Container security protection system and method based on differential privacy

Abstract

The invention relates to a container security protection system and method based on differential privacy, and the system comprises a containerized platform management module which is used for the creation, scheduling, operation, monitoring and destruction of a container, and maintaining the full life cycle of the container; the differential privacy processing module is used for performing differential privacy processing in the containers and between the containers; the differential privacy processing dynamically adjusts privacy budget parameters according to types and states of data transmitted in the containers and between the containers, and adds noise to the data transmitted in the containers and between the containers according to the privacy budget parameters; the log privacy protection module is used for selecting sensitive information in log data generated by a container, dividing sensitive levels and adding noise with different intensities to the sensitive information according to the sensitive levels; responding to the log diagnosis request and utilizing a noise recovery mechanism to recover the sensitive information of the set sensitive level; and the resource scheduling module carries out fuzzy processing on the resource request based on a privacy perception resource algorithm.

Description

Technical Field

[0001] The present invention relates to the field of container security protection, and mainly to a container security protection system and method based on differential privacy. Background Art

[0002] Containerization technology has become a widely used infrastructure in modern cloud computing and distributed systems. Containers provide efficient isolation through lightweight virtualization technology, allowing multiple containers to run on the same host without interfering with each other's resources and processes. Common containerization technology stacks include Docker, Kubernetes, etc., which provide flexible solutions for rapid deployment, expansion and management of applications.

[0003] Common container security reinforcement methods mainly focus on security protection at the system and network levels, such as ensuring isolation and security between containers through network isolation, access control, and resource restrictions. However, these methods mainly address security issues at the system and resource levels and are difficult to address privacy protection requirements at the data level. In a multi-tenant environment, even if the network and resources between containers are isolated, log analysis, statistical results, or resource scheduling information may still be used to conduct inference attacks and privacy leaks.

[0004] For example, the Chinese invention patent with the publication number "CN112613042A" discloses a "A tool, method and device for security inspection and repair of Docker containers", which specifically discloses "including a security inspection module, a security configuration module, a security audit module, a resource restriction module, and an access control module. Through the division of labor and cooperation among the modules, the tool automatically detects security vulnerabilities in Docker containers, and performs security configuration, security audit, resource restriction and access control on Docker containers, which significantly improves the efficiency of security inspection of Docker containers and ensures the security of Docker containers." However, this method lacks privacy protection functions when constructing modules such as security inspection, configuration and auditing. The data in the container is vulnerable to unauthorized access and leakage, which may lead to the leakage of sensitive information; in addition, the resource restriction module of this method can only provide basic resource quotas and restriction functions, but cannot dynamically allocate resources according to the actual operation and needs of the container, which easily leads to insufficient or wasteful resource utilization and reduces the overall performance of the system. Summary of the invention

[0005] In order to solve the above-mentioned problems existing in the prior art, the present application provides a container security protection system and method based on differential privacy.

[0006] The technical solution of this application is as follows:

[0007] On the one hand, the present invention proposes a container security protection system based on differential privacy, comprising:

[0008] Containerized platform management module, differential privacy processing module, log privacy protection module and resource scheduling module:

[0009] The containerized platform management module is used to create, schedule, run, monitor and destroy containers, and maintain the entire life cycle of containers;

[0010] The differential privacy processing module is used to perform differential privacy processing within and between containers; the differential privacy processing dynamically adjusts the privacy budget parameters according to the data type and state transmitted within and between containers, and adds noise to the data transmitted within and between containers according to the privacy budget parameters;

[0011] The log privacy protection module is used to select sensitive information in the log data generated by the container and classify the sensitivity level, add noise of different intensities to the sensitive information according to the sensitivity level; and use the noise recovery mechanism to restore the sensitive information of the set sensitivity level in response to the log diagnosis request;

[0012] The resource scheduling module performs fuzzy processing on resource requests based on a privacy-aware resource algorithm.

[0013] Preferably, privacy protection for the entire life cycle of a container includes the container creation phase, the container operation phase, the container migration phase, and the container destruction phase, wherein:

[0014] The container creation phase specifically initializes differential privacy parameters according to a predetermined privacy policy;

[0015] The container operation phase specifically involves obtaining the operating status of the container, monitoring the operating status of each module, and adjusting the dynamic privacy budget parameter allocation mechanism in real time according to the operating status of the container;

[0016] The container migration phase specifically performs differential privacy processing on snapshot data and migration data, where the snapshot data is specifically a complete copy of the state and data of the container at a moment;

[0017] The container destruction phase specifically involves using a differential privacy algorithm to fuzzy the residual data of the container and clearing the keys and configuration information related to the container.

[0018] Preferably, the steps of the differential privacy processing module performing differential privacy processing in the container are specifically as follows:

[0019] Obtaining the task type and container data in the container, and classifying the task type and container data according to a preset classification category; the task type is classified into high-risk, medium-risk and low-risk; the container data is classified into high-sensitivity data, medium-sensitivity data and low-sensitivity data;

[0020] Dynamically adjust the privacy budget parameters according to the classification results. Specifically, the preset privacy budget parameters are allocated to high-risk tasks and highly sensitive data with a privacy budget parameter lower than the preset privacy budget parameter; and to low-risk and low-sensitivity data with a privacy budget parameter higher than the preset privacy budget parameter;

[0021] Select the noise mechanism. For numerical containers and non-numerical data, choose different noise mechanisms to calculate the noisy container data.

[0022] Monitor the usage of privacy budget parameters in real time and dynamically adjust the allocation of privacy budget parameters.

[0023] Preferably, the steps of the differential privacy processing module performing differential privacy processing between containers are specifically as follows:

[0024] For any two containers, the first container transmits data to the second container, the first container adds noise to the transmitted data as the first layer of encryption; the transmission data after adding noise is encrypted using encryption technology to generate encrypted data as the second layer of encryption; the encrypted data is transmitted to the second container;

[0025] The second container decrypts the received encrypted data to obtain the transmission data after adding noise, and analyzes the transmission data after adding noise.

[0026] Preferably, in the log privacy protection module, the method of dividing the sensitivity levels is specifically as follows:

[0027] Classifying log fields in the log data according to sensitivity levels, where the sensitivity levels include highly sensitive fields, generally sensitive fields, and non-sensitive fields;

[0028] The method of adding noise of different intensities to sensitive information according to the sensitivity level is specifically as follows:

[0029] The noise intensity is preset, a noise intensity stronger than the preset noise intensity is assigned to a highly sensitive field, the noise intensity assigned to a generally sensitive field is the preset noise intensity, and no noise intensity is assigned to a non-sensitive field; the log data after the noise is added is stored.

[0030] Preferably, the method of restoring sensitive information of a set sensitivity level by using a noise recovery mechanism in response to a log diagnosis request is specifically:

[0031] When noise is first added to the log data, the noise is recorded and a public key is generated to encrypt the noise log data. When a log diagnosis request is received, the container determines whether the restore operation is allowed through permission verification. The encrypted noise log data is decrypted using the private key to restore the true value, obtain the log field, and recover sensitive information.

[0032] Preferably, the resource scheduling module performs the following steps to fuzzify resource requests based on a privacy-aware resource algorithm:

[0033] The container calls the differential privacy module to add noise to the resource request for fuzzification and generate fuzzy resources.

[0034] The privacy-aware resource algorithm specifically allocates the fuzzified resources and records the deviation between the allocation result and the resource request;

[0035] If the resource allocation deviation exceeds the preset deviation threshold, the feedback mechanism is used to request adjustment and reallocate resources until the resource allocation deviation is lower than the preset deviation threshold.

[0036] On the other hand, a container security protection method based on differential privacy includes:

[0037] Obtaining system data of the container and performing data cleaning on the system; the system data includes task type, container data, running status, log data and resource request;

[0038] Build a containerized platform management module, including a differential privacy processing module, a log privacy protection module, and a resource scheduling module;

[0039] The containerized platform management module is specifically used to complete the creation, scheduling, operation, monitoring and destruction of containers, and maintain the full life cycle of containers; the full life cycle of containers includes the container creation phase, container operation phase, container migration phase and container destruction phase;

[0040] The differential privacy processing module is specifically differential privacy processing within a container and between containers; the differential privacy processing dynamically adjusts the privacy budget parameters according to the data type and state transmitted within and between containers, and adds noise to the data transmitted within and between containers according to the privacy budget parameters;

[0041] The differential privacy processing in the container specifically includes obtaining the task type and container data in the container, dynamically adjusting the privacy budget parameter according to the classification result, and outputting the noise data;

[0042] The differential privacy processing between containers specifically includes obtaining the transmission data between containers and adding noise to the transmission data as the first layer of encryption; performing the second layer of encryption using encryption technology; transmitting the encrypted data to the second container; the second container decrypts the received encrypted data to obtain the transmission data after adding noise, performs analysis, and outputs the analysis result;

[0043] The log privacy protection module obtains sensitive information in the log data generated by the selected container and divides the sensitive information into sensitivity levels, adds noise of different intensities to the sensitive information according to the sensitivity levels; and in response to the log diagnosis request, uses the noise recovery mechanism to restore the sensitive information of the set sensitivity level, and outputs the restored sensitive information;

[0044] The resource scheduling module obtains resource requests and transmits them to the differential privacy processing module to perform fuzzy processing on the resource requests; intelligently allocates resources based on the privacy-aware scheduling algorithm; if the resource allocation deviation exceeds the preset deviation threshold, the feedback mechanism is used to request adjustment and reallocate resources until the resource allocation deviation is lower than the preset deviation threshold, and the resource allocation result is output;

[0045] The system data is input into the containerized platform management module, the differential privacy processing module, the log privacy protection module and the resource scheduling module, and the corresponding results of each module are output.

[0046] On the other hand, the present invention further proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a container security protection system based on differential privacy as described in any embodiment of the present invention is implemented.

[0047] On the other hand, the present invention further proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a container security protection system based on differential privacy as described in any embodiment of the present invention.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] 1) The present invention provides a container security protection system and method based on differential privacy. Through a dynamic privacy budget parameter allocation mechanism, the privacy budget parameters can be adjusted in real time according to the data classification and operation status obtained by the container, thereby improving the flexibility of the privacy protection mechanism and enhancing the privacy of the data;

[0050] 2) The present invention provides a container security protection system and method based on differential privacy, which improves the security of data privacy protection and improves the accuracy and availability of data by deeply integrating differential privacy technology;

[0051] 3) The present invention provides a container security protection system and method based on differential privacy. Through a privacy-aware resource algorithm, resource requests are fuzzified, thereby enhancing the privacy-aware capability of resource scheduling and improving resource utilization efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 is a system architecture diagram of an embodiment of the present invention;

[0053] Figure 2 is a flow chart of differential privacy processing within a container according to an embodiment of the present invention;

[0054] Figure 3 is a flowchart of differential privacy processing between containers in an embodiment of the present invention;

[0055] Figure 4 is a method flow chart of a log privacy protection module according to an embodiment of the present invention;

[0056] Figure 5 It is a method flow chart of a resource scheduling module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0058] The present invention provides the following technical solution: a container security protection system and method based on differential privacy.

[0059] Example 1

[0060] See Figure 1 ,This embodiment provides a container security protection system based on differential privacy, and the specific steps include: a containerized platform management module, a differential privacy processing module, a log privacy protection module and a resource scheduling module;

[0061] S1. The containerized platform management module is used to create, schedule, run, monitor and destroy containers, and maintain the entire life cycle of containers;

[0062] Privacy protection for the entire container life cycle, including the container creation phase, container operation phase, container migration phase, and container destruction phase, where:

[0063] The container creation phase specifically initializes differential privacy parameters according to a predetermined privacy policy;

[0064] The container operation phase specifically involves obtaining the operating status of the container, monitoring the operating status of each module, and adjusting the dynamic privacy budget parameter allocation mechanism in real time according to the operating status of the container;

[0065] The container migration phase specifically performs differential privacy processing on snapshot data and migration data, where the snapshot data is specifically a complete copy of the state and data of the container at a moment;

[0066] The container destruction phase specifically includes using a differential privacy algorithm to fuzzy the residual data of the container and clearing the key and configuration information related to the container;

[0067] S2, the differential privacy processing module is used to perform differential privacy processing within and between containers; the differential privacy processing dynamically adjusts the privacy budget parameters according to the data type and state transmitted within and between containers, and adds noise to the data transmitted within and between containers according to the privacy budget parameters;

[0068] S21. Please refer to Figure 2 The step of performing differential privacy processing in the container by the differential privacy processing module is specifically to obtain the task type and container data in the container, and classify the task type and container data according to the preset classification category; the task type is divided into high-risk, medium-risk and low-risk; the container data is divided into high-sensitivity data, medium-sensitivity data and low-sensitivity data;

[0069] Dynamically adjust the privacy budget parameters according to the classification results. Specifically, the preset privacy budget parameters are allocated to high-risk tasks and highly sensitive data with a privacy budget parameter lower than the preset privacy budget parameter; and to low-risk and low-sensitivity data with a privacy budget parameter higher than the preset privacy budget parameter;

[0070] Select the noise mechanism. For numerical containers and non-numerical data, choose different noise mechanisms to calculate the noisy container data.

[0071] Monitor the usage of privacy budget parameters in real time and dynamically adjust the allocation of privacy budget parameters;

[0072] S22, please refer to Figure 3 , the differential privacy processing module performs differential privacy processing between containers in the following specific steps: for any two containers, the first container transmits data to the second container, the first container adds noise to the transmitted data as a first layer of encryption; the transmission data after adding noise is encrypted by using encryption technology to generate encrypted data as a second layer of encryption; the encrypted data is transmitted to the second container;

[0073] The second container decrypts the received encrypted data to obtain transmission data after adding noise, and analyzes the transmission data after adding noise;

[0074] S221, the encryption technology adopts Transport Layer Security (TLS) or Advanced Encryption Standard (AES);

[0075] S3. Please refer to Figure 4 , the log privacy protection module is used to select sensitive information in the log data generated by the container and divide it into sensitivity levels, and add noise of different intensities to the sensitive information according to the sensitivity levels;

[0076] S31, classifying the log fields in the log data according to sensitivity levels, where the sensitivity levels include highly sensitive fields, generally sensitive fields, and non-sensitive fields;

[0077] The method of adding noise of different intensities to sensitive information according to the sensitivity level is specifically as follows:

[0078] Preset noise intensity, assign a noise intensity stronger than the preset noise intensity to highly sensitive fields, assign the preset noise intensity to generally sensitive fields, and do not assign noise intensity to non-sensitive fields; store the log data after adding noise;

[0079] S32, the method of restoring sensitive information of a set sensitivity level using a noise recovery mechanism in response to a log diagnosis request; when adding noise to log data for the first time, recording the noise, generating a public key to encrypt the noise log data; when receiving a log diagnosis request, the container determines whether to allow the restore operation through permission verification; and decrypting the encrypted noise log data using a private key, restoring the true value, obtaining the log field and restoring the sensitive information;

[0080] S4. Please refer to Figure 5 The resource scheduling module performs fuzzy processing on resource requests based on the privacy-aware resource algorithm as follows:

[0081] The container calls the differential privacy module to add noise to the resource request for fuzzification and generate fuzzy resources.

[0082] The privacy-aware resource algorithm specifically allocates the fuzzified resources and records the deviation between the allocation result and the resource request;

[0083] If the resource allocation deviation exceeds the preset deviation threshold, the feedback mechanism is used to request adjustment and reallocate resources until the resource allocation deviation is lower than the preset deviation threshold.

[0084] Example 2

[0085] This embodiment provides a container security protection method based on differential privacy, and the method includes:

[0086] Obtaining system data of the container and performing data cleaning on the system; the system data includes task type, container data, running status, log data and resource request;

[0087] Build a containerized platform management module, including a differential privacy processing module, a log privacy protection module, and a resource scheduling module;

[0088] The containerized platform management module is specifically used to complete the creation, scheduling, operation, monitoring and destruction of containers, and maintain the full life cycle of containers; the full life cycle of containers includes the container creation phase, container operation phase, container migration phase and container destruction phase;

[0089] The differential privacy processing module is specifically differential privacy processing within a container and between containers; the differential privacy processing dynamically adjusts the privacy budget parameters according to the data type and state transmitted within and between containers, and adds noise to the data transmitted within and between containers according to the privacy budget parameters;

[0090] The differential privacy processing in the container specifically includes obtaining the task type and container data in the container, dynamically adjusting the privacy budget parameter according to the classification result, and outputting the noise data;

[0091] The differential privacy processing between containers specifically includes obtaining the transmission data between containers and adding noise to the transmission data as the first layer of encryption; performing the second layer of encryption using encryption technology; transmitting the encrypted data to the second container; the second container decrypts the received encrypted data to obtain the transmission data after adding noise, performs analysis, and outputs the analysis result;

[0092] The log privacy protection module obtains sensitive information in the log data generated by the selected container and divides the sensitive information into sensitivity levels, adds noise of different intensities to the sensitive information according to the sensitivity levels; and in response to the log diagnosis request, uses the noise recovery mechanism to restore the sensitive information of the set sensitivity level, and outputs the restored sensitive information;

[0093] The resource scheduling module obtains resource requests and transmits them to the differential privacy processing module to perform fuzzy processing on the resource requests; intelligently allocates resources based on the privacy-aware scheduling algorithm; if the resource allocation deviation exceeds the preset deviation threshold, the feedback mechanism is used to request adjustment and reallocate resources until the resource allocation deviation is lower than the preset deviation threshold, and the resource allocation result is output;

[0094] The system data is input into the containerized platform management module, the differential privacy processing module, the log privacy protection module and the resource scheduling module, and the corresponding results are output.

[0095] Example 3

[0096] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, a container security protection method based on differential privacy as described in any embodiment of the present invention is implemented.

[0097] Example 4

[0098] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, a container security protection method based on differential privacy as described in any embodiment of the present invention is implemented.

[0099] It is worth noting that the system, electronic device and computer-readable storage medium described in the present invention are based on the same principles as the method described in Example 1, and will not be described in detail here.

[0100] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A container security protection system based on differential privacy, characterized in that: include: Containerized platform management module, differential privacy processing module, log privacy protection module and resource scheduling module: The containerized platform management module is used to create, schedule, run, monitor and destroy containers, and maintain the entire life cycle of containers; The differential privacy processing module is used to perform differential privacy processing within and between containers; the differential privacy processing dynamically adjusts the privacy budget parameters according to the data type and state transmitted within and between containers, and adds noise to the data transmitted within and between containers according to the privacy budget parameters; The log privacy protection module is used to select sensitive information in the log data generated by the container and classify the sensitivity levels, and add noise of different intensities to the sensitive information according to the sensitivity levels; and in response to the log diagnosis request, recovering sensitive information of a set sensitivity level using a noise recovery mechanism; The resource scheduling module performs fuzzy processing on resource requests based on a privacy-aware resource algorithm.

2. According to claim 1, a container security protection system based on differential privacy is characterized in that: Privacy protection for the entire container lifecycle, including the container creation phase, container operation phase, container migration phase, and container destruction phase, where: The container creation phase specifically initializes differential privacy parameters according to a predetermined privacy policy; The container operation phase specifically involves obtaining the operating status of the container, monitoring the operating status of each module, and adjusting the dynamic privacy budget parameter allocation mechanism in real time according to the operating status of the container; The container migration phase specifically performs differential privacy processing on snapshot data and migration data, where the snapshot data is specifically a complete copy of the state and data of the container at a moment; The container destruction phase specifically involves using a differential privacy algorithm to fuzzy the residual data of the container and clearing the keys and configuration information related to the container.

3. According to a container security protection system based on differential privacy according to claim 1, it is characterized in that: The steps of the differential privacy processing module for performing differential privacy processing in the container are specifically as follows: Obtaining the task type and container data in the container, and classifying the task type and container data according to a preset classification category; the task type is classified into high-risk, medium-risk and low-risk; the container data is classified into high-sensitivity data, medium-sensitivity data and low-sensitivity data; Dynamically adjust the privacy budget parameters according to the classification results. Specifically, the preset privacy budget parameters are allocated to high-risk tasks and highly sensitive data with a privacy budget parameter lower than the preset privacy budget parameter; and to low-risk and low-sensitivity data with a privacy budget parameter higher than the preset privacy budget parameter; Select the noise mechanism. For numerical containers and non-numerical data, choose different noise mechanisms to calculate the noisy container data. Monitor the usage of privacy budget parameters in real time and dynamically adjust the allocation of privacy budget parameters.

4. According to a container security protection system based on differential privacy according to claim 1, it is characterized in that: The steps of the differential privacy processing module for performing differential privacy processing between containers are specifically as follows: For any two containers, the first container transmits data to the second container, the first container adds noise to the transmitted data as the first layer of encryption; the transmission data after adding noise is encrypted using encryption technology to generate encrypted data as the second layer of encryption; the encrypted data is transmitted to the second container; The second container decrypts the received encrypted data to obtain the transmission data after adding noise, and analyzes the transmission data after adding noise.

5. According to a container security protection system based on differential privacy according to claim 1, it is characterized in that: In the log privacy protection module, the method for dividing the sensitivity levels is specifically as follows: Classifying log fields in the log data according to sensitivity levels, where the sensitivity levels include highly sensitive fields, generally sensitive fields, and non-sensitive fields; The method of adding noise of different intensities to sensitive information according to the sensitivity level is specifically as follows: Preset noise intensity: a noise intensity stronger than the preset noise intensity is allocated to a highly sensitive field, a noise intensity allocated to a generally sensitive field is the preset noise intensity, and no noise intensity is allocated to a non-sensitive field; The log data after adding noise is stored.

6. According to a container security protection system based on differential privacy according to claim 1, it is characterized in that: The method for recovering sensitive information of a set sensitivity level by using a noise recovery mechanism in response to a log diagnosis request is specifically as follows: When noise is first added to the log data, the noise is recorded and a public key is generated to encrypt the noise log data. When a log diagnosis request is received, the container determines whether the restore operation is allowed through permission verification. The encrypted noise log data is decrypted using the private key to restore the true value, obtain the log field, and recover sensitive information.

7. According to a container security protection system based on differential privacy according to claim 1, it is characterized in that: The resource scheduling module performs fuzzy processing on resource requests based on the privacy-aware resource algorithm as follows: The container calls the differential privacy module to add noise to the resource request for fuzzification and generate fuzzy resources. The privacy-aware resource algorithm specifically allocates the fuzzified resources and records the deviation between the allocation result and the resource request; If the resource allocation deviation exceeds the preset deviation threshold, the feedback mechanism is used to request adjustment and reallocate resources until the resource allocation deviation is lower than the preset deviation threshold.

8. A container security protection method based on differential privacy, characterized in that: The method comprises: Obtaining system data of the container and performing data cleaning on the system; the system data includes task type, container data, running status, log data and resource request; Build a containerized platform management module, including a differential privacy processing module, a log privacy protection module, and a resource scheduling module; The containerized platform management module is specifically used to complete the creation, scheduling, operation, monitoring and destruction of containers, and maintain the full life cycle of containers; the full life cycle of containers includes the container creation phase, container operation phase, container migration phase and container destruction phase; The differential privacy processing module is specifically differential privacy processing within a container and between containers; the differential privacy processing dynamically adjusts the privacy budget parameters according to the data type and state transmitted within and between containers, and adds noise to the data transmitted within and between containers according to the privacy budget parameters; The differential privacy processing in the container specifically includes obtaining the task type and container data in the container, dynamically adjusting the privacy budget parameter according to the classification result, and outputting the noise data; The differential privacy processing between containers specifically includes obtaining the transmission data between containers and adding noise to the transmission data as the first layer of encryption; performing the second layer of encryption using encryption technology; transmitting the encrypted data to the second container; the second container decrypts the received encrypted data to obtain the transmission data after adding noise, performs analysis, and outputs the analysis result; The log privacy protection module obtains sensitive information in the log data generated by the selected container and divides the sensitive information into sensitivity levels, adds noise of different intensities to the sensitive information according to the sensitivity levels; and in response to the log diagnosis request, uses the noise recovery mechanism to restore the sensitive information of the set sensitivity level, and outputs the restored sensitive information; The resource scheduling module obtains resource requests and transmits them to the differential privacy processing module to perform fuzzy processing on the resource requests; intelligently allocates resources based on the privacy-aware scheduling algorithm; if the resource allocation deviation exceeds the preset deviation threshold, the feedback mechanism is used to request adjustment and reallocate resources until the resource allocation deviation is lower than the preset deviation threshold, and the resource allocation result is output; The system data is input into the containerized platform management module, the differential privacy processing module, the log privacy protection module and the resource scheduling module, and the corresponding results of each module are output.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, a container security protection method based on differential privacy as described in claim 8 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a container security protection method based on differential privacy as described in claim 8 is implemented.

Images