Container memory space isolation detection method and system and related equipment
By creating a new container on the host machine and writing a random string, the shortcomings of container memory space isolation detection are solved, and accurate detection of whether container memory spaces are completely isolated is achieved, ensuring the security and independence of memory between containers.
Patent Information
- Application Number
- CN202510984174.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-17
- Publication Date
- 2025-11-14
AI Technical Summary
Existing technologies cannot effectively detect whether container memory spaces are completely isolated, which may cause memory leaks to affect the normal operation of other containers.
By creating first and second containers on the host machine, allocating the minimum memory to the second container, and creating and writing a text file with random strings in the first container, the second container is used to search for these strings to determine whether the memory space is isolated.
It enables accurate detection of whether container memory spaces are completely isolated, ensuring the security and independence of memory between containers and preventing memory leaks from affecting other containers.
Smart Images
Figure CN120950176A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to network data security technology, specifically to container data security technology. Background Technology
[0002] Virtualization technology has become a widely accepted method for sharing server resources, providing system administrators with great flexibility in the process of building operating system instances on demand.
[0003] Because hypervisor virtualization technology still has some performance and resource utilization efficiency issues, a new virtualization technology called containers has emerged to help solve these problems. Container technology refers to creating isolated groups on the physical host operating system, distributing the resources of the physical host operating system among these groups, and balancing conflicting resource usage demands between the groups. Compared to traditional virtualization technologies, container technology better enables running more workloads on the same hardware. Based on the powerful capabilities of container engines, applications can share the resources of the physical host operating system while remaining independent of each other.
[0004] With the development and use of container technology, the security risks faced by containers are receiving increasing attention. One of the most significant risks is memory isolation. When an application within a container has a memory leak, without memory isolation, it may continuously consume system memory resources. For example, a vulnerable web application container might experience a continuous increase in memory usage due to errors in its code, such as failing to properly release allocated memory. If memory space is not isolated, it may encroach on the memory share of other normally functioning containers. This can cause memory shortages in other containers, leading to slow response times or even crashes in the applications within those containers. Memory isolation ensures that each container has its own independent memory space, preventing memory leaks in one container from interfering with the normal memory usage of other containers.
[0005] Therefore, effectively detecting the isolation status of container memory space is crucial. However, existing memory security detection solutions cannot effectively detect whether container memory space is completely isolated, and thus cannot determine the memory security of the container. Summary of the Invention
[0006] To address the problem that existing memory security detection schemes cannot effectively detect the isolation status of container memory space, the present invention aims to provide a method for detecting the isolation of container memory space. This scheme can effectively and accurately detect whether the container memory space is completely isolated. In addition, the present invention further provides a detection system and related equipment that can implement this detection method.
[0007] To achieve the above objectives, the present invention provides a method for detecting container memory space isolation, comprising:
[0008] By creating a first container and a second container on the host machine, allocating the minimum memory space to the second container, and allocating all other allocatable memory space on the host machine to the first container;
[0009] Create N new text files in the first container, write the same random string into each of them, and then open all N text files.
[0010] Search the memory of the second container for a random string from the text file in the first container, and determine whether the container memory space is effectively isolated based on the search results.
[0011] Furthermore, the minimum memory space allocated in the second container is sufficient to enable the operating system on the second container to run.
[0012] Furthermore, a 20480-character random string is written into a newly created text file in the first container.
[0013] Furthermore, if the detection method finds the content of a corresponding random string by traversing the memory space in the second container, it determines that the memory space of the container is not effectively isolated.
[0014] If, within the second container, the content of the corresponding random string cannot be found by traversing the memory space, then the memory space of the container is deemed to be effectively isolated.
[0015] To achieve the above objectives, the present invention provides a container memory space isolation detection system, which includes a container creation module, a memory allocation module, a text creation module, a text management module, a search module, and a detection module.
[0016] The container creation module is configured to create a first container and a second container on the host machine;
[0017] The memory allocation module is configured to allocate space in the host machine's memory space, allocate the minimum memory space to the newly created second container, and allocate all other allocable memory space in the host machine to the newly created first container.
[0018] The text creation module is configured to create N text files in a newly created first container;
[0019] The text management module is configured to write the same random string into N newly created text files in the first container, and to open all N text files into which the random string has been written.
[0020] The search module is configured to traverse the memory space of the second container to search for random strings in the text file of the first container;
[0021] The detection module is configured to interact with the search module and can determine whether the container memory space is effectively isolated based on the search results.
[0022] Furthermore, the memory allocation module allocates the minimum memory space in the second container so that the operating system on the second container can run.
[0023] Furthermore, the text management module writes a 20480-bit random string into each newly created text file in the first container.
[0024] Furthermore, if the detection module can find the corresponding random string content in the memory space of the second container, it determines that the memory space of the container is not effectively isolated.
[0025] If the search module cannot find the corresponding random string content in the memory space of the second container, then the memory space of the container is determined to be effectively isolated.
[0026] To achieve the above objectives, the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps of the above-described detection method for container memory space isolation.
[0027] To achieve the above objectives, the present invention provides a processor for running a program, wherein the program executes the steps of the above-described method for detecting container memory space isolation.
[0028] To achieve the above objectives, the present invention provides a terminal device, the device including a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program code is loaded and executed by the processor to implement the steps of the above-described detection method for container memory space isolation.
[0029] To achieve the above objectives, the present invention provides a computer program product that, when executed on a data processing device, is adapted to perform the steps of the above-described container memory space isolation detection method.
[0030] The container memory space isolation detection scheme provided by this invention can automatically detect container memory isolation and verify the security of the container from the perspective of memory isolation. Attached Figure Description
[0031] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.
[0032] Figure 1This is a flowchart of the container memory space isolation detection method in this invention;
[0033] Figure 2 This is a system block diagram of the container memory space isolation detection system in this invention. Detailed Implementation
[0034] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below with reference to specific illustrations.
[0035] Through a thorough study of the technical characteristics of container memory space, this invention provides a detection method for container memory space isolation, which can effectively and accurately detect whether container memory space is completely isolated.
[0036] See Figure 1 The flowchart shown is an example of the container memory space isolation detection method given in this invention.
[0037] Based on the diagram, the detection method for container memory space isolation mainly includes the following steps:
[0038] (1) By creating a first container and a second container on the host machine, allocate the minimum memory space to the second container, and allocate all other allocatable memory space on the host machine to the first container;
[0039] (2) Create N new text files in the first container, write the same random string into each text file, and open all N text files into which the random string has been written;
[0040] (3) Search for random strings in the text file in the first container in the memory of the second container, and determine whether the container memory space is effectively isolated based on the search results.
[0041] The following details the specific implementation plan for each step in this container memory space isolation detection method.
[0042] As further explanation, in step (1) of this detection method, when creating the first container and the second container on the host machine, the first container and the second container with independent operating environments are generated by instantiating the image through a container engine (such as Docker) based on the same operating system kernel.
[0043] As a supplementary explanation, the memory allocated for the second container in this step is the minimum memory space required to allow the operating system on the second container to run.
[0044] In addition, by allocating the minimum memory space to the second container, it is possible to traverse all memory space at the fastest speed during memory space traversal, thereby improving the overall detection efficiency.
[0045] As further explanation, in step (2) of this detection method, it is preferable to create N text files in the first container using a loop command to create files in batches.
[0046] Furthermore, in step (2) of this detection method, a 20480-character random string is written for each newly created text file, and the written random string serves as a unique content marker, thereby enabling the target file to be quickly distinguished from other files.
[0047] Furthermore, string generation and writing have almost zero resource overhead, making them suitable for high-frequency detection and improving detection efficiency.
[0048] Furthermore, when all text files are opened, the corresponding file content is written into the memory of the first container. If the isolation is effective, the file content will not appear in the memory of the second container. Therefore, this method can effectively detect the isolation of container memory space.
[0049] As further explanation, in step (3) of this detection method, when searching for a random string in the text file of the first container in the memory of the second container, a memory snapshot of the second container is first generated to obtain a complete address space image; then, the memory mapping region corresponding to the loaded text file of the first container is identified to obtain the content of the random string; finally, a string matching algorithm is executed to determine whether there is a random string in the text file of the first container in the memory of the second container. This allows for a quick traversal search of the memory space of the second container and ensures the accuracy of the search results.
[0050] Furthermore, in step (3) of this detection method, if the content of the corresponding random string can be found in the memory space of the second container by traversing and searching the memory space, then it is determined that the memory space of the container is not effectively isolated.
[0051] If, within the second container, a search of the memory space fails to find the corresponding random string, then the container's memory space is considered to be effectively isolated.
[0052] The container memory space isolation detection method provided in this invention can be configured into a corresponding software program to form a container memory space isolation detection system. When running, this software program executes the aforementioned container memory space isolation detection method and implements the corresponding functions, while storing the results in a suitable storage medium for the processor to retrieve and execute.
[0053] See Figure 2The resulting container memory space isolation detection system 100 mainly includes the following functions: container creation module 110, memory allocation module 120, text creation module 130, text management module 140, search module 150, and detection module 160.
[0054] The container creation module 110 in this system is specifically configured to create a first container and a second container on the host machine.
[0055] The memory allocation module 120 in this system is configured to interact with the container creation module 110. After the container creation module 110 completes the creation of the first and second containers on the host machine, it can allocate space to the host machine's memory space, allocate the minimum memory space to the newly created second container, and allocate all other allocatable memory space on the host machine to the newly created first container.
[0056] The text creation module 130 in this system is configured to interact with the memory allocation module 120, and can create N text files in the first container after memory space allocation is completed.
[0057] The text management module 140 in this system is configured to interact with the text creation module 130. It can write the same random string into each of the N text files created by the text creation module 130 in the first container. That is, it writes the same random string into each text file. Based on this, it can further open all N text files into which the random string has been written.
[0058] The search module 150 in this system is configured to traverse the memory space of the second container to search for random strings in the text file of the first container.
[0059] The detection module 160 in this system is configured to interact with the search module 150, and can determine whether the container memory space is effectively isolated based on the search results.
[0060] As further explanation, the minimum memory space allocated by the memory allocation module 120 in this system for the second container is sufficient to enable the operating system on the second container to run.
[0061] As further explanation, the text management module 140 in this system preferably writes a 20480-bit random string into a newly created text file in the first container.
[0062] As further explanation, when the detection module 160 in this system performs effective isolation status detection and judgment of the container memory space based on the search results of the search module 150, if the search module 150 searches for the content of the corresponding random string in the second container by traversing the memory space, it determines that the container memory space is not effectively isolated.
[0063] If the search module 150 fails to find the corresponding random string content by traversing the memory space in the second container, it is determined that the memory space of the container is effectively isolated.
[0064] Regarding the container memory space isolation detection scheme provided by this invention, the following application examples further illustrate the implementation process of this scheme.
[0065] In this example, a corresponding base container memory space isolation detection system is first built based on the aforementioned scheme, and then the base container memory space isolation detection system is deployed and run on the corresponding host machine A to be detected.
[0066] Based on this, the detection system runs its own logic to complete the detection of the completely isolated state of the container's memory space. The entire detection process includes the following steps:
[0067] The system first creates a first container and a second container on host machine A, allocates the minimum memory space to the second container, and allocates the remaining allocatable memory space of host machine A to the first container. By allocating the minimum memory space to the second container 2, the system can traverse all memory space as quickly as possible when performing memory space traversal.
[0068] Next, for the first container with allocated memory space, N text files are created simultaneously on the first container, and the same 20480-character random string is written into each text file. Then, these N text files are opened and run on container 1.
[0069] Next, the memory of the newly created second container is traversed and searched for a 20480-character random string in the text file of the first container to determine whether the container memory is effectively isolated. If the container memory space is not effectively isolated, then in the second container, by traversing the memory space, all or part of the 20480-character random string can be read; conversely, if the container memory space is effectively isolated, then in the memory space of the second container, all or part of the 20480-character random string cannot be read. That is:
[0070] If, by traversing the memory space of the second container, all or part of the content of a 20480-character random string can be searched and read, then it is determined that the container memory space is not effectively isolated.
[0071] If, by traversing the memory space of the second container, it is impossible to search and read the entire content or part of the 20480-character random string, then the container memory space is considered to have been effectively isolated.
[0072] This enables effective detection and secure isolation of container memory space.
[0073] As an example, this instance is implemented primarily using the following specific algorithm:
[0074] Traversing memory;
[0075] If content(memory)==content or half of the content(20480bit randomstring)
[0076] print”The container does not implement memory isolation”
[0077] else
[0078] print”The container does implement memory isolation”
[0079] It should be noted that the algorithm described above is not the only way to implement this judgment process.
[0080] Based on the above examples, it can be seen that the solution provided by this invention can automatically and effectively detect whether the container memory space is completely isolated. Compared with traditional container isolation detection methods, it has the following advantages:
[0081] 1. Traditional container isolation testing only focuses on whether storage space and processes are effectively isolated, without addressing memory space isolation testing, and cannot comprehensively and accurately test the isolation security of containers.
[0082] 2. Because the computer automatically detects whether memory is isolated, the memory isolation of the container can be effectively assessed more quickly, ensuring its security.
[0083] As a further explanation, based on the above-described method for detecting container memory space isolation, this embodiment of the invention also provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the steps of the above-described method for detecting container memory space isolation.
[0084] This invention also provides a processor for running a program, wherein the program executes the steps of the container memory space isolation detection method described above.
[0085] This invention also provides a terminal device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. The program code is loaded and executed by the processor to implement the steps of the above-described container memory space isolation detection method.
[0086] The present invention also provides a computer program product, which, when executed on a data processing device, is adapted to perform the steps of the above-described container memory space isolation detection method.
[0087] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.
[0088] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0089] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0090] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0091] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0092] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0093] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0094] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0095] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.
[0096] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0097] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0098] The method, specific system unit, or part thereof of the present invention described above is a pure software architecture. It can be deployed via program code on physical media, such as hard disks, optical discs, or any electronic device (such as smartphones or computer-readable storage media). When a machine loads and executes the program code (e.g., a smartphone loads and executes it), the machine becomes an apparatus for implementing the present invention. The method and apparatus of the present invention can also be transmitted in program code form via transmission media, such as cables, optical fibers, or any transmission method. When the program code is received, loaded, and executed by a machine (e.g., a smartphone), the machine becomes an apparatus for implementing the present invention.
[0099] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.
Claims
1. A method for detecting container memory space isolation, characterized in that, include: By creating a first container and a second container on the host machine, allocating the minimum memory space to the second container, and allocating all other allocatable memory space on the host machine to the first container; Create N new text files in the first container, write the same random string into each of them, and then open all N text files. Search the memory of the second container for a random string from the text file in the first container, and determine whether the container memory space is effectively isolated based on the search results.
2. The method for detecting container memory space isolation according to claim 1, characterized in that, The minimum memory space allocated in the second container is sufficient to allow the operating system on the second container to run.
3. The method for detecting container memory space isolation according to claim 1, characterized in that, Write a 20480-character random string into a newly created text file in the first container.
4. The method for detecting container memory space isolation according to claim 1, characterized in that, If the detection method finds the content of the corresponding random string by traversing the memory space in the second container, it determines that the memory space of the container is not effectively isolated. If, within the second container, the content of the corresponding random string cannot be found by traversing the memory space, then the memory space of the container is deemed to be effectively isolated.
5. A detection system for isolated container memory space, characterized in that, The system includes a container creation module, a memory allocation module, a text creation module, a text management module, a search module, and a detection module. The container creation module is configured to create a first container and a second container on the host machine; The memory allocation module is configured to allocate space in the host machine's memory space, allocate the minimum memory space to the newly created second container, and allocate all other allocable memory space in the host machine to the newly created first container. The text creation module is configured to create N text files in a newly created first container; The text management module is configured to write the same random string into N newly created text files in the first container, and to open all N text files into which the random string has been written. The search module is configured to traverse the memory space of the second container to search for random strings in the text file of the first container; The detection module is configured to interact with the search module and can determine whether the container memory space is effectively isolated based on the search results.
6. The detection system for container memory space isolation according to claim 5, characterized in that, The memory allocation module allocates the minimum memory space in the second container so that the operating system on the second container can run.
7. The detection system for container memory space isolation according to claim 6, characterized in that, The text management module writes a 20480-character random string into each newly created text file in the first container.
8. The detection system for container memory space isolation according to claim 6, characterized in that, The detection module determines that the memory space of the container is not effectively isolated when the search module is able to search for the corresponding random string content in the memory space of the second container. If the search module cannot find the corresponding random string content in the memory space of the second container, then the memory space of the container is determined to be effectively isolated.
9. A computer-readable storage medium having a program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the container memory space isolation detection method according to any one of claims 1-4.
10. A computer program product, characterized in that, When executed on a data processing device, it is suitable for performing the steps of the container memory space isolation detection method according to any one of claims 1-4.