Information processing method and device for ensuring safety of operation container environment

Abstract

The invention discloses an information processing method and device for ensuring the safety of a running container environment, and relates to the technical field of information processing.The method comprises the steps that after it is determined that resource expansion is conducted on a current service in an enabled monitoring environment, a resource scheduling service obtains a request for conducting resource expansion on a certain service from the monitoring environment, determining a newly allocated resource for the certain service; and the resource scheduling service calls a service task scheduler plug-in, so that the service task scheduler plug-in generates to-be-processed task information for the newly allocated resources, and sends the to-be-processed task information to the resource scheduling service, so that the resource scheduling service calls a deployment upgrading service. Through the endogenous safe strong isolation container, the isolation level of the container is improved, the probability that the container is attacked and the attack severity are reduced, risks are prevented from being further diffused, the safety of services on a cloud platform is improved, the purpose of improving the safety of the container is achieved, and the safety protection capacity is improved.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to an information processing method and device for ensuring the security of a running container environment. Background Art

[0002] In scenarios with high security requirements, the security isolation requirements for containers are relatively stringent.

[0003] In modern enterprise applications and cloud computing environments, containers are used as the basic unit for service operation and scheduling, and the pure software isolation implementation method of the operating system kernel is adopted. There are some new security issues and security risks: the container and the host machine share a kernel. As long as the kernel is attacked, the host machine can be accessed through the container, or other containers can be entered, resulting in escape, which poses a kernel security risk; Namespace and cgroup are not safe, and not all resources are isolated. Neither of these two types has a very complete isolation.

[0004] In related technologies, the security protection capabilities of container isolation measures need to be improved for scenarios with higher security requirements. Summary of the invention

[0005] The main purpose of the present invention is to provide an information processing method and device for ensuring the security of the running container environment, so as to solve the deficiencies existing in the related technology.

[0006] In order to achieve the above-mentioned purpose, according to the first aspect of the present invention, there is provided an information processing method for ensuring the security of a running container environment, comprising: after the enabled monitoring environment determines to perform resource expansion on the current service, the resource scheduling service obtains a request for resource expansion on a certain service from the monitoring environment, and determines newly allocated resources for the certain service, wherein the enabled monitoring environment obtains real-time status information of different sub-resource pools of the cloud platform server and real-time operating status information of each service deployed and operated by the cloud platform when determining whether to perform resource expansion on a certain service; and determines whether to perform resource expansion on a certain service based on the real-time status information of the different sub-resource pools and the real-time operating status information of the each service; the resource scheduling service calls a service task scheduler plug-in so that the service task scheduler plug-in generates pending task information for the newly allocated resources, and sends the pending task information to the resource scheduling service, so that the resource scheduling service calls a deployment upgrade service, wherein the deployment upgrade service creates a container for the certain service and creates a service instance in the container through the server indicated by the newly allocated resources.

[0007] Optionally, before the enabled monitoring environment obtains the real-time status information of different sub-resource pools of the cloud platform server and the real-time operating status information of each service deployed and run by the cloud platform, different servers are divided into the same sub-resource pool; different sub-resource pools are subjected to traffic control; wherein, the basis for the division is to divide the security level of the server based on the level division strategy; the services deployed and run by the cloud platform are divided into service levels; each service is determined to have a corresponding core degree; services with different core degrees are sorted in descending order, wherein the core degree is used as the basis for the order of resource allocation.

[0008] Optionally, when the resource scheduling service determines newly allocated resources for the certain service, the method includes: determining the corresponding resource demand data for the certain service; determining the service confidentiality level and the security level of the server to determine a target sub-resource pool that matches the certain service; determining the remaining resource information of each server in the target sub-resource pool; and determining the server corresponding to the certain service based on the remaining resource information and the resource demand data.

[0009] Optionally, the method also includes determining container risks through a container monitoring module: the container monitoring module obtains real-time security indicator information of the container in the running container environment from a container anomaly monitoring tool; based on the security indicator information and the security level of the server corresponding to the container, determines the risk scores of multiple preset indicator items, and determines the target risk score based on the scores under each of the preset indicator items; based on the risk level to which the target risk score belongs, executes different risk handling processes.

[0010] Optionally, when determining the scores under each of the preset indicators, the method includes: a first score determined based on whether the system is deployed on different cloud computing nodes according to different service confidentiality levels; a second score determined based on whether network security services and business services are deployed in isolation; a third score determined based on whether the source of the container image is trustworthy, whether the image has vulnerabilities, and the level of the vulnerabilities; a fourth score determined based on whether the image is minimized and whether the proportion of non-essential components is the lowest; a fifth score determined based on whether there is an image signature and integrity check; a sixth score determined based on detecting abnormal processes, file systems, and network behaviors; a seventh score determined based on monitoring resource abuse; an eighth score determined based on container escape defense configuration; and a ninth score determined based on regular abnormal traffic, software vulnerabilities or configuration errors, data security, and malware scanning.

[0011] Optionally, based on the risk level to which the target risk score belongs, executing different risk handling processes includes: if the risk level is medium, cutting off the inlet and outlet traffic of the server node where the risk container is located; if the risk level is high, cutting off the inlet and outlet traffic of the server node where the risk container is located, and outputting an alarm message.

[0012] According to a second aspect of the present invention, there is provided an information processing device for ensuring the security of a running container environment, comprising: a resource allocation determination unit, wherein after an enabled monitoring environment determines to perform resource expansion on a current service, a resource scheduling service obtains a request for resource expansion on a certain service from the monitoring environment, and determines newly allocated resources for the certain service, wherein the enabled monitoring environment obtains real-time status information of different sub-resource pools of a cloud platform server and real-time operating status information of each service deployed and operated by the cloud platform when determining whether to perform resource expansion on a certain service; and determines whether to perform resource expansion on a certain service based on the real-time status information of the different sub-resource pools and the real-time operating status information of each service; a resource expansion unit, wherein the resource scheduling service calls a service task scheduler plug-in so that the service task scheduler plug-in generates pending task information for the newly allocated resources, and sends the pending task information to the resource scheduling service, so that the resource scheduling service calls a deployment upgrade service, wherein the deployment upgrade service creates a container for the certain service and creates a service instance in the container through the server indicated by the newly allocated resources.

[0013] According to a third aspect of the present invention, there is provided a computer-readable storage medium storing computer instructions for causing the computer to execute the method described in the first implementation manner of the first aspect.

[0014] According to a fourth aspect of the present invention, there is provided an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the method described in the first implementation manner of the first aspect.

[0015] The inherently secure strong isolation container technology of this embodiment uses physical isolation technology based on the security level of tenant equipment to isolate the user perception layer of the container, thereby improving the isolation level of the container, reducing the probability of the container being compromised and the severity of the compromise, preventing the risk from further spreading, and improving the security of services on the cloud platform. The purpose of improving container security has been achieved, and the security protection capability has been improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 is a flow chart of an information processing method for ensuring the security of a running container environment according to an embodiment of the present invention; Figure 2 This is a schematic diagram of an application of an information processing method for ensuring the security of a running container environment according to an embodiment of the present invention; Figure 3 is a schematic diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0019] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present invention described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0020] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0021] According to an embodiment of the present invention, a method for information processing to ensure the security of a running container environment is provided. This method can improve security through the intrinsically secure strong isolation container technology. Figure 1 As shown, it includes the following steps 101 to 102: Step 101: After the enabled monitoring environment determines to expand resources for the current service, a resource scheduling service is provided, wherein the enabled monitoring environment obtains real-time status information of different sub-resource pools of the cloud platform server and real-time operating status information of each service deployed and operated by the cloud platform when determining whether to expand resources for a certain service; and determines whether to expand resources for a certain service based on the real-time status information of the different sub-resource pools and the real-time operating status information of each service.

[0022] In this step, refer to Figure 2 ,The operation monitoring environment collects two types of status data in real time: the current resource usage status of the cloud platform server resource pool, and the real-time operation status of the service cluster. It determines whether the service resources need to be expanded based on the operation status. At the same time, it determines whether there are expandable resources by comparing the resource usage. If both conditions are met, the resource scheduling service allocates new resources to the service.

[0023] As an optional implementation method of this embodiment, before the enabled monitoring environment obtains the real-time status information of different sub-resource pools of the cloud platform server and the real-time operating status information of each service deployed and run by the cloud platform, different servers are divided into the same sub-resource pool; different sub-resource pools are subjected to traffic control; wherein, the basis for the division is to divide the security level of the server based on the level division strategy; the services deployed and run by the cloud platform are divided into service confidentiality levels; each service is determined to have a corresponding core degree; services with different core degrees are sorted in descending order, wherein the core degree is used as the basis for the order of resource allocation.

[0024] In this optional implementation, based on the physical isolation of the tenant device security level, the server security level is divided. The security level of the server is divided by security policy and its own performance, and different security level labels are added to the server. The server is divided into different security levels according to the added security level labels. In this way, the unified resource pool is divided into sub-resource pools of different levels.

[0025] When controlling the flow of different sub-resource pools, use network tools such as iptables to control the flow of sub-resource pools with different security levels, so that services in sub-pools with the same security level can access each other, ensuring that servers in the same security level can communicate and collaborate normally. Allow servers in sub-resource pools with high security levels to access servers in sub-resource pools with low security levels. This access is usually one-way to meet management and monitoring needs. Forbid servers in sub-resource pools with low security levels to access servers in sub-resource pools with high security levels, further preventing potential security threats such as malicious attacks and data theft.

[0026] When performing classification, you can add service classification information when describing the resources required for the service, and classify the service classification based on the sensitivity of the data, the importance of the business, and the potential security risks. The service classification information mainly provides a scheduling basis for container orchestration and scheduling. When scheduling containers, the scheduler will match the sub-resource pool of the corresponding level according to the service classification information.

[0027] When performing core degree division, core degree information can be added when describing the resources required by the service. The core degree division can be determined based on factors such as the business importance of the service, the degree of dependence on the system function, and the relationship between services.

[0028] It should be understood that the above divisions can all be configured by the user through the management terminal based on the configuration mode.

[0029] Step 102: The resource scheduling service calls the service task scheduler plug-in so that the service task scheduler plug-in generates pending task information for the newly allocated resources, and sends the pending task information to the resource scheduling service, so that the resource scheduling service calls the deployment upgrade service, wherein the deployment upgrade service creates a container for the service through the server indicated by the newly allocated resources and creates a service instance in the container.

[0030] In this step, the resource scheduling service allocates new resources to the service using the scheduling algorithm according to the current available resources, and submits the newly allocated resources to the task scheduler plug-in of the service. The task scheduler of the service processes the tasks based on the allocated resources and hands over the resources and tasks to the resource scheduling service; the resource scheduling service hands over the resources and tasks to the deployment and upgrade service; the deployment and upgrade service finds the server that provides the resources based on the resource information, and based on the microservice operation management agent of the server and the task executor of the service, obtains the container image according to the service information, creates a Docker container, and updates and improves the configuration information of the service; assuming that service A needs to be expanded, the task executor of the service starts service A in the container, creates service instance A3, and service instance A3 registers the service in the A service cluster to achieve the expansion of the service A cluster.

[0031] As an optional implementation method of this embodiment, when the resource scheduling service determines the newly allocated resources for the certain service, the method includes: determining the corresponding resource demand data for the certain service; determining the service confidentiality level and the security level of the server to determine the target sub-resource pool that matches the certain service; determining the remaining resource information of each server in the target sub-resource pool; and determining the server corresponding to the certain service based on the remaining resource information and the resource demand data.

[0032] In this optional implementation, it is assumed that the software service set is A={a1, a2, ..., a m}, the server set is S={s1,s2,…,s n}, according to the core degree of software services (a i ) Sort the services from high to low and calculate the resource requirements for each software service ai (resource) i) = (r i1 , r i2 , r i3 ) (representing CPU, memory, and disk resources respectively), server s j The remaining resources remaining (s j ) = (rr j1 ,rr j2 ,rr j3 ), let software service a i The confidentiality level is sec (a i ), servers j The confidentiality level is sec (s j ), then find the value that satisfies sec (a i ) <= sec(s j )and Minimum Servers j Deploy a i .

[0033] This embodiment introduces a two-level scheduling mechanism of service density and service coreness by clarifying the service density and service coreness to match the sub-resource pool of the corresponding level and implementing a cross-level deployment strategy. It supports dynamic expansion and contraction of service clusters, ensures that the security and performance requirements of the service are met, improves overall resource utilization, and can further improve the security and stability of the platform.

[0034] As an optional implementation of this embodiment, the method also includes using a container monitoring module to determine container risks: the container monitoring module obtains real-time security indicator information of the container in the running container environment from the container anomaly monitoring tool; based on the security indicator information and the security level of the server corresponding to the container, determines the risk scores of multiple preset indicator items, and determines the target risk score based on the scores under each of the preset indicator items; based on the risk level to which the target risk score belongs, executes different risk handling processes.

[0035] In this optional implementation, the security isolation of containers can be further achieved through automated flow control of container threats. Commonly used image scanning tools such as Trivy and Clair, as well as container abnormal behavior monitoring tools such as Falco, can be used to monitor container security in real time. Based on the monitoring results and the server security level, the risk is comprehensively rated, and the weighted influence of high-security level servers on the risk rating is increased to further improve the risk level of high-security level servers. The overall risk level is divided into three levels: high, medium and low, which are comprehensively evaluated by the risk rating algorithm.

[0036] As an optional implementation method of this embodiment, based on the risk level to which the target risk score belongs, different risk handling processes are executed, including: if the risk level is medium, cutting off the inlet and outlet traffic of the server node where the risk container is located; if the risk level is high, cutting off the inlet and outlet traffic of the server node where the risk container is located, and outputting an alarm message.

[0037] In this optional implementation, in addition to conventional danger warnings, for medium-level risks, an automatic defense mechanism needs to be activated to isolate the risk range. With the help of iptables rules, a two-way blocking method at the container level and the server level is completed, that is, in addition to cutting off the inlet and outlet traffic of the risk container / the server node where the risk container is located, other normal containers / the server nodes where normal containers are located also deny access to the risk container / the container on the server node where the risk container is located, to prevent the risk from further expanding. For high-level risks, in addition to taking medium-risk isolation measures, the alarm prompts the user to manually intervene to block the risk source as soon as possible and confirm whether to stop the service.

[0038] As an optional implementation method of the present embodiment, when determining the scores under each of the preset indicators, the method includes: a first score determined based on whether the images are deployed on different cloud computing nodes according to different service confidentiality levels; a second score determined based on whether network security services and business services are deployed in isolation; a third score determined based on whether the source of the container image is trustworthy, whether the image has vulnerabilities, and the level of the vulnerabilities; a fourth score determined based on whether the image is minimized and whether the proportion of non-essential components is the lowest; a fifth score determined based on whether there is an image signature and integrity check; a sixth score determined based on detecting abnormal processes, file systems, and network behaviors; a seventh score determined based on monitoring resource abuse; an eighth score determined based on container escape defense configuration; and a ninth score determined based on regular abnormal traffic, software vulnerabilities or configuration errors, data security, and malware scanning.

[0039] In this optional implementation, the monitoring indicators include 9 items, assuming that the rating factor is F i (i=1~9), the corresponding weight is w j (j=1~9), and =1, the scores of various indicators are shown in Table 1, the score range is 0 to 10, 0 means the safest, 10 means the most dangerous. Risk assessment first scores each safety rating factor according to Table 1 to obtain the score S i (i=1~9), and , the comprehensive risk score is R, and the calculation formula is ,when Indicates that the system risk is low. Indicates a high risk, the risk level is medium risk. Indicates that the risk is very high and the level is high risk. For each indicator item and calculation rules, refer to Table 1: Table 1 This embodiment adopts the above-mentioned intrinsic security strong isolation container technology solution, and uses physical isolation technology based on the security level of tenant equipment and container threat automatic flow control technology to isolate the user perception layer of the container, improve the isolation level of the container, reduce the probability of the container being compromised and the severity of the compromise, prevent the risk from further spreading, and improve the security of services on the cloud platform. The purpose of improving container security is achieved, and the security protection capability is improved by 20%.

[0040] In order to further improve the security protection capability, we can further adopt the container's inherent security enhancement method. Based on the traditional security protection mechanism, the container security enhancement method proposed in this article mainly designs an inter-node encryption control strategy in the container scheduling system to ensure the security enhancement of container scheduling, designs a container-based resource and permission management system, strengthens the resource management and isolation capabilities of the container application itself, and establishes a container-level security protection system, including container layer security, container scheduling system security, and container-based application systems.

[0041] Container scheduling security enhancement: When containers are used on a large scale, they rely on the scheduling system to automatically scale and recover. In the container security enhancement plan, the focus is on strengthening the security of the container scheduling system. TLS encryption is innovatively enabled between nodes, and role permissions are differentiated for different users and controlled with ACL. The management node uses a secure port and performs security authentication through certificates as the only entrance to access the backend storage to increase security, search for vulnerable software and obtain image metadata, communicate with other authorization centers before running the image, and add its own unique security policies through the Authorizer interface.

[0042] Container application security enhancement: In response to the problem of weak resource isolation of the container platform, a resource and permission management system based on the Docker platform is designed to strengthen the resource management and isolation capabilities of the container application itself. The multi-tenant design of the application takes into account the permission access control of tenants, involving the overall permission control architecture of the container cloud platform, and adopts the concept of permission and resource management center to meet the resource and permission isolation requirements of the container cloud platform.

[0043] Through independent security management processes and plug-in collections, a unified authority center is implemented, which can dynamically control the components and functions of the container cloud to meet the flexible needs of different application scenarios.

[0044] First, a hierarchical organizational structure is adopted. Application management and tenant resource management are distinguished. Application management includes deployment, viewing, operation and maintenance, deletion, etc.; tenant resource management includes application, use, and redistribution permissions.

[0045] The second is the definition of the role-based permission model. This is done by defining permissions and providing the tenant with a list of functions provided by the container cloud. Roles can be predefined, such as the tenant administrator role, application administrator role, etc.

[0046] The third is user domain-based login authentication and management. Define the concept of user name + domain. The tenant is the access control space of the domain and is associated with network virtualization isolation. The tenant account is the domain name, and login authentication is performed in the form of useraccount@domainName.

[0047] Fourth, use containers as resource management units. Use labels to classify resources, fully and effectively utilize resources in the container cloud, achieve resource isolation, and realize on-demand resource allocation.

[0048] Container management security enhancement: Container image-level security enhancement. Create a local secure image repository server, keep the latest software in the image, use trusted image files and download them through secure channels, rebuild the image instead of patching the container and image, manage image tags reasonably and remove unused images in a timely manner, use image scanning and use image signatures.

[0049] Container-level security enhancement: By trimming down the container size and built-in services, limiting the permissions of applications in the container, simplifying applications, separating data from functions, limiting the available process tree in the container and remote access to the container, high-security container security is provided.

[0050] Container security audit and inspection. This includes regular security audits of host systems and containers, reasonable scheduling of host resources used by containers, monitoring container status and collecting threat events, and providing security log audit capabilities.

[0051] By designing a container-layer security enhancement solution, strengthening the security of the container scheduling system, increasing the security management methods for container-based application systems, and establishing a container-level security protection system.

[0052] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0053] According to an embodiment of the present invention, an information processing device for ensuring the security of a running container environment is also provided, comprising: a resource allocation determination unit, which obtains a request for resource expansion for a certain service from a monitoring environment, and a resource scheduling service determines newly allocated resources for the certain service, wherein, when determining whether to expand resources for a certain service, the enabled monitoring environment obtains real-time status information of different sub-resource pools of a cloud platform server and real-time operating status information of each service deployed and running on the cloud platform; and judges whether to expand resources for a certain service based on the real-time status information of the different sub-resource pools and the real-time operating status information of each service; a resource expansion unit, wherein the resource scheduling service calls a service task scheduler plug-in so that the service task scheduler plug-in generates pending task information for the newly allocated resources, and sends the pending task information to the resource scheduling service, so that the resource scheduling service calls a deployment upgrade service, wherein the deployment upgrade service creates a container for the certain service and creates a service instance in the container through the server indicated by the newly allocated resources.

[0054] According to an embodiment of the present invention, the present invention further provides a readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to implement the method described in any of the above embodiments when executed.

[0055] According to an embodiment of the present invention, the present invention further provides a computer program product, which can implement the method described in any of the above embodiments when executed by a processor.

[0056] According to an embodiment of the present invention, the present invention also provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can implement the method described in any of the above embodiments when executing.

[0057] Figure 3 A schematic block diagram of an example electronic device that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices.

[0058] like Figure 3As shown, the electronic device includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device can also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0059] A number of components in the electronic device are connected to the I / O interface 305, including: an input unit 306, such as a keyboard, a mouse, etc.; an output unit 307, such as various types of displays, speakers, etc.; a storage unit 308, such as a disk, an optical disk, etc.; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 309 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0060] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above, such as the object matching method. For example, in some embodiments, the object matching method may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via a ROM 302 and / or a communication unit 309. When the computer program is loaded into the RAM 303 and executed by the computing unit 301, one or more steps of the method described above may be performed.

[0061] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0062] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0063] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

Claims

1. An information processing method for ensuring the security of a running container environment, characterized in that: include: After the enabled monitoring environment determines to perform resource expansion on the current service, the resource scheduling service obtains a request for performing resource expansion on a certain service from the monitoring environment, and determines newly allocated resources for the certain service, wherein the enabled monitoring environment obtains real-time status information of different sub-resource pools of the cloud platform server and real-time operating status information of each service deployed and operated by the cloud platform when determining whether to perform resource expansion on a certain service; and determines whether to perform resource expansion on a certain service based on the real-time status information of the different sub-resource pools and the real-time operating status information of each service; The resource scheduling service calls the service task scheduler plug-in so that the service task scheduler plug-in generates pending task information for the newly allocated resources, and sends the pending task information to the resource scheduling service, so that the resource scheduling service calls the deployment upgrade service, wherein the deployment upgrade service creates a container for the service through the server indicated by the newly allocated resources and creates a service instance in the container.

2. The information processing method for ensuring the security of the running container environment according to claim 1 is characterized in that: Before the enabled monitoring environment obtains the real-time status information of different sub-resource pools of the cloud platform server and the real-time operation status information of each service deployed and operated by the cloud platform, different servers are divided into the same sub-resource pool; different sub-resource pools are subjected to flow control; wherein the basis for the division is to divide the security level of the server based on the level division strategy; The services deployed and run on the cloud platform are classified into service levels; Each service is determined to have a corresponding core degree; Services with different coreness are sorted in descending order, wherein the coreness serves as the basis for the resource allocation order.

3. The information processing method for ensuring the security of the running container environment according to claim 2 is characterized in that: When the resource scheduling service determines the newly allocated resources for the certain service, the method includes: Determining resource demand data corresponding to the certain service; Determine the service confidentiality level, the security level of the server and determine a target sub-resource pool matching the certain service; Determine the remaining resource information of each server in the target sub-resource pool; and determine the server corresponding to the certain service based on the remaining resource information and the resource demand data.

4. The information processing method for ensuring the security of the running container environment according to claim 3 is characterized in that: The method also includes determining container risks through a container monitoring module: The container monitoring module obtains real-time security indicator information of the container in the running container environment from the container anomaly monitoring tool; Determine risk scores of a plurality of preset indicator items based on the security indicator information and the security level of the server corresponding to the container, and determine a target risk score based on the scores under each of the preset indicator items; Based on the risk level to which the target risk score belongs, different risk handling processes are performed.

5. The information processing method for ensuring the security of the running container environment according to claim 4 is characterized in that: When determining the scores under each of the preset indicators, the method includes: A first score determined based on whether the nodes are deployed on different cloud computing nodes according to different service levels; The second score is determined based on whether network security services are deployed in isolation from business services; The third score is based on whether the source of the container image is trustworthy, whether the image has vulnerabilities, and the vulnerability level; A fourth score is determined based on whether the image is minimized and whether the proportion of non-essential components is minimal; A fifth score determined based on whether there is an image signature and integrity check; The sixth score is determined based on detecting abnormal behaviors of processes, file systems, and networks; A seventh score determined based on monitoring resource misuse; An eighth score based on container escape defense configuration; Ninth score determined based on regular abnormal traffic, software vulnerabilities or configuration errors, data security, and malware scanning.

6. The information processing method for ensuring the security of the running container environment according to claim 4 is characterized in that: Based on the risk level to which the target risk score belongs, different risk handling processes are performed including: If the risk level is medium, cut off the ingress and egress traffic of the server node where the risk container is located; If the risk level is high, the inlet and outlet traffic of the server node where the risk container is located is cut off and an alarm message is output.

7. An information processing device for ensuring the security of a running container environment, characterized in that: include: The resource allocation determination unit, after the enabled monitoring environment determines to expand resources for the current service, the resource scheduling service obtains a request for resource expansion for a certain service from the monitoring environment, and determines the newly allocated resources for the certain service, wherein the enabled monitoring environment obtains the real-time status information of different sub-resource pools of the cloud platform server and the real-time running status information of each service deployed and running on the cloud platform when determining whether to expand resources for a certain service; and determines whether to expand resources for a certain service based on the real-time status information of the different sub-resource pools and the real-time running status information of each service; A resource extension unit, wherein the resource scheduling service calls a service task scheduler plug-in so that the service task scheduler plug-in generates pending task information for the newly allocated resources, and sends the pending task information to the resource scheduling service, so that the resource scheduling service calls a deployment upgrade service, wherein the deployment upgrade service creates a container for the service through the server indicated by the newly allocated resources and creates a service instance in the container.

8. The information processing device for ensuring the security of the running container environment according to claim 7, characterized in that: Before the enabled monitoring environment obtains the real-time status information of different sub-resource pools of the cloud platform server and the real-time operation status information of each service deployed and operated by the cloud platform, different servers are divided into the same sub-resource pool; different sub-resource pools are subjected to flow control; wherein the basis for the division is to divide the security level of the server based on the level division strategy; The services deployed and run on the cloud platform are classified into service levels; Each service is determined to have a corresponding core degree; Services with different coreness are sorted in descending order, wherein the coreness serves as the basis for the resource allocation order.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the information processing method for ensuring the security of the running container environment according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 5.

Images