system. The runtime assets may include the container cluster deployed by the OA system, the pods, workloads, services, ingress, and APIs of the OA system.

[0110] In practice, cloud-native environments usually deploy various security devices, which can be used to collect assets of cloud-native applications at various stages of their life cycle.

[0111] Please refer to Figure 6 The cloud-native application platform also communicates with code security devices, SCA (Software Composition Analysis Appliance) security devices, image security devices, container security devices, and API security devices. Code assets, SBOM assets, image assets, container assets, and API assets of cloud-native applications can be collected through code security devices, SCA security devices, image security devices, container security devices, and API security devices.

[0112] Code security equipment is used to protect code security during the software development process. It can scan the code base, perform vulnerability detection, code review and compliance verification, and perform static and dynamic analysis of the code to discover potential vulnerabilities and security issues.

[0113] SCA security appliances are used to perform software component analysis to identify third-party open source and commercial components used in applications, helping developers understand the security, license compliance, and potential vulnerabilities of components.

[0114] Image security devices are used to protect and manage the security of images. They can scan software components and operating systems in images and detect potential vulnerabilities, malicious code, and security configuration issues. They can also verify the source and integrity of images, provide image auditing and security policy control, and ensure the security and reliability of images.

[0115] Container security devices are used to protect and manage the security of container environments. They can monitor and prevent threats and attacks during container runtime, perform vulnerability scans, image scans, and behavior audits on containers to provide container-level security monitoring and protection. They can also isolate resources, networks, and permissions between containers to ensure that the container's operating environment is secure.

[0116] API security devices are used to protect the security of application program interfaces. They can monitor and analyze API traffic in real time, detect potential malicious requests, vulnerabilities, and attacks, and strengthen API authentication, authorization, and access control to ensure API compliance and security.

[0117] For example, Figure 7 As shown, CNAPP is deployed with APP1 and APP2. The source code and code defects of APP1 and APP2 can be collected through code security equipment, the SBOM and component risks of APP1 and APP2 can be collected through SCA security equipment, the images and image risks of APP1 and APP2 can be collected through container security equipment, the container assets and container risks of APP1 and APP2 can be collected through container security equipment, and the API assets and API risks of APP1 and APP2 can be collected through API security equipment.

[0118] Below Figure 6 and Figure 7 Based on the application architecture shown, the detailed implementation of the above steps S102 and S103 is introduced.

[0119] Please continue to refer to Figure 4 The process of collecting development-state assets of the target cloud-native application in the development phase according to the attribute information in step S102 and associating the development-state assets with the target cloud-native application may include sub-steps S1021 to S1023.

[0120] S1021, according to the code information, collect code assets associated with the code information from the code security device, and associate the code assets with the target cloud native application.

[0121] In this embodiment, the code security device stores code assets associated with the code information of the target cloud native application, so the code repository address and code branch information obtained in step S101 can be used to call the API of the code security device to collect code assets such as source code and code defect information of the target cloud native application. Since the code information of the target cloud native application is directly used and the code assets associated with the code information are collected through the API, the collected code assets are directly associated with the target cloud native application.

[0122] S1022: According to the code information, collect SBOM assets associated with the code information from the SCA security device, and associate the SBOM assets with the target cloud native application.

[0123] In this embodiment, the SCA security device stores SBOM assets associated with the code information of the target cloud native application, so the code repository address and code branch information obtained in step S101 can also be used to call the API of the SCA security device to collect SBOM assets such as SBOM and component risks of the target cloud native application. Similarly, since the code information of the target cloud native application is directly used to collect the SBOM assets associated with the code information through the API, the collected SBOM assets are directly associated with the target cloud native application.

[0124] S1023, according to the image information, collect image assets and image asset information associated with the image information from the image security device, and associate the image assets with the target cloud native application according to the image information and the image asset information.

[0125] In this embodiment, the image security device stores image assets and image asset information of image assets associated with the image information of the target cloud native application, so the API of the image security device can be called to collect the image assets and image asset information of the target cloud native application. The image asset information may include a remote warehouse address and metadata information, and the metadata information includes a tag label.

[0126] Optionally, the image information includes the image repository address and a first tag label, and the image asset information includes the remote repository address and a second tag label. Therefore, the image asset and the target cloud native application can be automatically associated by matching the remote repository address in the image asset information with the image repository address in the image information and matching the second tag label in the image asset information with the first tag label in the image information.

[0127] Please refer again Figure 4 The process of collecting runtime assets of the target cloud native application in the running stage in step S103 and associating the runtime assets with the target cloud native application according to the development assets and attribute information may include sub-steps S1031 to S1035.

[0128] S1031, collecting container assets of the target cloud native application and asset information of the container assets from the container security device.

[0129] S1032: Establish a mapping relationship between the container asset and the mirror asset according to the asset information of the container asset and the mirror asset information of the mirror asset.

[0130] S1033: Associating the image asset with the target cloud native application according to the image information and the image asset information, so as to indirectly associate the container asset with the target cloud native application through the image asset.

[0131] In this embodiment, the container security device stores the container assets of the target cloud native application and the asset information of the container assets, so the API of the container security device can be called to collect the container assets of the target cloud native application and the asset information of the container assets. The container assets may include clusters, Pods, Services, Ingresses, and workloads, and the asset information includes cluster attributes, Pod attributes, Service attributes, Ingress attributes, and workload attributes.

[0132] A cluster is a computing resource pool consisting of a group of physical or virtual machines. It provides computing, storage, and network resources, as well as an environment for managing and scheduling applications. It usually consists of hosts, nodes, and a control plane, and provides features such as high availability, elastic expansion, and automated management.

[0133] Pod is the smallest deployable unit in a K8S cluster, which is used to encapsulate one or more related containers. The containers in a Pod are usually tightly coupled, and they share the same resources and network namespace. Pods can be scheduled and managed in a cluster, and share storage, network, and other resources.

[0134] Service is a network abstraction in a K8S cluster that exposes a group of Pods as a stable network endpoint. Service can provide load balancing, service discovery, and reliability for backend Pods, allowing other applications to easily access and communicate with these Pods.

[0135] Ingress is an object in the K8S cluster that manages external traffic and access rules. Through Ingress, you can define and configure external traffic routing, load balancing, and access policies to direct traffic to the corresponding Services and Pods.

[0136] A workload refers to a group of container instances running in a cluster, which can be objects in a K8S cluster such as Deployment, StatefulSet, DaemonSet, etc.

[0137] The mapping relationship between container assets and image assets can include: the mapping relationship between Ingress and cluster, the mapping relationship between Service and Ingress, the mapping relationship between Pod and Service, the mapping relationship between workload and Pod, and the mapping relationship between Pod and image asset association, that is, establish a mapping relationship of cluster-》ingress-》service-》workload-》pods-》image asset.

[0138] Optionally, cluster attributes may include the cluster identifier of the cluster, Ingress attributes may include the cluster identifier of the cluster to which the Ingress belongs and Service information of the Service associated with the Ingress, Service attributes may include Pod information of the Pod associated with the Service, workload attributes may include Pod information of the Pod associated with the workload, and Pod attributes may include image information of the target cloud native application.

[0139] Therefore, in a possible implementation, the process of establishing a mapping relationship between the container asset and the mirror asset according to the asset information of the container asset and the mirror asset information of the mirror asset in sub-step S1033 may include sub-steps S10331 to S10334.

[0140] S10331: Establish a mapping relationship between the Ingress and the cluster according to the cluster identifier of the cluster contained in the cluster attribute and the cluster identifier of the cluster to which the Ingress belongs contained in the Ingress attribute.

[0141] S10332: Establish a mapping relationship between the Service and the Ingress according to the Service information of the Service associated with the Ingress contained in the Ingress attribute;

[0142] S10333, based on the Pod information of the Pod associated with the Service contained in the Service attribute, establish a mapping relationship between the Pod and the Service, and based on the Pod information of the Pod associated with the workload contained in the workload attribute, establish a mapping relationship between the workload and the Pod;

[0143] S10334, establish a mapping relationship between the Pod and the image asset association according to the image asset information of the image asset and the image information of the target cloud native application contained in the Pod attribute.

[0144] Afterwards, according to a method similar to sub-step S1024, the image asset and the target cloud native application are automatically associated by matching the remote warehouse address in the image asset information with the image warehouse address in the image information and matching the second tag label in the image asset information with the first tag label in the image information.

[0145] S1034, collecting API assets of the target cloud native application from the API security device.

[0146] S1035, establishing a mapping relationship between the API asset and the container asset, so as to associate the API asset with the target cloud native application through the container asset.

[0147] In this embodiment, the API security device stores the API assets of the target cloud native application, so the API of the API security device can be called to collect the API assets of the target cloud native application. Since the API assets include API information such as the access IP address or DNS domain name of the API, and the container assets collected in sub-step S1031 include Service assets, and the Service assets also include API information, such as the IP address and DNS information of the API, a mapping relationship between the API assets and the Service assets can be established based on the API information contained in the Service assets, and the API assets and the target cloud native application can be indirectly associated through the Service assets.

[0148] After completing the cloud native asset collection for the target cloud native application according to the process of steps S101 to S103 above, the collection results can be displayed to the user through the interface. Figure 8 As shown, it includes the basic information and asset information of the target cloud native application, among which code, SBOM, basic image and application image are development assets, and container, Pod, workload, Service, Ingress and API are runtime assets.

[0149] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0150] First, with cloud-native applications as the center, different assets of cloud-native applications at various stages of their lifecycle are collected and associated, which improves the efficiency of subsequent risk management such as security operation and maintenance and security operations;

[0151] Secondly, through the cloud-native asset collection method provided in the embodiment of the present application, assets can be collected for cloud-native applications of different business departments within an organization, helping the organization to better understand and manage its cloud-native environment and improve the reliability and performance of cloud-native applications;

[0152] Third, the existing cloud native asset collection method only covers the collection of application runtime assets. The embodiment of the present application collects different assets of cloud native applications at various stages of their life cycle, including not only runtime assets but also development assets, covering the entire life cycle of cloud native applications, which facilitates subsequent risk management of cloud native applications.

[0153] Fourth, the existing cloud-native asset collection methods display the runtime assets of the application together and can only perform single asset management according to clusters, container images, processes, ports, etc. The embodiments of the present application associate different assets of cloud-native applications at various stages of their life cycle with cloud-native applications, thereby realizing asset management in the application dimension and facilitating subsequent risk management of cloud-native applications.

[0154] In order to execute the corresponding steps in the above method embodiment and each possible implementation method, an implementation method of a cloud-native asset collection device is given below.

[0155] Please refer to Fig. 9 , Fig. 9 The block diagram of the cloud native asset collection device 100 provided in the embodiment of the present application is shown. The cloud native asset collection device 100 is applied to CNAPP, and includes: an information acquisition module 101, a first asset collection module 102 and a second asset collection module 103.

[0156] The information acquisition module 101 is used to obtain the attribute information of the target cloud native application deployed in CNAPP.

[0157] The first asset collection module 102 is used to collect development-state assets of the target cloud native application in the development phase according to the attribute information, and associate the development-state assets with the target cloud native application.

[0158] The second asset collection module 103 is used to collect runtime assets of the target cloud native application in the running stage, and associate the runtime assets with the target cloud native application according to the development assets and attribute information.

[0159] Optionally, the CNAPP communicates with both the code repository and the image repository, and the attribute information includes code information and image information; the information acquisition module 101 is specifically used for:

[0160] Determine the custom page in the target cloud-native application deployed in CNAPP. The custom page is used to enter code repository information and image repository information;

[0161] Obtain the code repository information and image repository information of the target cloud-native application from the custom page;

[0162] Determine the code repository based on the code repository information, and obtain code information from the code repository;

[0163] Determine the image repository based on the image repository information and obtain the image information from the image repository.

[0164] Optionally, CNAPP communicates with the code security device, the SCA security device and the mirror security device; the attribute information includes code information and mirror information, the code security device stores code assets associated with the code information, the SCA security device stores SBOM assets associated with the code information, and the mirror security device stores mirror assets associated with the mirror information and mirror asset information of the mirror assets; the development state assets include code assets, SBOM assets and mirror assets;

[0165] The first asset collection module 102 is specifically used for:

[0166] According to the code information, code assets associated with the code information are collected from the code security device, and the code assets are associated with the target cloud native application;

[0167] According to the code information, collect SBOM assets associated with the code information from the SCA security device, and associate the SBOM assets with the target cloud native application;

[0168] According to the image information, image assets and image asset information associated with the image information are collected from the image security device, and according to the image information and the image asset information, the image assets and the target cloud native application are associated.

[0169] Optionally, the first asset collection module 102 executes a method of associating the image asset with the target cloud native application according to the image information and the image asset information, including:

[0170] The remote warehouse address in the image asset information is matched with the image warehouse address in the image information, and the first tag label is matched with the second tag label to associate the image asset with the target cloud native application.

[0171] Optionally, CNAPP also communicates with a container security device and an API security device, wherein the container security device stores the container assets of the target cloud native application and the asset information of the container assets, and the API security device stores the API assets of the target cloud native application; the attribute information includes image information, the development state assets include image assets, and the runtime assets include container assets and API assets;

[0172] The second asset collection module 103 is specifically used for:

[0173] Collect container assets of the target cloud native application and asset information of the container assets from the container security device;

[0174] A mapping relationship between the container asset and the image asset is established according to the asset information of the container asset and the image asset information of the image asset;

[0175] According to the image information and the image asset information, the image asset and the target cloud native application are associated, so as to indirectly associate the container asset and the target cloud native application through the image asset;

[0176] Collect API assets of target cloud-native applications from API security devices;

[0177] A mapping relationship between API assets and container assets is established to associate API assets with target cloud-native applications through container assets.

[0178] Optionally, the container assets include clusters, Pods, Services, Ingresses, and workloads, and the asset information includes cluster attributes, Pod attributes, Service attributes, Ingress attributes, and workload attributes; the cluster attributes include the cluster identifier of the cluster, the Ingress attributes include the cluster identifier of the cluster to which the Ingress belongs and the Service information of the Service associated with the Ingress, the Service attributes include the Pod information of the Pod associated with the Service, the workload attributes include the Pod information of the Pod associated with the workload, and the Pod attributes include the image information of the target cloud native application;

[0179] The second asset collection module 103 executes a method of establishing a mapping relationship between the container asset and the mirror asset according to the asset information of the container asset and the mirror asset information of the mirror asset, including:

[0180] A mapping relationship between the Ingress and the cluster is established based on the cluster ID of the cluster contained in the cluster attribute and the cluster ID of the cluster to which the Ingress belongs contained in the Ingress attribute.

[0181] Based on the Service information of the Service associated with the Ingress contained in the Ingress attributes, a mapping relationship between the Service and the Ingress is established;

[0182] A mapping relationship between Pod and Service is established based on the Pod information of the Pod associated with the Service contained in the Service attributes, and a mapping relationship between workload and Pod is established based on the Pod information of the Pod associated with the workload contained in the workload attributes;

[0183] A mapping relationship between the Pod and the image asset association is established based on the image asset information of the image asset and the image information of the target cloud native application contained in the Pod attributes;

[0184] The mapping relationship between container assets and image assets includes the mapping relationship between Ingress and cluster, the mapping relationship between Service and Ingress, the mapping relationship between Pod and Service, the mapping relationship between workload and Pod, and the mapping relationship between Pod and image asset association.

[0185] Optionally, the container asset includes a Service asset, and the Service asset includes API information;

[0186] The second asset collection module 103 establishes a mapping relationship between the API asset and the container asset, so as to associate the API asset with the target cloud native application through the container asset, including:

[0187] Based on the API information contained in the Service asset, a mapping relationship between the API asset and the Service asset is established to indirectly associate the API asset with the target cloud native application through the Service asset.

[0188] Technical personnel in the relevant field can clearly understand that for the convenience and conciseness of description, the specific working process of the cloud-native asset collection device 100 described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0189] Please refer to Fig.10 , Fig.10 A block diagram of an electronic device 10 provided in an embodiment of the present application is shown. The electronic device 10 may be hardware in a cloud native environment, such as a cloud server, etc., and the electronic device 10 is deployed with a CNAPP. The electronic device 10 includes a processor 11, a memory 12, and a bus 13, and the processor 11 is connected to the memory 12 via the bus 13.

[0190] The memory 12 is used to store programs, such as Fig. 9 The cloud-native asset collection device 100 shown. The cloud-native asset collection device 100 includes at least one software function module that can be stored in the memory 12 in the form of software or firmware. After receiving the execution instruction, the processor 11 executes the program to implement the cloud-native asset collection method disclosed in the above embodiment.

[0191] The memory 12 may include a high-speed random access memory (RAM) and may also include a non-volatile memory (NVM).

[0192] The processor 11 may be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 11 or an instruction in the form of software. The above processor 11 may be a general processor, including a central processing unit (CPU), a microcontroller unit (MCU), a complex programmable logic device (CPLD), a field programmable gate array (FPGA), an embedded ARM and other chips.

[0193] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by the processor 11, the cloud-native asset collection method disclosed in the aforementioned embodiment is implemented.

[0194] To summarize, the embodiments of the present application provide a cloud-native asset collection method, device, electronic device, and storage medium. When it is necessary to collect assets for a target cloud-native application, the attribute information of the target cloud-native application deployed in the CNAPP is obtained, and the development-state assets of the target cloud-native application in the development phase are collected according to the attribute information, and the development-state assets are associated with the target cloud-native application. Then, the runtime assets of the target cloud-native application in the operation phase are collected, and the runtime assets are associated with the target cloud-native application according to the development-state assets and the attribute information. This allows the target cloud-native application to be taken as the center, and the assets of the entire life cycle of the target cloud-native application to be automatically collected and associated, thereby improving the efficiency of subsequent risk management such as security operation and maintenance and security operations.

[0195] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A cloud native asset collection method, characterized in that: Applied to the cloud native application protection platform CNAPP, the method includes: Obtaining attribute information of the target cloud native application deployed in the CNAPP; According to the attribute information, the development-state assets of the target cloud native application in the development phase are collected, and the development-state assets are associated with the target cloud native application; The runtime assets of the target cloud native application in the running stage are collected, and the runtime assets are associated with the target cloud native application according to the development state assets and the attribute information.

2. The method according to claim 1, characterized in that The CNAPP communicates with both the code repository and the image repository, and the attribute information includes code information and image information; The step of obtaining the attribute information of the target cloud native application deployed in the CNAPP includes: Determine a custom page in the target cloud native application deployed in the CNAPP, wherein the custom page is used to input code repository information and image repository information; Obtain code repository information and image repository information of the target cloud native application from the custom page; Determine a code repository according to the code repository information, and obtain the code information from the code repository; An image repository is determined according to the image repository information, and the image information is obtained from the image repository.

3. The method according to claim 1, characterized in that The CNAPP communicates with the code security device, the SCA security device and the mirror security device; the attribute information includes code information and mirror information, the code security device stores code assets associated with the code information, the SCA security device stores SBOM assets associated with the code information, and the mirror security device stores mirror assets associated with the mirror information and mirror asset information of the mirror assets; The development assets include the code assets, the SBOM assets and the image assets; The step of collecting development-state assets of the target cloud-native application in the development phase according to the attribute information and associating the development-state assets with the target cloud-native application includes: According to the code information, the code assets associated with the code information are collected from the code security device, and the code assets are associated with the target cloud native application; According to the code information, the SBOM assets associated with the code information are collected from the SCA security device, and the SBOM assets are associated with the target cloud native application; According to the image information, the image assets and the image asset information associated with the image information are collected from the image security device, and according to the image information and the image asset information, the image assets are associated with the target cloud native application.

4. The method according to claim 3, characterized in that The image information includes the image warehouse address and the first tag label, and the image asset information includes the remote warehouse address and the second tag label; The step of associating the image asset with the target cloud native application according to the image information and the image asset information includes: The remote warehouse address in the image asset information is matched with the image warehouse address in the image information, and the first tag label is matched with the second tag label to associate the image asset with the target cloud native application.

5. The method according to claim 1, characterized in that The CNAPP also communicates with a container security device and an API security device, wherein the container security device stores the container assets and asset information of the target cloud native application, and the API security device stores the API assets of the target cloud native application; The attribute information includes image information, the development state assets include image assets, and the runtime assets include the container assets and API assets; The step of collecting runtime assets of the target cloud native application in the running stage, and associating the runtime assets with the target cloud native application according to the development state assets and the attribute information includes: collecting the container asset of the target cloud native application and the asset information of the container asset from the container security device; Establishing a mapping relationship between the container asset and the mirror asset according to the asset information of the container asset and the mirror asset information of the mirror asset; Associating the image asset with the target cloud native application according to the image information and the image asset information, so as to indirectly associate the container asset with the target cloud native application through the image asset; Collecting the API assets of the target cloud native application from the API security device; A mapping relationship between the API asset and the container asset is established to associate the API asset with the target cloud native application through the container asset.

6. The method according to claim 5, characterized in that The container assets include clusters, Pods, Services, Ingresses, and workloads, and the asset information includes cluster attributes, Pod attributes, Service attributes, Ingress attributes, and workload attributes; the cluster attributes include the cluster identifier of the cluster, the Ingress attributes include the cluster identifier of the cluster to which the Ingress belongs and the Service information of the Service associated with the Ingress, the Service attributes include the Pod information of the Pod associated with the Service, the workload attributes include the Pod information of the Pod associated with the workload, and the Pod attributes include the image information of the target cloud native application; The step of establishing a mapping relationship between the container asset and the mirror asset according to the asset information of the container asset and the mirror asset information of the mirror asset comprises: Establishing a mapping relationship between the Ingress and the cluster according to the cluster identifier of the cluster contained in the cluster attribute and the cluster identifier of the cluster to which the Ingress belongs contained in the Ingress attribute; Establishing a mapping relationship between the Service and the Ingress according to the Service information of the Service associated with the Ingress contained in the Ingress attribute; A mapping relationship between the Pod and the Service is established according to the Pod information of the Pod associated with the Service contained in the Service attribute, and a mapping relationship between the workload and the Pod is established according to the Pod information of the Pod associated with the workload contained in the workload attribute; Establishing a mapping relationship between the Pod and the image asset association according to the image asset information of the image asset and the image information of the target cloud native application included in the Pod attribute; Among them, the mapping relationship between the container asset and the image asset includes the mapping relationship between the Ingress and the cluster, the mapping relationship between the Service and the Ingress, the mapping relationship between the Pod and the Service, the mapping relationship between the workload and the Pod, and the mapping relationship between the Pod and the image asset association.

7. The method according to claim 5, characterized in that The container asset includes a Service asset, and the Service asset includes API information; The step of establishing a mapping relationship between the API asset and the container asset to associate the API asset with the target cloud native application through the container asset includes: According to the API information included in the Service asset, a mapping relationship between the API asset and the Service asset is established, so as to indirectly associate the API asset with the target cloud native application through the Service asset.

8. A cloud-native asset collection device, characterized in that: Applied to the cloud native application protection platform CNAPP, the device includes: An information acquisition module, used to obtain attribute information of the target cloud native application deployed in the CNAPP; A first asset collection module, configured to collect development-state assets of the target cloud native application in a development phase according to the attribute information, and associate the development-state assets with the target cloud native application; The second asset collection module is used to collect runtime assets of the target cloud native application in the running stage, and associate the runtime assets with the target cloud native application according to the development assets and the attribute information.

9. An electronic device, characterized in that: It includes a processor and a memory, the memory is used to store a program, and the processor is used to implement the cloud native asset collection method described in any one of claims 1 to 7 when executing the program.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the cloud-native asset collection method described in any one of claims 1 to 7 is implemented.

Images