Container mirror image security attribute transmission method and device, electronic equipment and storage medium

Abstract

The invention provides a container mirror image security attribute transmission method and device, electronic equipment and a storage medium, and belongs to the technical field of computer security. In the method, security attribute information (in the form of an OCI product) of a to-be-transmitted container mirror image and the to-be-transmitted container mirror image are stored in a mirror image storage platform together; different environments can access the same to-be-transmitted container mirror image in the same mirror image storage platform and obtain consistent security attribute information, so that the security attribute transmission of the container mirror image is realized, the environmental dependence in different environments is avoided, in addition, the process does not need complex security attribute information migration any more, and the security attribute transmission efficiency is improved. The security attribute information of the first environment does not need to be synchronized to the second environment, and only the security attribute information of the to-be-transmitted container mirror image needs to be stored in the mirror image storage platform along with the to-be-transmitted container mirror image, so that the complexity and the cost of data migration are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security, and in particular to a method, device, electronic device and storage medium for transmitting security attributes of a container image. Background Art

[0002] In the prior art, the security attributes of container images are usually synchronized by database migration, that is, the security attribute information of container images is migrated from the database of one environment to the database of another environment, so that systems in different environments can obtain the same container image security attributes.

[0003] In the prior art, synchronizing (i.e., transferring) container image security attributes through database migration has the problems of environment dependence and high migration cost. For example, a container image marked as compliant (compliance is a security attribute) in the database of environment A may be considered non-compliant in the database of environment B because the data has not been synchronized, that is, the security attributes of the same container image may be inconsistent in different environments due to data not being synchronized; in addition, traditional data migration requires the synchronization of a large amount of security attribute information, for example, the security attributes of all container images need to be synchronized from the database of environment A to the database of environment B, which is complex and costly.

[0004] In summary, how to reduce the environmental dependence and delivery cost of container image security attribute delivery has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a method, device, electronic device and storage medium for transmitting container image security attributes, so as to alleviate the technical problems of environmental dependence and high migration cost in the traditional method of transmitting container image security attributes.

[0006] In a first aspect, an embodiment of the present invention provides a method for transmitting security attributes of a container image, including: The signature verification service of the first environment obtains the security attribute information of the container image to be delivered, the public key and the private key required for the signature, and obtains the container image information of the container image to be delivered from the image storage platform; The signature verification service of the first environment uses the private key to sign the security attribute information and the container image information to obtain signature data; The signature verification service of the first environment combines the public key, the security attribute information and the signature data into an OCI product, assigns a container image tag to the OCI product, and then stores the OCI product carrying the container image tag to the image storage platform; The signature verification service of the second environment constructs a container image tag to be searched according to the container image name of the container image to be transferred, and obtains a target OCI artifact corresponding to the container image tag to be searched from the image storage platform according to the container image tag to be searched; The signature verification service of the second environment obtains the container image information of the container image to be delivered from the image storage platform; The signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the acquired container image information and the security attribute information in the target OCI product, and obtains the security attribute information in the target OCI product after the verification.

[0007] Furthermore, the signature verification service of the first environment obtains the security attribute information of the container image to be delivered, the public key and the private key required for the signature, including: The signature verification service of the first environment obtains the security attribute information of the container image to be transferred, the public key and the private key required for the signature from the first security data source, wherein the first security data source is the security scanning result obtained after performing a security scan on the container image to be transferred.

[0008] Further, obtaining container image information of the container image to be transferred from the image storage platform includes: The container image information of the container image to be transferred is obtained from the container image stored in the image storage platform.

[0009] Furthermore, the signature verification service of the first environment uses the private key to sign the security attribute information and the container image information, including: The signature verification service of the first environment integrates the security attribute information and the container image information to obtain data to be signed; The signature verification service of the first environment uses the private key to sign the data to be signed to obtain the signature data.

[0010] Further, the signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the acquired container image information and the security attribute information in the target OCI product, including: The signature verification service of the second environment integrates the obtained container image information and the security attribute information in the target OCI product to obtain the data to be verified; The signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the data to be verified, and obtains the security attribute information in the target OCI product after the verification.

[0011] Furthermore, the security attribute information includes: whether it contains virus files, whether it contains patch vulnerabilities, and whether it is compliant.

[0012] Furthermore, the method further comprises: The signature verification service of the second environment obtains the public key required for signature verification from the second secure data source; Generate prompt information on whether the public keys are consistent based on the public key required for the signature verification and the public key in the target OCI product.

[0013] In a second aspect, an embodiment of the present invention further provides a device for transmitting security attributes of a container image, including: A first acquisition unit, used for the signature verification service of the first environment to obtain security attribute information of the container image to be transferred, a public key and a private key required for the signature, and to obtain container image information of the container image to be transferred from the image storage platform; A signing unit, used for the signature verification service of the first environment to sign the security attribute information and the container image information using the private key to obtain signature data; A combination allocation unit, for the signature verification service of the first environment, combines the public key, the security attribute information and the signature data into an OCI product, allocates a container image tag to the OCI product, and further stores the OCI product carrying the container image tag to the image storage platform; Constructing an acquisition unit, the signature verification service for the second environment constructs a container image tag to be searched according to the container image name of the container image to be transferred, and acquires a target OCI artifact corresponding to the container image tag to be searched from the image storage platform according to the container image tag to be searched; A second acquisition unit, used for the signature verification service of the second environment to acquire the container image information of the container image to be delivered from the image storage platform; The signature verification unit is used for the signature verification service of the second environment to verify the obtained container image information and the security attribute information in the target OCI product using the public key in the target OCI product and the signature data in the target OCI product, and obtain the security attribute information in the target OCI product after the verification.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0015] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to execute any method described in the first aspect above.

[0016] In an embodiment of the present invention, a method for delivering security attributes of a container image is provided, including: a signature verification service of a first environment obtains security attribute information of a container image to be delivered, a public key and a private key required for signature, and obtains container image information of the container image to be delivered from an image storage platform; the signature verification service of the first environment signs the security attribute information and the container image information with a private key to obtain signature data; the signature verification service of the first environment combines the public key, the security attribute information and the signature data into an OCI product, assigns a container image label to the OCI product, and then stores the OCI product carrying the container image label in the image storage platform; the signature verification service of the second environment constructs a container image tag to be searched according to the container image name of the container image to be transferred, and obtains the target OCI product corresponding to the container image tag to be searched from the image storage platform according to the container image tag to be searched; the signature verification service of the second environment obtains the container image information of the container image to be transferred from the image storage platform; the signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the obtained container image information and the security attribute information in the target OCI product, and obtains the security attribute information in the target OCI product after the verification passes. It can be seen from the above description that in the method for transmitting the security attributes of the container image of the present invention, the security attribute information of the container image to be transmitted (in the form of an OCI product) and the container image to be transmitted are stored together in the image storage platform, so that different environments can access the same container image to be transmitted in the same image storage platform and obtain consistent security attribute information, thereby realizing the transmission of the security attributes of the container image and avoiding environmental dependence in different environments. In addition, the above process no longer requires complex security attribute information migration, that is, it is no longer necessary to synchronize the security attribute information of the first environment to the second environment. It is only necessary to store the security attribute information of the container image to be transmitted together with the container image to be transmitted itself in the image storage platform, thereby reducing the complexity and cost of data migration and alleviating the technical problems of environmental dependence and high migration cost in the method for transmitting the security attributes of the container image in the traditional technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A flowchart of a method for transmitting container image security attributes provided by an embodiment of the present invention; Figure 2 A flowchart of another method for transmitting container image security attributes provided by an embodiment of the present invention; Figure 3 A schematic diagram of a device for transmitting security attributes of a container image provided by an embodiment of the present invention; Figure 4 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] In traditional technologies, the method of delivering container image security attributes is environment-dependent and has high migration costs.

[0021] Based on this, in the method for transmitting the security attributes of a container image of the present invention, the security attribute information of the container image to be transmitted (in the form of an OCI product) is stored together with the container image to be transmitted in the image storage platform, so that different environments can access the same container image to be transmitted in the same image storage platform and obtain consistent security attribute information, thereby realizing the transmission of the security attributes of the container image and avoiding environmental dependencies in different environments. In addition, the above process no longer requires complex migration of security attribute information, that is, it is no longer necessary to synchronize the security attribute information of the first environment to the second environment. It is only necessary to store the security attribute information of the container image to be transmitted in the image storage platform together with the container image to be transmitted itself, thereby reducing the complexity and cost of data migration.

[0022] To facilitate understanding of this embodiment, a method for transmitting security attributes of a container image disclosed in an embodiment of the present invention is first introduced in detail.

[0023] Embodiment 1: According to an embodiment of the present invention, an embodiment of a method for transmitting security attributes of a container image is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0024] Figure 1 is a flow chart of a method for delivering container image security attributes according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps: Step S102: The signature verification service of the first environment obtains the security attribute information of the container image to be delivered, the public key and the private key required for the signature, and obtains the container image information of the container image to be delivered from the image storage platform; The following is an explanation of some concepts involved in the present invention: Image: In the field of computer security technology related to the present invention, it refers to a container image, which is a lightweight, executable, independent software package that contains all the content required to run a certain software, such as code, runtime environment, system tools, system libraries, etc., so that the application can run in the same way in different environments.

[0025] Signature: refers to the process of using a private key to encrypt the data to be transmitted (e.g., the data to be signed in the present invention, i.e., security attribute information and container image information) to generate signature data, the purpose of which is to ensure the integrity, authenticity and non-repudiation of the data; Signature verification: refers to the process in which the recipient uses the corresponding public key to decrypt and verify the signed data to confirm that the data has not been tampered with during transmission.

[0026] Image signature: specifically refers to the signature operation performed on the container image. In the present invention, the Payload (i.e., the data to be signed) which is an integration of the image security attributes and the container image information is encrypted using a private key obtained from a secure data source, and the signature data is generated, and then combined with the relevant information (public key, security attribute information) and stored on the image storage platform, and saved together with the container image to be delivered.

[0027] Image signature verification: It is the process of verifying the signature data of the container image. In the present invention, the signature-related data (public key, security attribute information, signature data) is obtained from the image storage platform, and the signature data is verified using the public key to determine that the image's security attribute information and the container image information have not been tampered with during transmission or storage. After the signature verification is passed, the security attribute information of the image (i.e., the container image to be transferred) is extracted.

[0028] Data to be signed (Payload): refers to a data set formed by integrating the container image information obtained from the image storage platform and the security attribute information obtained from the secure data source. This data set will be used for subsequent operations such as signing.

[0029] OCI Artifact: An artifact under the Open Container Initiative (OCI) specification. In the present invention, it is a data unit in a specific format that is composed of a public key obtained from a secure data source, security attribute information containing a container image, and generated signature data in accordance with the OCI specification. An image tag (i.e., container image tag) is assigned to it (i.e., the OCI artifact) and then stored on the image storage platform.

[0030] In the embodiment of the present invention, the public key and private key required for the above signature are generated by using relevant algorithms.

[0031] Step S104: The signature verification service of the first environment signs the security attribute information and the container image information using a private key to obtain signature data; Step S106: The signature verification service of the first environment combines the public key, security attribute information, and signature data into an OCI product, assigns a container image tag to the OCI product, and then stores the OCI product carrying the container image tag to the image storage platform; Specifically, when allocating a container image tag to an OCI product, an image tag (ie, Tag) is allocated to it (OCI product) in a specific format.

[0032] The final image storage platform stores: the container image to be delivered and the corresponding OCI product.

[0033] Step S108: The signature verification service of the second environment constructs a container image tag to be searched according to the container image name of the container image to be transferred, and obtains a target OCI artifact corresponding to the container image tag to be searched from the image storage platform according to the container image tag to be searched; Specifically, the image storage platform stores OCI artifacts carrying container image tags. When searching according to the container image tag to be searched, the target OCI artifact corresponding to the container image tag to be searched is obtained. When constructing the container image tag to be searched, it is constructed according to a preset rule. For example, the container image tag to be searched is the container image name-identifier of the container image to be transferred.

[0034] Step S110, the signature verification service of the second environment obtains the container image information of the container image to be delivered from the image storage platform; Specifically, the signature verification service of the second environment obtains the container image information of the container image to be delivered from the container image stored in the image storage platform.

[0035] It should be noted that the container image information is only a part of the container image to be transferred. The container image to be transferred also includes other contents, which will not be repeated here.

[0036] Step S112: The signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the acquired container image information and the security attribute information in the target OCI product, and obtains the security attribute information in the target OCI product after the verification.

[0037] During implementation, the container image information and the security attribute information in the target OCI product are integrated, and the public key is used to calculate the integrated data. If the calculated data is consistent with the signature data, the signature verification passes, otherwise, the signature verification fails.

[0038] In an embodiment of the present invention, a method for delivering security attributes of a container image is provided, including: a signature verification service of a first environment obtains security attribute information of a container image to be delivered, a public key and a private key required for signature, and obtains container image information of the container image to be delivered from an image storage platform; the signature verification service of the first environment signs the security attribute information and the container image information with a private key to obtain signature data; the signature verification service of the first environment combines the public key, the security attribute information and the signature data into an OCI product, assigns a container image label to the OCI product, and then stores the OCI product carrying the container image label in the image storage platform; the signature verification service of the second environment constructs a container image tag to be searched according to the container image name of the container image to be transferred, and obtains the target OCI product corresponding to the container image tag to be searched from the image storage platform according to the container image tag to be searched; the signature verification service of the second environment obtains the container image information of the container image to be transferred from the image storage platform; the signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the obtained container image information and the security attribute information in the target OCI product, and obtains the security attribute information in the target OCI product after the verification passes. It can be seen from the above description that in the method for transmitting the security attributes of the container image of the present invention, the security attribute information of the container image to be transmitted (in the form of an OCI product) and the container image to be transmitted are stored together in the image storage platform, so that different environments can access the same container image to be transmitted in the same image storage platform and obtain consistent security attribute information, thereby realizing the transmission of the security attributes of the container image and avoiding environmental dependence in different environments. In addition, the above process no longer requires complex security attribute information migration, that is, it is no longer necessary to synchronize the security attribute information of the first environment to the second environment. It is only necessary to store the security attribute information of the container image to be transmitted together with the container image to be transmitted itself in the image storage platform, thereby reducing the complexity and cost of data migration and alleviating the technical problems of environmental dependence and high migration cost in the method for transmitting the security attributes of the container image in the traditional technology.

[0039] The above content briefly introduces the method for transmitting the security attributes of the container image of the present invention. The specific contents involved are described in detail below.

[0040] In an optional embodiment of the present invention, the signature verification service of the first environment obtains the security attribute information of the container image to be transferred, and the public key and private key required for the signature, specifically including the following steps: The signature verification service of the first environment obtains security attribute information of the container image to be delivered, and the public key and private key required for the signature from the first security data source, wherein the first security data source is the security scan result obtained after performing a security scan on the container image to be delivered.

[0041] In an optional embodiment of the present invention, obtaining container image information of the container image to be transferred from the image storage platform specifically includes the following steps: The container image information of the container image to be delivered is obtained from the container image stored in the image storage platform.

[0042] In an optional embodiment of the present invention, the signature verification service of the first environment uses a private key to sign the security attribute information and the container image information, specifically including the following steps: The signature verification service of the first environment integrates the security attribute information and the container image information to obtain the data to be signed; The signature verification service of the first environment uses a private key to sign the signature data to obtain the signature data.

[0043] In an optional embodiment of the present invention, the signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the acquired container image information and the security attribute information in the target OCI product, specifically including the following steps: (1) The signature verification service of the second environment integrates the obtained container image information and the security attribute information in the target OCI product to obtain the data to be verified; (2) The signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the data to be verified, and obtains the security attribute information in the target OCI product after the verification passes.

[0044] In an optional embodiment of the present invention, the security attribute information includes: whether it contains virus files, whether it contains patch vulnerabilities, and whether it is compliant.

[0045] In an optional embodiment of the present invention, the method further comprises the following steps: (1) The signature verification service of the second environment obtains the public key required for signature verification from the second secure data source; (2) Generate a prompt message to indicate whether the public key required for signature verification is consistent with the public key in the target OCI product.

[0046] Next, combine Figure 2 A brief description of the signing process and the signature verification process: Signing process: Step 1: Obtain security attribute information of the container image to be transferred and the public key and private key required for signing from the first secure data source.

[0047] Step 2: Obtain the container image information of the container image to be delivered from the image storage platform, and integrate the security attribute information and the container image information into a payload.

[0048] Step 3: Use the private key to sign the payload and generate signature data.

[0049] Step 4: Combine the public key, security attribute information in step 1, and the signature data in step 3 into an OCI Artifact, assign a container image tag to it in a specific format, and push the OCI artifact carrying the container image tag to the image storage platform and store it together with the container image to be delivered.

[0050] Verification process: Step 5: Obtain the public key required for signature verification from the second secure data source.

[0051] Step 6: According to the container image name of the container image to be transferred, construct the container image tag to be searched, and obtain the target OCI artifact (including public key, signature data and security attribute information) corresponding to the container image tag to be searched from the image storage platform.

[0052] Step 7: Obtain the container image information of the container image to be delivered from the image storage platform.

[0053] Step 8: Use the public key in the target OCI product and the signature data in the target OCI product to verify the obtained container image information and the security attribute information in the target OCI product, and obtain the security attribute information in the target OCI product after the verification, to ensure that the container image information and the security attribute information in the target OCI product have not been tampered with.

[0054] Step 9: After the signature verification is passed, the security attribute information in the target OCI product after the signature verification is extracted, that is, the security attribute information of the container image to be transferred.

[0055] The method of the present invention obtains relevant information from a first secure data source, signs the container image to be transmitted and stores the signature result, verifies the signature with a public key in an isolated environment and extracts security attribute information, thereby ensuring the transmission and verification of the security attribute information of the container image in different environments.

[0056] The present invention proposes a technical solution that combines container image security attribute information with image signature to ensure the consistency of image security attributes in different environments; utilizes a signature verification mechanism to prevent the image security attribute information from being tampered with during the transmission process, so that the image security attribute information can be safely and accurately transmitted in multiple environments; proposes a solution to reduce the complexity and dependency of security attribute migration, thereby simplifying container image management in multiple environments.

[0057] The present invention has the following advantages: 1. Reduce environmental dependence. By combining security attribute information with image signatures, different environments only need to access the same image storage platform to obtain consistent security attribute information, avoiding environmental dependence in different environments.

[0058] 2. Improve security. Through the signature verification mechanism, ensure that the security attribute information of the image has not been tampered with, and improve the security of the image during cross-environment transmission.

[0059] 3. Simplify the migration process. The solution of the present invention only involves the migration of the public and private key pairs for signature verification (i.e., synchronizing the public key and private key of the first environment to the second environment, specifically the second secure data source in the second environment). It no longer requires complex security attribute information migration, reducing migration costs and operational complexity.

[0060] Embodiment 2: An embodiment of the present invention further provides a device for transmitting the security attributes of a container image. The device for transmitting the security attributes of a container image is mainly used to execute the method for transmitting the security attributes of a container image provided in the first embodiment of the present invention. The device for transmitting the security attributes of a container image provided in the embodiment of the present invention is specifically introduced below.

[0061] Figure 3 is a schematic diagram of a device for delivering security attributes of a container image according to an embodiment of the present invention, such as Figure 3 As shown, the device mainly includes: a first acquisition unit 10, a signature unit 20, a combination allocation unit 30, a structure acquisition unit 40, a second acquisition unit 50, and a signature verification unit 60, wherein: A first acquisition unit, used for the signature verification service of the first environment to obtain security attribute information of the container image to be delivered, a public key and a private key required for the signature, and to obtain container image information of the container image to be delivered from the image storage platform; The signature unit is used for the signature verification service of the first environment to sign the security attribute information and the container image information with a private key to obtain signature data; A combination allocation unit, used for the signature verification service of the first environment to combine the public key, security attribute information and signature data into an OCI product, and allocate a container image tag to the OCI product, and then store the OCI product carrying the container image tag to the image storage platform; Constructing an acquisition unit, the signature verification service for the second environment constructs a container image tag to be searched according to the container image name of the container image to be delivered, and acquires a target OCI artifact corresponding to the container image tag to be searched from the image storage platform according to the container image tag to be searched; A second acquisition unit, used for the signature verification service of the second environment to acquire container image information of the container image to be delivered from the image storage platform; The signature verification unit, which is used for the signature verification service of the second environment, uses the public key in the target OCI product and the signature data in the target OCI product to verify the acquired container image information and the security attribute information in the target OCI product, and obtains the security attribute information in the target OCI product after the verification passes.

[0062] In an embodiment of the present invention, a device for delivering security attributes of a container image is provided, including: a signature verification service of a first environment obtains security attribute information of a container image to be delivered, a public key and a private key required for signature, and obtains container image information of the container image to be delivered from an image storage platform; the signature verification service of the first environment uses a private key to sign the security attribute information and the container image information to obtain signature data; the signature verification service of the first environment combines the public key, the security attribute information and the signature data into an OCI product, assigns a container image label to the OCI product, and then stores the OCI product carrying the container image label in the image storage platform; the signature verification service of the second environment constructs a container image tag to be searched according to the container image name of the container image to be transferred, and obtains the target OCI product corresponding to the container image tag to be searched from the image storage platform according to the container image tag to be searched; the signature verification service of the second environment obtains the container image information of the container image to be transferred from the image storage platform; the signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the obtained container image information and the security attribute information in the target OCI product, and obtains the security attribute information in the target OCI product after the verification passes. It can be seen from the above description that in the device for transmitting the security attributes of the container image of the present invention, the security attribute information of the container image to be transmitted (in the form of an OCI product) and the container image to be transmitted are stored together in the image storage platform, so that different environments can access the same container image to be transmitted in the same image storage platform and obtain consistent security attribute information, thereby realizing the transmission of the security attributes of the container image and avoiding environmental dependence in different environments. In addition, the above process no longer requires complex security attribute information migration, that is, it is no longer necessary to synchronize the security attribute information of the first environment to the second environment. It is only necessary to store the security attribute information of the container image to be transmitted together with the container image to be transmitted itself in the image storage platform, thereby reducing the complexity and cost of data migration and alleviating the technical problems of environmental dependence and high migration cost in the method for transmitting the security attributes of container images in traditional technologies.

[0063] Optionally, the first acquisition unit is also used for: the signature verification service of the first environment obtains security attribute information of the container image to be transferred, and the public key and private key required for the signature from the first security data source, wherein the first security data source is the security scanning result obtained after performing a security scan on the container image to be transferred.

[0064] Optionally, the first obtaining unit is further used to: obtain container image information of the container image to be transferred from the container image stored in the image storage platform.

[0065] Optionally, the signature unit is also used for: the signature verification service of the first environment integrates the security attribute information and the container image information to obtain the data to be signed; the signature verification service of the first environment uses a private key to sign the data to be signed to obtain the signature data.

[0066] Optionally, the signature verification unit is also used for: the signature verification service of the second environment integrates the acquired container image information and the security attribute information in the target OCI product to obtain the data to be verified; the signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the data to be verified, and obtains the security attribute information in the target OCI product after the verification passes.

[0067] Optionally, the security attribute information includes: whether it contains virus files, whether it contains patch vulnerabilities, and whether it is compliant.

[0068] Optionally, the device is also used for: the signature verification service of the second environment obtains the public key required for verification from the second security data source; and generates prompt information on whether the public keys are consistent based on the public key required for verification and the public key in the target OCI product.

[0069] The device provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0070] like Figure 4 As shown, an electronic device 600 provided in an embodiment of the present application includes: a processor 601, a memory 602 and a bus, wherein the memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 through the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the method for transmitting the security attributes of the container image as described above.

[0071] Specifically, the above-mentioned memory 602 and processor 601 can be general-purpose memory and processor, which are not specifically limited here. When the processor 601 runs the computer program stored in the memory 602, the above-mentioned method for transferring the security attributes of the container image can be executed.

[0072] The processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 601. The above processor 601 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 602, and the processor 601 reads the information in the memory 602 and completes the steps of the above method in combination with its hardware.

[0073] Corresponding to the above-mentioned method for transmitting the security attributes of a container image, an embodiment of the present application further provides a computer-readable storage medium, which stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above-mentioned method for transmitting the security attributes of a container image.

[0074] The device for transmitting the security attributes of the container image provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The device provided in the embodiment of the present application, its implementation principle and the technical effect produced are the same as those in the aforementioned method embodiment. For the sake of brief description, the parts not mentioned in the device embodiment can refer to the corresponding contents in the aforementioned method embodiment. Technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0075] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0076] For another example, the flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the device, method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of the boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0077] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0078] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0079] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable an electronic device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method for transmitting the security attributes of the container image described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program code.

[0080] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0081] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solution of the present application, rather than to limit it. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the aforementioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solution recorded in the aforementioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solution deviate from the scope of the technical solution of the embodiment of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for delivering security attributes of a container image, characterized in that: include: The signature verification service of the first environment obtains the security attribute information of the container image to be delivered, the public key and the private key required for the signature, and obtains the container image information of the container image to be delivered from the image storage platform; The signature verification service of the first environment uses the private key to sign the security attribute information and the container image information to obtain signature data; The signature verification service of the first environment combines the public key, the security attribute information and the signature data into an OCI product, assigns a container image tag to the OCI product, and then stores the OCI product carrying the container image tag to the image storage platform; The signature verification service of the second environment constructs a container image tag to be searched according to the container image name of the container image to be transferred, and obtains a target OCI artifact corresponding to the container image tag to be searched from the image storage platform according to the container image tag to be searched; The signature verification service of the second environment obtains the container image information of the container image to be delivered from the image storage platform; The signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the acquired container image information and the security attribute information in the target OCI product, and obtains the security attribute information in the target OCI product after the verification.

2. The method according to claim 1, characterized in that The signature verification service of the first environment obtains the security attribute information of the container image to be delivered, the public key and private key required for the signature, including: The signature verification service of the first environment obtains the security attribute information of the container image to be transferred, the public key and the private key required for the signature from the first security data source, wherein the first security data source is the security scanning result obtained after performing a security scan on the container image to be transferred.

3. The method according to claim 1, characterized in that Obtaining container image information of the container image to be transferred from the image storage platform includes: The container image information of the container image to be transferred is obtained from the container image stored in the image storage platform.

4. The method according to claim 1, characterized in that: The signature verification service of the first environment uses the private key to sign the security attribute information and the container image information, including: The signature verification service of the first environment integrates the security attribute information and the container image information to obtain data to be signed; The signature verification service of the first environment uses the private key to sign the data to be signed to obtain the signature data.

5. The method according to claim 1, characterized in that: The signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the acquired container image information and the security attribute information in the target OCI product, including: The signature verification service of the second environment integrates the obtained container image information and the security attribute information in the target OCI product to obtain the data to be verified; The signature verification service of the second environment uses the public key in the target OCI product and the signature data in the target OCI product to verify the data to be verified, and obtains the security attribute information in the target OCI product after the verification.

6. The method according to claim 1, characterized in that The security attribute information includes: whether it contains virus files, whether it contains patch vulnerabilities, and whether it is compliant.

7. The method according to claim 1, characterized in that The method further comprises: The signature verification service of the second environment obtains the public key required for signature verification from the second secure data source; Generate prompt information on whether the public keys are consistent based on the public key required for the signature verification and the public key in the target OCI product.

8. A device for delivering security attributes of a container image, characterized in that: include: A first acquisition unit, used for the signature verification service of the first environment to obtain security attribute information of the container image to be transferred, a public key and a private key required for the signature, and to obtain container image information of the container image to be transferred from the image storage platform; A signing unit, used for the signature verification service of the first environment to sign the security attribute information and the container image information using the private key to obtain signature data; A combination allocation unit, for the signature verification service of the first environment, combines the public key, the security attribute information and the signature data into an OCI product, allocates a container image tag to the OCI product, and further stores the OCI product carrying the container image tag to the image storage platform; Constructing an acquisition unit, the signature verification service for the second environment constructs a container image tag to be searched according to the container image name of the container image to be transferred, and acquires a target OCI artifact corresponding to the container image tag to be searched from the image storage platform according to the container image tag to be searched; A second acquisition unit, used for the signature verification service of the second environment to acquire the container image information of the container image to be delivered from the image storage platform; The signature verification unit is used for the signature verification service of the second environment to verify the obtained container image information and the security attribute information in the target OCI product using the public key in the target OCI product and the signature data in the target OCI product, and obtain the security attribute information in the target OCI product after the verification.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to execute the method according to any one of claims 1 to 7.

Images