Security control methods for network communication in container scenarios

Abstract

This invention relates to a security control method for network communication in a containerized environment, belonging to the field of communication security technology. The method includes: sending data packets within a container; matching the source IP address of the data packet with the container IP address in a first storage space according to the container's network layer processing logic; if a match is found, storing the application's inode number in a reserved field; sending the data packet through the container's internal network card to the peer network card of an extended Linux Bridge; the extended Linux Bridge matching the source IP address and application inode number of the data packet with the mapping relationship between the container IP address and application inode number in the first storage space; if a match is found, the extended Linux Bridge allows the application's data packet to pass. This invention achieves process-level network communication security control in a containerized environment, improving the fine-grained control and anti-attack performance, while consuming low resources and incurring low costs.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, and in particular to a security control method for network communication in a container scenario. Background Technology

[0002] In recent years, container technology has been increasingly widely used, and its flexibility and lightweight nature have made it the preferred choice for modern software development and deployment. However, with the growth in the number and scale of containers, secure communication management between containers has become a challenge. The current mainstream network communication control methods are as follows:

[0003] 1. Firewall rules: Configure firewall rules to allow or deny traffic from specific IP addresses.

[0004] 2. NAT (Network Address Translation) device: Configure a NAT device to restrict access from specific IP addresses.

[0005] 3. Router Access Control Lists (ACLs): Configure ACLs on the router to restrict access from specific IP addresses or subnets.

[0006] 4. Internal DNS server configuration: Configure the internal DNS server so that only specific domain name resolution requests are allowed.

[0007] 5. MAC address: Network devices (such as switches and wireless routers) use the device's MAC address to allow or block it from accessing network resources.

[0008] 6. Flow Tables: Flow table rules are used to match traffic and execute actions to achieve traffic control.

[0009] The above solutions can all achieve traffic control in container scenarios, but they have the following problems:

[0010] 1) Traditional flow control technologies require significant processing power and memory resources on network devices to handle traffic filtering and management. This can increase the load on network devices, affecting their performance and response speed.

[0011] 2) Traditional traffic control technologies primarily rely on network-level identification, which cannot accurately distinguish the traffic of multiple applications running on the same device, resulting in an inability to perform personalized traffic management for each application. In the face of complex network environments and changing application requirements, they lack sufficient flexibility and adaptability, and cannot effectively address traffic management needs in different scenarios.

[0012] 3) Traditional technologies cannot accurately identify and distinguish malicious traffic because they cannot map traffic to specific applications or processes. This makes it difficult to detect and block potential security threats, such as malware or cyberattacks, in a timely manner.

[0013] 4) Traditional technologies cannot identify forged programs. When a malicious program forges information such as the program name to appear as a trusted program for traffic control, traditional technologies cannot identify it and will still allow the malicious program's traffic, posing a significant security risk.

[0014] 5) Some methods in traditional technologies require the addition of physical hardware, which increases development and usage costs.

[0015] Traditional cybersecurity measures are often ineffective in adapting to dynamic and highly interconnected container environments, thus requiring a more granular, secure, and resource-efficient cybersecurity control method. Summary of the Invention

[0016] Based on the above analysis, the embodiments of the present invention aim to provide a security control method for network communication in a container scenario, in order to solve the problem of the lack of a network security control method that is more refined, more secure and has low resource consumption.

[0017] On one hand, embodiments of the present invention provide a security control method for network communication in a container scenario. The method includes: a first application within a first container requests to send a data packet to a destination port of a destination address; according to the processing logic of the network layer of the first container, the source IP address of the data packet is matched with the container IP address in a first storage space; if a container IP address matching the source IP address exists in the first storage space, the inode number of the first application is stored in a reserved field of the data packet; the modified data packet is sent to a first internal network interface card (NIC) of the first container, and the first NIC sends the data packet through the network to a first peer NIC of an extended Linux Bridge connected to the first NIC; the extended Linux Bridge matches the source IP address of the data packet and the inode number of the first application with the mapping relationship between the container IP address and the application inode number in the first storage space; in response to the existence of a matching entry between the source IP address and the inode number of the first application in the mapping relationship, the extended Linux Bridge allows the data packet of the first application to pass through and forwards the data packet to the destination port of the destination address.

[0018] The beneficial effects of the above technical solution are as follows: it realizes process-level network communication security control in container scenarios, improves the fine-grained control and anti-attack performance of network security control, and has the advantages of low resource consumption and low cost.

[0019] Based on a further improvement of the above method, after the extended Linux Bridge matches the source IP address of the data packet and the inode number of the first application with the mapping relationship of the container IP address and the application inode number in the first storage space, the method further includes: in response to the absence of a matching entry for the source IP address and the inode number of the first application in the mapping relationship, the extended Linux Bridge discards the data packet of the first application, acquires and records the lost packet data, and stores the lost packet data in the second storage space.

[0020] The beneficial effects of the above-mentioned further improvement scheme are: it prevents the transmission of data packets when there is no matching entry in the mapping relationship between the source IP address and the inode number of the first application, and it records the lost data.

[0021] Based on a further improvement of the above method, the acquisition and recording of packet loss data includes: acquiring the absolute path of the process processing the data packet, the destination address and the destination port, and counting the number of packet losses; storing the absolute path of the process, the destination address and the destination port and the number of packet losses as a single packet loss data entry.

[0022] The beneficial effect of the above-mentioned further improvement scheme is that storing the absolute path of the process, the destination address, the destination port, and the number of lost packets as a single packet loss record improves the comprehensiveness of the packet loss data record.

[0023] Based on a further improvement of the above method, before the first application within the first container requests to send a data packet to the destination port of the destination address, the method further includes: sending a process network control policy configuration and enable request to the network controller through the configuration interface of the first container in the container management system; wherein, the process network control policy configuration and enable request includes process network control policy information, the process network control policy information includes the IP address of the first container and the absolute path of the process, the absolute path of the process is the storage path of the executable file of the first application; after receiving the process network control policy configuration and enable request, the network controller stores the process network control policy information in a local configuration file.

[0024] The beneficial effect of the above-mentioned further improvement scheme is that it enables the local storage of process network control policy configuration and enable requests and process network control policy information to be sent through the container management system.

[0025] Based on a further improvement of the above method, after storing the process network control policy information in a local configuration file, the method further includes: the network controller accessing the built-in interface of the virtual device, reading the process network control policy information in the local configuration file through the built-in interface, obtaining the inode number of the first application through the absolute path of the process in the process network control policy information, and storing the IP address of the first container, the inode number of the first application, and the absolute path of the process as a data of the mapping relationship into the first storage space.

[0026] The beneficial effect of the above-mentioned further improvement scheme is that it realizes the storage of the mapping relationship between the IP address of the first container, the inode number of the first application and the absolute path of the process.

[0027] Based on a further improvement of the above method, after storing the process network control policy information in a local configuration file, the method further includes: the container management system switching to the network namespace of the first container by calling the interface of the network controller; the network controller accessing the built-in interface of the virtual device; and modifying the network layer protocol in the network namespace of the first container through the built-in interface to obtain the processing logic.

[0028] The beneficial effect of the above-mentioned further improvement scheme is that it obtains the modified processing logic of the first container network layer, laying the foundation for subsequent packet filtering.

[0029] Based on a further improvement of the above method, after storing the process network control policy information in a local configuration file, the method further includes: the network controller accessing the built-in interface of the virtual device, and extending the filtering rules of Linux Bridge based on the process network control policy information through the built-in interface to obtain the extended Linux Bridge; the filtering rules include allowing data packets of applications whose inode numbers have the mapping relationship with the IP address of the first container when the source IP address is the IP address of the first container, and discarding data packets of other applications whose inode numbers do not have the mapping relationship with the IP address of the first container.

[0030] The beneficial effects of the above-mentioned further improvement scheme are: it realizes the expansion of the filtering rules of Linux Bridge, and provides a basis for the extended Linux Bridge to filter data packets.

[0031] Based on a further improvement of the above method, the method further includes: the container management system periodically sending a packet loss data acquisition request to the network controller; the network controller receiving the packet loss data acquisition request, reading the packet loss data in the second storage space through the built-in interface of the virtual device, and sending it to the configuration interface of the first container for display.

[0032] The beneficial effect of the above-mentioned further improvement scheme is that it enables the periodic acquisition and display of packet loss data.

[0033] Based on a further improvement of the above method, the destination address includes the IP address of a second container located on the same node as the first container, and the destination port includes the port of a second application in the second container; forwarding the data packet to the destination port of the destination address includes: forwarding the data packet to the second peer network interface card (NIC) of the second internal NIC of the second container to connect to the extended Linux Bridge; the second peer NIC sending the data packet to the second internal NIC of the second container; and the second internal NIC sending the data packet to the port of the second application.

[0034] The beneficial effect of the above-mentioned further improvement scheme is that it enables data transmission between applications within the same node.

[0035] Based on a further improvement of the above method, the destination address includes the IP address of the external node, and the destination port includes the port of the third application; forwarding the data packet to the destination port of the destination address includes: forwarding the data packet to the physical network interface card (NIC) of the node of the extended Linux Bridge; the physical NIC of the node sending the data packet to the physical NIC of the external node according to the IP address of the external node; and the physical NIC of the external node sending the data packet to the port of the third application.

[0036] The beneficial effect of the above-mentioned further improvement scheme is that it enables applications in the container to send data to applications on external nodes.

[0037] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0038] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0039] Figure 1 This is one of the flowcharts illustrating the security control method for network communication in a container scenario provided by the present invention;

[0040] Figure 2 This is the second flowchart illustrating the security control method for network communication in a container scenario provided by the present invention.

[0041] Figure 3 This is a schematic diagram of the processing logic for network layer modification in the security control method for network communication in a container scenario provided by the present invention;

[0042] Figure 4 This is a schematic diagram of the filtering rules for the Linux Bridge extension in the security control method for network communication in a container scenario provided by this invention. Detailed Implementation

[0043] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0044] This invention proposes a security control method for process-level network communication in container scenarios, which solves the problems existing in the existing container network communication control schemes. It also has the advantages of low resource consumption, fine-grained control and high security. This invention overcomes the limitations of existing container network communication control technologies and is something that traditional container network communication control technologies cannot meet.

[0045] First, let's explain the relevant terms:

[0046] Linux bridge: It is a software virtual bridge implemented in the kernel. It completely simulates the behavior of a physical switch through the kernel network module, connects multiple network interfaces at Layer 2, and implements functions such as MAC address learning, frame forwarding and broadcast isolation.

[0047] Container management system: Used to configure network process flow control policies in each container and manage process-level network communication security control functions for containers.

[0048] Container management system display: A visual interface that allows for various control operations on containers.

[0049] Network Controller: A custom kernel module with container process-level network traffic control capabilities.

[0050] Virtual devices: Character devices registered through kernel modules, enabling direct access between user space and container process network controller modules to memory-mapped regions.

[0051] Figure 1 This is one of the flowcharts illustrating the security control method for network communication in a container scenario provided by the present invention. For example... Figure 1 As shown, the method includes:

[0052] Step S1: The first application within the first container requests to send a data packet to the destination port of the destination address.

[0053] This invention can filter and process data packets when a container sends data to the outside world, including communication between containers within the same node (referring to the host) and communication between a container and an external node (referring to the external host).

[0054] The first application runs in the first container. First, the first application in the first container requests to send a data packet to the destination port of the destination address.

[0055] Step S2: According to the network layer processing logic of the first container, the source IP address of the data packet is matched with the container IP address in the first storage space. If there is a container IP address in the first storage space that matches the source IP address, the inode number of the first application is stored in the reserved field of the data packet.

[0056] Before network packets are sent out from the local machine, the extended container network protocol modifies the packet header from the target container by adding a process-level identifier. The peer container or node accepts the specified process traffic from the target container according to the default network protocol, thereby achieving process-level container network traffic control.

[0057] The network layer processing logic of the first container was modified in advance, that is, the network layer protocol was modified in advance. The first container is the one that requires data monitoring. The modification to the network layer processing logic of the first container includes matching the source IP address of the data packet sent by the application in the first container with the container IP address in the first storage space. If a matching container IP address exists in the first storage space, the application's inode number is stored in the reserved field of the data packet.

[0058] Therefore, after the first application in the first container requests to send a data packet to the destination port of the destination address, according to the processing logic of the network layer of the first container, the source IP address of the data packet is matched with the container IP address in the first storage space. If there is a container IP address in the first storage space that matches the source IP address, the inode number of the first application is stored in the reserved field of the data packet, thereby obtaining the modified data packet.

[0059] Step S3: Send the modified data packet to the first internal network card of the first container. The first internal network card then sends the data packet over the network to the first peer network card of the extended Linux Bridge connected to the first internal network card.

[0060] The modified data packet is sent to the first internal network interface card (NIC) of the first container. The first NIC then forwards the data packet over the network to the first peer NIC of the extended Linux Bridge. The sent data packet can be called an Ethernet frame.

[0061] Step S4: The extended Linux Bridge matches the source IP address of the data packet and the inode number of the first application with the mapping relationship between the container IP address and the application inode number in the first storage space.

[0062] The Linux Bridge pre-modifies its filtering rules to create an extended Linux Bridge. The modified filtering rules match the source IP address of the data packet and the inode number of the first application with the mapping relationship between the container IP address and the application inode number in the first storage space. If a match exists between the source IP address and the inode number of the first application in the mapping relationship, the extended Linux Bridge allows the data packet from the first application to pass.

[0063] Therefore, after the first internal network interface card (NIC) sends the data packet over the network to the first peer NIC of the extended Linux Bridge connected to the first internal NIC, the extended Linux Bridge matches the source IP address of the data packet and the inode number of the first application with the mapping relationship between container IP addresses and application inode numbers in the first storage space. The first storage space includes the mapping relationship between container IP addresses and application inode numbers; this mapping relationship can be one-to-one or one-to-many, indicating which applications within the container need to be monitored. The extended Linux Bridge matches the source IP address of the data packet and the inode number of the first application with the mapping relationship between container IP addresses and application inode numbers in the first storage space. This involves checking if a mapping relationship exists in the first storage space where the container IP address is the source IP address and the corresponding application inode number is the inode number of the first application. If such a mapping exists, it indicates that there is a matching entry in the mapping relationship between the source IP address and the inode number of the first application.

[0064] Specifically, the absolute path of a process can be obtained based on the `current` macro definition in the kernel. From this absolute path, the executable file of the first application can be retrieved, and thus its inode number. The inode number of the first application is a unique identifier for its executable file. If the executable file of the first application is modified, its inode number will change. Therefore, controlling network communication based on the application's inode number can prevent the transmission of data packets from tampered or forged applications.

[0065] Step S5: In response to the existence of a matching entry between the source IP address and the inode number of the first application in the mapping relationship, the extended Linux Bridge allows the data packet of the first application to pass through and forwards the data packet to the destination port of the destination address.

[0066] If a matching entry exists between the source IP address and the inode number of the first application in the mapping relationship, the extended Linux Bridge allows the first application's data packets and forwards them to the destination port of the destination address.

[0067] This invention enables the management of data packets for applications. Since the execution of applications generates processes, it also achieves process-level network communication security management in container scenarios.

[0068] Compared with existing container network communication control implementation schemes, this invention has the following advantages:

[0069] 1) By finely controlling the network traffic of each process, network bandwidth and other resources can be managed more effectively. This ensures that resources between various applications do not interfere with or contend for each other, improving overall network performance and stability.

[0070] 2) Process-level control can be precise down to each application or process. This means that network usage can be restricted based on the specific application, rather than simply limiting all traffic to an entire IP address or port, thus improving the flexibility of network traffic control.

[0071] 3) Process-level flow control can enhance security and reduce the likelihood of malicious applications or unauthorized programs exploiting network resources. By restricting network access permissions for each process, it can prevent malware from launching attacks or data leaks over the network. Even with similar filenames, different executables have different inode numbers.

[0072] 4) Accurately identify malicious traffic from counterfeit programs. The process-level identification of traffic in this invention is based on the application inode number. Traffic is distinguished according to the unique identifier of the program, eliminating the possibility of allowing counterfeit program traffic to pass.

[0073] 5) In this invention, the control of process-level network traffic is all based on software implementation, which does not require the configuration of additional physical hardware, thus reducing development and usage costs.

[0074] The security control method for network communication in a container scenario provided by this invention involves a first application within a first container requesting to send a data packet to the destination port of a destination address. Based on the network layer processing logic of the first container, the source IP address of the data packet is matched with the container IP address in the first storage space. If a matching container IP address exists in the first storage space, the inode number of the first application is stored in the reserved field of the data packet. The modified data packet is then sent to the first internal network interface card (NIC) of the first container. The first NIC then forwards the data packet to the first peer NIC of the extended Linux Bridge connected to the first NIC. The extended Linux Bridge matches the mapping relationship between the source IP address of the data packet and the inode number of the first application with the mapping relationship between the container IP address and the application inode number in the first storage space. If a matching entry exists in the mapping relationship between the source IP address and the inode number of the first application, the extended Linux Bridge allows the data packet of the first application to pass through and forwards the data packet to the destination port of the destination address. This achieves process-level network communication security control in a container scenario, improves the fine-grained control and anti-attack performance of network security control, and has the advantages of low resource consumption and low cost.

[0075] According to a security control method for network communication in a container scenario provided by the present invention, after the extended Linux Bridge matches the source IP address of the data packet and the inode number of the first application with the mapping relationship between the container IP address and the application inode number in the first storage space, the method further includes: in response to the absence of a matching entry between the source IP address and the inode number of the first application in the mapping relationship, the extended Linux Bridge discards the data packet of the first application, acquires and records the packet loss data, and stores the packet loss data in a second storage space.

[0076] After the extended Linux Bridge matches the source IP address and inode number of the first application packet with the mapping relationship between container IP address and application inode number in the first storage space, if no matching entry exists for the source IP address and the inode number of the first application, the extended Linux Bridge discards the packet from the first application, preventing it from being sent to the destination port of the destination address. Lost packet data is acquired and recorded, and stored in the second storage space for later retrieval. The second storage space is the kernel-mode storage space.

[0077] The security control method for network communication in a container scenario provided by this invention, in response to the absence of a matching entry between the source IP address and the inode number of the first application in the mapping relationship, the extended Linux Bridge discards the data packets of the first application, acquires and records the lost packet data, and stores the lost packet data in a second storage space. This achieves the blocking of data packet transmission when there is no matching entry between the source IP address and the inode number of the first application in the mapping relationship, and also achieves the recording of lost packet data.

[0078] According to a security control method for network communication in a container scenario provided by the present invention, the step of acquiring and recording packet loss data includes: acquiring the absolute path of the process processing the data packet, the destination address and the destination port, and counting the number of packet losses; storing the absolute path of the process, the destination address and the destination port and the number of packet losses as a single packet loss data entry.

[0079] Packet loss data includes information such as the process's absolute path, destination address, destination port, and the number of lost packets. When acquiring and recording packet loss data, the absolute path, destination address, and destination port of the process processing the data packets are obtained, and the number of lost packets is counted. The process's absolute path, destination address, destination port, and the number of lost packets are stored as a single packet loss record. The absolute path of the process can be obtained using the `current` macro definition in the kernel.

[0080] The security control method for network communication in container scenarios provided by this invention improves the comprehensiveness of packet loss data recording by obtaining the absolute path, destination address, and destination port of the process that processes data packets, counting the number of packet losses, and storing the absolute path, destination address, destination port, and number of packet losses as a single packet loss data entry.

[0081] According to a security control method for network communication in a container scenario provided by the present invention, before a first application in a first container requests to send a data packet to a destination port of a destination address, the method further includes: sending a process network control policy configuration and enable request to a network controller through the configuration interface of the first container in a container management system; wherein, the process network control policy configuration and enable request includes process network control policy information, the process network control policy information including the IP address of the first container and the absolute path of the process, the absolute path of the process being the storage path of the executable file of the first application; after receiving the process network control policy configuration and enable request, the network controller stores the process network control policy information in a local configuration file.

[0082] Before the first application within the first container requests to send a data packet to the destination port of the destination address, the process network control policy needs to be configured and enabled in advance.

[0083] Through the configuration interface of the first container in the container management system, a process network control policy configuration and enable request is sent to the network controller. This request includes process network control policy information, which includes the IP address of the first container and the absolute path of the process. The absolute path is the storage path of the executable file of the first application. This process network control policy information indicates that data packets from the application running the executable file in the first container are allowed to pass through.

[0084] After receiving the process network control policy configuration and enable request, the network controller stores the process network control policy information in the local configuration file.

[0085] The security control method for network communication in a container scenario provided by this invention sends a process network control policy configuration and enable request to the network controller through the configuration interface of the first container in the container management system. The process network control policy configuration and enable request includes process network control policy information, which includes the IP address of the first container and the absolute path of the process. The absolute path of the process is the storage path of the executable file of the first application. After receiving the process network control policy configuration and enable request, the network controller stores the process network control policy information in a local configuration file, thereby realizing the sending of the process network control policy configuration and enable request and the local storage of the process network control policy information through the container management system.

[0086] According to a security control method for network communication in a container scenario provided by the present invention, after storing the process network control policy information in a local configuration file, the method further includes: the network controller accessing the built-in interface of the virtual device, reading the process network control policy information in the local configuration file through the built-in interface, obtaining the inode number of the first application through the absolute path of the process in the process network control policy information, and storing the IP address of the first container, the inode number of the first application, and the absolute path of the process as a data of the mapping relationship into the first storage space.

[0087] After storing the process network control policy information in the local configuration file, the network controller accesses the virtual device's built-in interface, reads the process network control policy information from the local configuration file through the built-in interface, obtains the inode number of the first application through the absolute path of the process in the process network control policy information, and stores the IP address of the first container, the inode number of the first application, and the absolute path of the process as a mapping relationship into the first storage space. The first storage space is the kernel-mode cache space.

[0088] The security control method for network communication in a container scenario provided by this invention accesses the built-in interface of the virtual device through the network controller, reads the process network control policy information in the local configuration file through the built-in interface, obtains the inode number of the first application through the absolute path of the process in the process network control policy information, and stores the IP address of the first container, the inode number of the first application, and the absolute path of the process as a mapping relationship into the first storage space, thereby realizing the storage of the mapping relationship between the IP address of the first container, the inode number of the first application, and the absolute path of the process.

[0089] According to a security control method for network communication in a container scenario provided by the present invention, after storing the process network control policy information in a local configuration file, the method further includes: the container management system switching to the network namespace of the first container by calling the interface of the network controller; the network controller accessing the built-in interface of the virtual device and modifying the network layer protocol in the network namespace of the first container through the built-in interface to obtain the processing logic.

[0090] After storing the process network control policy information in the local configuration file, it is also necessary to modify the network layer processing logic in the network namespace of the first container. Specifically, the container management system switches to the network namespace of the first container by calling the network controller's interface. The network controller accesses the virtual device's built-in interface and modifies the network layer processing logic in the first container's network namespace through this built-in interface. This modified processing logic includes matching the source IP address of the data packet sent by the application in the first container with the container IP address in the first storage space. If a matching container IP address exists in the first storage space, the application's inode number is stored in the reserved field of the data packet.

[0091] The security control method for network communication in a container scenario provided by this invention involves the container management system switching to the network namespace of the first container by calling the interface of the network controller. The network controller accesses the built-in interface of the virtual device and modifies the processing logic of the network layer in the network namespace of the first container through the built-in interface, thereby obtaining the modified processing logic of the network layer of the first container, which lays the foundation for subsequent packet filtering.

[0092] According to a security control method for network communication in a container scenario provided by the present invention, after storing the process network control policy information in a local configuration file, the method further includes: the network controller accessing the built-in interface of the virtual device, and extending the filtering rules of LinuxBridge based on the process network control policy information through the built-in interface to obtain the extended Linux Bridge; the filtering rules include allowing data packets of applications whose inode numbers have a mapping relationship with the IP address of the first container when the source IP address is the IP address of the first container, and discarding data packets of other applications whose inode numbers do not have a mapping relationship with the IP address of the first container.

[0093] After storing the process network control policy information in a local configuration file, the filtering rules of Linux Bridge need to be extended to filter packets based on the process network control policy information. Specifically, the network controller accesses the built-in interface of the virtual device and extends the filtering rules of Linux Bridge based on the process network control policy information through the built-in interface. The filtering rules include allowing packets from applications whose inode numbers are mapped to the IP address of the first container in the first storage space when the source IP address is the IP address of the first container, and rejecting packets from other applications whose inode numbers are not mapped to the IP address of the first container in the first storage space.

[0094] The security control method for network communication in a container scenario provided by this invention accesses the built-in interface of the virtual device through the network controller, and extends the filtering rules of Linux Bridge based on process network control policy information through the built-in interface to obtain an extended Linux Bridge. The filtering rules include allowing data packets of applications whose inode numbers are mapped to the IP address of the first container when the source IP address is the IP address of the first container, and discarding data packets of other applications whose inode numbers are not mapped to the IP address of the first container. This realizes the extension of the filtering rules of Linux Bridge and provides a basis for the extended Linux Bridge to filter data packets.

[0095] According to a security control method for network communication in a container scenario provided by the present invention, the method further includes: the container management system periodically sending a packet loss data acquisition request to the network controller; the network controller receiving the packet loss data acquisition request, reading the packet loss data in the second storage space through the built-in interface of the virtual device, and sending it to the configuration interface of the first container for display.

[0096] Lost packets may be data packets sent by malicious programs or tampered programs. These lost packets need to be analyzed, including obtaining the absolute path of the process, destination address, destination port, and number of lost packets in the lost packets, in order to eliminate security risks.

[0097] The container management system periodically sends packet loss data retrieval requests to the network controller. The network controller receives the packet loss data retrieval requests, reads the packet loss data from the second storage space through the built-in interface of the virtual device, and sends it to the configuration interface of the first container for display.

[0098] The present invention provides a security control method for network communication in a container scenario. The container management system periodically sends a packet loss data acquisition request to the network controller. The network controller receives the packet loss data acquisition request, reads the packet loss data in the second storage space through the built-in interface of the virtual device, and sends it to the configuration interface of the first container for display, thereby realizing the periodic acquisition and display of packet loss data.

[0099] According to a security control method for network communication in a container scenario provided by the present invention, the destination address includes the IP address of a second container located on the same node as the first container, and the destination port includes the port of a second application in the second container; forwarding the data packet to the destination port of the destination address includes: forwarding the data packet to the second peer network card of the Linux Bridge extended by the second internal network card of the second container; the second peer network card sending the data packet to the second internal network card of the second container; and the second internal network card sending the data packet to the port of the second application.

[0100] A first application within a first container requests to send a data packet to the destination port of the destination address. The destination address includes the IP address of the second container, and the destination port includes the port of the second application within the second container. This scenario represents data transmission between containers within the same node. In this scenario, when forwarding the data packet to the destination port of the destination address, the data packet is also forwarded to the second peer network interface card (NIC) of the second internal NIC of the second container, which is connected to the extended Linux Bridge. The second peer NIC then sends the data packet to the second internal NIC of the second container; the second internal NIC then sends the data packet to the port of the second application.

[0101] The security control method for network communication in a container scenario provided by this invention enables data transmission between applications within the same node.

[0102] According to a security control method for network communication in a container scenario provided by the present invention, the destination address includes the IP address of an external node, and the destination port includes the port of a third application; forwarding the data packet to the destination port of the destination address includes: forwarding the data packet to the physical network interface card (NIC) of the node of the extended Linux Bridge; the physical NIC of the node sending the data packet to the physical NIC of the external node according to the IP address of the external node; and the physical NIC of the external node sending the data packet to the port of the third application.

[0103] The first application within the first container requests to send a data packet to the destination port of the destination address. The destination address includes the IP address of the external node, and the destination port includes the port of the third application. The third application can be a container application on the external node or a regular application on the external node. This scenario involves data transmission between applications on different nodes. In this scenario, when forwarding the data packet to the destination port of the destination address, the data packet is forwarded to the physical network interface card (NIC) of the node extending the Linux Bridge connection. The physical NIC of the node sends the data packet to the physical NIC of the external node based on the IP address of the external node, and the physical NIC of the external node sends the data packet to the port of the third application. The physical NIC of the node refers to the physical NIC of the host where the first and second containers reside, and the physical NIC of the external node refers to the physical NIC of the external host.

[0104] The security control method for network communication in a container scenario provided by this invention forwards data packets to the physical network interface card (NIC) of the node of the Linux Bridge with extended connectivity. The physical NIC of the node sends the data packets to the physical NIC of the external node according to the IP address of the external node. The physical NIC of the external node then sends the data packets to the port of the third application, thereby enabling the application in the container to send data to the application on the external node.

[0105] Figure 2 This is the second flowchart illustrating the security control method for network communication in a container scenario provided by the present invention. Figure 2 As shown, the method includes:

[0106] Step 1: Send a process network control policy configuration and enable request to the network controller through the configuration interface of the first container (container 1) in the container management system.

[0107] Step 2: The network controller updates and stores the process network control policy information; wherein, the process network control policy information includes the IP address of the first container and the absolute path of the process.

[0108] Step 3: The network controller accesses the built-in interface of the virtual device, reads the process network control policy information in the local configuration file through the built-in interface, obtains the inode number of the first application through the absolute path of the process in the process network control policy information, and stores the IP address of the first container, the inode number of the first application and the absolute path of the process as a mapping relationship into the first storage space.

[0109] Figure 3This is a schematic diagram of the network layer modification processing logic in the security control method for network communication in a container scenario provided by the present invention. The container management system switches to the network namespace of the first container by calling the interface of the network controller. The network controller accesses the built-in interface of the virtual device and modifies the network layer processing logic in the network namespace of the first container through the built-in interface. When processing data packets, the system reads the information in the first storage space (storage space I) and matches the source IP address of the data packet with the container IP address in the first storage space. If a container IP address matching the source IP address exists in the first storage space, the inode number of the first application is stored in the reserved field of the data packet.

[0110] Figure 4 This is a schematic diagram of the extended filtering rules of Linux Bridge in the security control method for network communication in a container scenario provided by this invention. During filtering, Linux Bridge processes data packets according to the extended filtering rules.

[0111] The network controller accesses the built-in interface of the virtual device and extends the filtering rules of Linux Bridge based on process network control policy information through the built-in interface. The filtering rules include allowing data packets of applications whose inode numbers are mapped to the IP address of the first container when the source IP address is the IP address of the first container, discarding data packets of other applications whose inode numbers are not mapped to the IP address of the first container, acquiring the lost packet data and writing it to the second storage space (storage space II).

[0112] Step 4: Execute the first application (application A) within the first container to send data packets to the destination port of the destination address;

[0113] According to the network layer processing logic of the first container, the source IP address of the data packet is matched with the container IP address in the first storage space. If there is a container IP address in the first storage space that matches the source IP address, the inode number of the first application is stored in the reserved field of the data packet.

[0114] The modified data packet is sent to the first internal network interface card (NIC) of the first container, and the first NIC sends the data packet over the network to the first peer NIC of the extended Linux Bridge connected to the first NIC.

[0115] The extended Linux Bridge matches the source IP address of the data packet and the inode number of the first application with the mapping relationship between the container IP address and the application inode number in the first storage space;

[0116] If a matching entry exists in the mapping relationship between the source IP address and the inode number of the first application, the extended Linux Bridge allows the first application's data packets and forwards them to the destination port of the destination address.

[0117] If no matching entry is found in the mapping relationship between the source IP address and the inode number of the first application, the extended Linux Bridge discards the packets of the first application, acquires and records the lost packet data, and stores the lost packet data in the second storage space.

[0118] Step 5: The container management system periodically sends packet loss data acquisition requests to the network controller. The network controller receives the packet loss data acquisition requests, reads the packet loss data from the second storage space through the built-in interface of the virtual device, and sends it to the configuration interface of the first container for display.

[0119] The present invention adopts the following technical approach:

[0120] 1. Enable process-level network communication security control functions through the container management system, load the network controller kernel module, create virtual devices, and register built-in interfaces.

[0121] 2. Add process network control policies for containers through the container management system's UI tool and save them synchronously in the local configuration file. The container management system will call the network controller's interface, which will cache the file content and switch to the application container's network namespace to register a network traffic filter (referring to the modification of the network layer processing logic) to achieve process-level differentiation of data packets.

[0122] 3. The network controller extends the Linux bridge by adding filtering rules to filter data based on process-level identifiers and record packet loss information, thereby enabling security control of process-level network communication in container scenarios.

[0123] Furthermore, loading the network controller kernel module, creating virtual devices, and registering built-in interfaces also includes:

[0124] (1.1) During the initialization of the network controller kernel module, two memory spaces are first allocated. The first storage space is used to cache the process namespace identifier (referring to the application inode number) and container IP information of each container that requires network flow control. The second storage space is used to record packet loss information. A virtual device is created and a built-in interface is registered for the device. The custom functional logic can be triggered by calling and accessing the input / output control system.

[0125] Furthermore, configuring process network control policies in the container management system also includes:

[0126] (2.1) Using the visual interface provided by the container management system UI tool, create process network traffic control policies on the container and save them to the local configuration file. During the creation process, you need to specify the container IP and the absolute path of the network process inside the container.

[0127] (2.2) After local storage is completed, the container network manager of the container management system calls the internal interface of the container network manager to switch to the network command space of the container, and then calls the built-in interface of the virtual device.

[0128] (2.3) In the built-in interface of the virtual device, the process network traffic control policy saved in the local configuration file is first read and cached in the first storage space previously allocated. Then, a network traffic filter is registered in the network layer of the current container network namespace. The filter will add the inode information of the application in the target container to the reserved field of the corresponding data packet.

[0129] Furthermore, the network controller extends the Linux bridge to add filtering rules, including:

[0130] (3.1) Obtain the packet header in the extended Linux Bridge, check the source IP information, and then compare and filter the inode information in the packet header reserved field from the target container with the information in the first storage space.

[0131] (3.2) Record packet loss information in the second storage space for the container management system to retrieve and display periodically.

[0132] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0133] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0134] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0136] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A security control method for network communication in a container scenario, characterized in that, The method comprises: a first application in a first container requests to send a data packet to a destination port of a destination address; according to the processing logic of the network layer of the first container, the source IP address of the data packet is matched with the container IP address in the first storage space, if the container IP address matching the source IP address exists in the first storage space, the inode number of the first application is stored in the reserved field of the data packet; the modified data packet is sent to the first internal network card of the first container, and the first internal network card sends the data packet to the first opposite end network card of the Linux Bridge extended by the first internal network card; the extended Linux Bridge matches the source IP address of the data packet and the inode number of the first application with the mapping relationship between the container IP address and the application inode number in the first storage space; in response to the existence of matching entries of the source IP address and the inode number of the first application in the mapping relationship, the extended Linux Bridge releases the data packet of the first application and forwards the data packet to the destination port of the destination address.

2. The method of claim 1, wherein, After the extended Linux Bridge matches the source IP address of the data packet and the inode number of the first application with the mapping relationship between the container IP address and the application inode number in the first storage space, the method further comprises: in response to the absence of matching entries of the source IP address and the inode number of the first application in the mapping relationship, the extended Linux Bridge discards the data packet of the first application, acquires and records the packet loss data, and stores the packet loss data into the second storage space.

3. The method of claim 2, wherein, The acquisition and recording of the packet loss data comprise: acquiring the process absolute path of the process processing the data packet, the destination address and the destination port, and counting the number of packet loss; storing the process absolute path, the destination address, the destination port and the number of packet loss as a piece of packet loss data.

4. The method of claim 2, wherein, Before the first application in the first container requests to send a data packet to the destination port of the destination address, the method further comprises: sending a process network control policy configuration and enabling request to a network controller through a configuration interface of the first container in a container management system; wherein the process network control policy configuration and enabling request comprises process network control policy information, and the process network control policy information comprises the IP address of the first container and the process absolute path, and the process absolute path is the storage path of the executable file of the first application; after the network controller receives the process network control policy configuration and enabling request, the network controller stores the process network control policy information into a local configuration file.

5. The method of claim 4, wherein, After storing the process network control policy information into the local configuration file, the method further comprises: The network controller accesses a built-in interface of the virtual device, reads the process network control policy information in the local configuration file through the built-in interface, and obtains an inode number of the first application program through the process absolute path in the process network control policy information. The IP address of the first container, the inode number of the first application program, and the process absolute path are stored as a piece of data of the mapping relationship into the first storage space.

6. The method of claim 5, wherein, After storing the process network control policy information into the local configuration file, the method further comprises: The container management system switches to the network namespace of the first container by calling the interface of the network controller. The network controller accesses the built-in interface of the virtual device, modifies the network layer protocol in the network namespace of the first container through the built-in interface, and obtains the processing logic.

7. The method of claim 5, wherein, After storing the process network control policy information into the local configuration file, the method further comprises: The network controller accesses the built-in interface of the virtual device, and extends the filtering rule of the Linux Bridge based on the process network control policy information through the built-in interface, to obtain the extended Linux Bridge. The filtering rule includes, when the source IP address is the IP address of the first container, passing the data packet of the application program whose inode number has the mapping relationship with the IP address of the first container, and discarding the data packet of other application programs whose inode number does not have the mapping relationship with the IP address of the first container.

8. The method of claim 5, wherein, The method further comprises: The container management system periodically sends a packet loss data acquisition request to the network controller; The network controller receives the packet loss data acquisition request, reads the packet loss data of the second storage space through the built-in interface of the virtual device, and sends to the configuration interface of the first container for display.

9. The method of claim 1, wherein, The destination address includes an IP address of a second container located in the same node as the first container, and the destination port includes a port of a second application program in the second container; The forwarding of the data packet to the destination port of the destination address comprises: forwarding the data packet to a second opposite end network card of a second internal network card connection extended Linux Bridge of the second container; The second opposite end network card sends the data packet to the second internal network card of the second container; The second internal network card sends the data packet to the port of the second application program.

10. The method of claim 1, wherein, The destination address includes an IP address of an external node, and the destination port includes a port of a third application program; The forwarding of the data packet to the destination port of the destination address comprises: forwarding the data packet to a node physical network card connected to the extended Linux Bridge; The node physical network card sends the data packet to an external node physical network card according to the IP address of the external node. The external node physical network card sends the data packet to a port of the third application.

Images