Mimicry transformation system based on service component

Abstract

The invention provides a mimicry transformation system based on a service component, and the system comprises the steps: determining N distribution requests after determining the installation of a service in a new service request, matching N heterogeneous cluster nodes, creating corresponding M kubernates cluster connections according to the matching of the N heterogeneous cluster nodes and corresponding heterogeneous information, and generating a command to create N service components. The method comprises the steps of storing a cluster node path and service component information into a database table, obtaining relevant configuration and role information of service components, generating serviceRoleUi, determining an installation sequence of each service component according to a dependency relationship existing among the service components, generating a new service command according to the installation sequence, and installing N service components, and different processing modes are designed according to N response results returned by N service component requests, so that the safety characteristic of the service component is improved, and the anti-attack capability of the whole platform is enhanced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network space security, and particularly relates to a quasi-state reconstruction system based on a service component. BACKGROUND

[0002] With the rapid development of information technology, network space security problems have increasingly become the focus of social attention. Containerization technology, as one of the core technologies in the field of cloud computing, has been widely used in enterprise-level applications due to its advantages. However, as the application scope of containerization technology continues to expand, the security risks it faces have gradually become prominent.

[0003] The containerization management platform provides functions and services in the form of service components. These service components are not only the core units of platform operation, but also the main targets of attackers. Currently, there are the following problems with the service components of the containerization management platform: First, existing security protection schemes are mostly focused on traditional methods, and there is still a lack of research on the quasi-state reconstruction of service components. Second, due to the dynamic, lightweight and distributed characteristics of the container environment, traditional security defense methods are not sufficient in dealing with new attack methods. These factors lead to serious security threats to the containerization management platform.

[0004] Therefore, there is an urgent need for a quasi-state reconstruction scheme for the service components of the containerization management platform to enhance the anti-attack ability of the entire platform by improving the security characteristics of the service components themselves. SUMMARY

[0005] The purpose of the technical solution of the application is to solve the deficiencies in the prior art and improve the overall security defense capability of the containerization management platform.

[0006] The technical solution of the application provides a quasi-state reconstruction system based on a service component, which includes: A service distribution module is configured to preprocess a new service request initiated by a user on a containerization management platform, determine N distribution requests after installing the service in the new service request, and match N heterogeneous cluster nodes. A service management module is configured to create M kubernates cluster connections according to the N heterogeneous cluster nodes and corresponding heterogeneous information, generate a command to create N service components, store the cluster node path and service component information in a database table, obtain service component related configurations and role information, generate a serviceRoleUi, determine the installation order of each service component according to the dependency relationship between the service components, generate a new service command according to the installation order, install the N service components, and return N response results requested by the N service components. a service decision module, configured to obtain N response results, and compare and decide the N response results; If all comparison results are consistent, store the N service component related instance data into a database table, randomly select one response result from the N response results as the final decision result; If there are M (M < N) consistent comparison results, send the abnormal cluster node information of the inconsistent comparison results to the negative feedback module, and randomly select one response result from the M consistent comparison results as the final decision result, and send the final decision result to the decision result output module; If all comparison results are inconsistent, send the abnormal cluster node information of all response results to the negative feedback module, and take the specific mark -1 as the final decision result; a decision result output module, configured to obtain the final decision result of the service decision module, judge whether the final decision result is the specific mark -1, if yes, return the preset error response to the containerized management platform, and if not, return the received response result to the containerized management platform; a negative feedback module, configured to obtain the abnormal cluster node information, and report the abnormal cluster node information to the service management module.

[0007] Preferably, the preprocessing operation comprises: parsing the clusterId from the new service request; According to the clusterId, query the clusterId-1 of the associated cluster from the database stored in the service distribution module, add it to the clusterIdList, and obtain the array length K of the nodeIds-1 in the associated cluster; According to the service identifier in the new service request, query and verify in the corresponding database table whether the service in the new service request needs to be installed, if not, return the response with the "already exists" mark to the containerized management platform, if yes, determine to install the service in the new service request.

[0008] Preferably, the matching N heterogeneous cluster nodes comprises: If the array length K of the nodeIds-1 is greater than or equal to the number N of distribution requests, directly select N cluster node ids from the nodeIds-1 array, add them to the IdList array, and obtain N heterogeneous cluster nodes; If the array length K of nodeIds-1 is less than the number N of distribution requests, the cluster node information corresponding to other clusterId-N is queried, N-K cluster nodes with architecture information different from the cluster nodes in the nodeIds-1 array are selected, all cluster node ids in the nodeIds-1 array and the N-K newly selected cluster node ids are added to IdList to obtain N heterogeneous cluster nodes, and a new clusterId-N is added to clusterIdList.

[0009] Preferably, the creating of the corresponding M kubernates cluster connections comprises: obtaining kubeconfig information corresponding to the N cluster nodes according to clusterIdList, and creating the corresponding M kubernates clusters.

[0010] Preferably, the service component is used to describe a service running on a cluster node with different architecture, and is a component actually providing a business service.

[0011] Preferably, the N cluster nodes are physical nodes with different architectures in a kubernates cluster, and are host nodes running service components.

[0012] The technical scheme of the present application provides a paratransgenic system based on a service component. After determining the installation of a new service request, N distribution requests are determined, N heterogeneous cluster nodes are matched, N kubernates cluster connections are created according to the matching of the N heterogeneous cluster nodes and the corresponding heterogeneous information, N service components are generated by creating commands, the cluster node path and service component information are stored in a database table, service component related configurations and role information are obtained, a serviceRoleUi is generated, the installation order of each service component is determined according to the dependency relationship between the service components, a new service command is generated according to the installation order, N service components are installed, and different processing methods are designed according to the N service component request returning N response results, so as to improve the security characteristics of the service component itself and enhance the attack resistance of the entire platform. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 A paratransgenic system based on a service component is provided. DETAILED DESCRIPTION

[0014] As shown in the figure, the paratransgenic system based on a service component provided by the embodiment of the present application comprises: Figure 1 The paratransgenic system based on a service component provided by the embodiment of the present application comprises: The service distribution module is configured to perform preprocessing operation on the new service request initiated by the user on the container management platform, determine N (N>=3) distribution requests after determining the installation of the service in the new service request, and match the N heterogeneous cluster nodes.

[0015] The preprocessing operation includes: Parsing the clusterId from the new service request; According to the clusterId, the clusterId-1 of the associated cluster is queried from the database stored in the service distribution module, added to the clusterIdList, and the array length K of the nodeIds-1 in the associated cluster is obtained. According to the service identifier in the new service request, the corresponding database table is queried and checked to check whether the service in the new service request needs to be installed, if not, a response with an "already exists" identifier is returned to the container management platform, if yes, the installation of the service in the new service request is determined.

[0016] The matching of the N heterogeneous cluster nodes includes: If the array length K of the nodeIds-1 is greater than or equal to the number N of distribution requests, N cluster node ids are directly selected from the nodeIds-1 array and added to the IdList array to obtain N heterogeneous cluster nodes. If the array length K of the nodeIds-1 is less than the number N of distribution requests, the cluster node information corresponding to other clusterId-N is queried, N-K cluster nodes with different architecture information from the cluster nodes in the nodeIds-1 array are selected, all cluster node ids in the nodeIds-1 array and the newly selected N-K cluster node ids are added to the IdList to obtain N heterogeneous cluster nodes, and the new clusterId-N is added to the clusterIdList.

[0017] The service management module is configured to create M kubernates cluster connections according to the matching of the N heterogeneous cluster nodes and the corresponding heterogeneous information, generate a command to create N service components, store the cluster node path and service component information in the database table, obtain the service component related configuration and role information, generate a serviceRoleUi, determine the installation order of each service component according to the dependency relationship between the service components, generate a new service command according to the installation order, install the N service components, and return N response results for the N service component requests.

[0018] The creating of the corresponding M kubernates cluster connection comprises: obtaining the kubeconfig information corresponding to the N cluster nodes according to the clusterIdList, and creating the corresponding M kubernates cluster.

[0019] The service arbitration module is used for obtaining N response results, and comparing and arbitrating the N response results. If all comparison results are consistent, the N service component related instance data is stored in the database table, and a response result is randomly selected from the N response results as the final arbitration result. If there are M (M < N) consistent comparison results, the abnormal cluster node information of the response result with inconsistent comparison results is sent to the negative feedback module, and a response result is randomly selected from the M consistent comparison results as the final arbitration result, and is sent to the arbitration result output module. If all comparison results are inconsistent, the abnormal cluster node information of all response results is sent to the negative feedback module, and a specific marker -1 is taken as the final arbitration result. The arbitration result output module is used for obtaining the final arbitration result of the service arbitration module, judging whether the final arbitration result is a specific identifier -1, and returning a preset error response to the containerized management platform if the final arbitration result is the specific identifier -1, and returning the received response result to the containerized management platform if the final arbitration result is not the specific identifier -1.

[0020] The negative feedback module obtains the abnormal cluster node information and reports the abnormal cluster node information to the service management module.

[0021] The service management module performs cleaning operation on the cluster node corresponding to the abnormal cluster node information, so that the service corresponding to the cluster node is restored to normal.

[0022] The service component is used for describing the service running on the cluster nodes with different architectures, and is a component for actually providing business service.

[0023] The N cluster nodes are physical nodes with different architectures in the kubernates cluster, and are host nodes running the service component.

[0024] The service component based on the paratopic transformation system provided by the embodiment of the application has the following beneficial effects: (1) The application provides an innovative solution to the problem of lack of service component paratopic transformation scheme for the containerized management platform, which makes up for the deficiencies in the prior art.

[0025] (2) The method fully considers the dynamicity, lightness and distributed characteristics of the container environment, and can effectively cope with the security challenges brought by these characteristics.

[0026] (3) Through the mimic transformation method, the security of service components in the containerized management platform can be enhanced, making it have stronger anti-attack ability.

[0027] (4) By improving the security of service components, it can effectively prevent attackers from exploiting service component vulnerabilities for malicious operations, thereby protecting user data and stable operation of the system.

[0028] (5) Through the mimic transformation of service components, the defense capability of the entire containerized management platform can be improved, enhancing its ability to cope with new attack methods.

Claims

1. A service component-based mimicry system, characterized in that, include: The service distribution module is used to preprocess new service requests initiated by users on the containerized management platform, determine the services to be installed in the new service requests, identify N distribution requests, and match them with N heterogeneous cluster nodes. The service management module is used to create M corresponding Kubernetes cluster connections based on N heterogeneous cluster nodes and their corresponding heterogeneous information, generate commands to create N service components, store cluster node paths and service component information in a database table, obtain service component-related configuration and role information, generate serviceRoleUi, determine the installation order of each service component based on the dependencies between service components, generate a new service command based on the installation order, install N service components, and return N response results for each of the N service component requests. The service adjudication module is used to obtain N response results and compare and adjudicate the N response results; If all comparison results are consistent, store the relevant instance data of N service components into a database table, and randomly select one response result from the N response results as the final decision result; If there are M (M < N) matching results, the abnormal cluster node information of the inconsistent response results is sent to the negative feedback module, and one response result is randomly selected from the M matching response results as the final decision result and sent to the decision result output module. If all comparison results are inconsistent, the abnormal cluster node information of all response results will be sent to the negative feedback module, and a specific flag -1 will be used as the final decision result. The adjudication result output module is used to obtain the final adjudication result of the service adjudication module, determine whether the final adjudication result is a specific identifier -1, and if so, return the preset error response to the containerization management platform; otherwise, return the received response result to the containerization management platform. The negative feedback module acquires information about abnormal cluster nodes and reports this information to the service management module.

2. The mimicry system based on service components as described in claim 1, characterized in that, The preprocessing operations include: Parse the clusterId from the new service request; Based on clusterId, query the associated clusterId-1 from the database stored inside the service distribution module, add it to clusterIdList, and obtain the length K of the nodeIds-1 array in the associated cluster; Based on the service identifier in the new service request, a query is performed in the corresponding database table to verify whether the service in the new service request needs to be installed. If not, a response with the "already exists" flag is returned to the containerization management platform. If yes, the service in the new service request is installed.

3. The mimicry system based on service components as described in claim 2, characterized in that, The matching of N heterogeneous cluster nodes includes: If the length K of the nodeIds-1 array is greater than or equal to the number of requests N, then N cluster node IDs are directly selected from the nodeIds-1 array and added to the IdList array to obtain N heterogeneous cluster nodes. If the length K of the nodeIds-1 array is less than the number of distribution requests N, then query the cluster node information corresponding to other clusterId-N, select NK cluster nodes whose architecture information is different from that of the cluster nodes in the nodeIds-1 array, add all cluster node IDs in the nodeIds-1 array and the newly selected NK cluster node IDs to IdList, obtain N heterogeneous cluster nodes, and add the new clusterId-N to clusterIdList.

4. The mimicry system based on service components as described in claim 1, characterized in that, The process of creating M corresponding Kubernetes cluster connections includes: obtaining the kubeconfig information corresponding to N cluster nodes based on clusterIdList, and creating M corresponding Kubernetes clusters.

5. The mimicry system based on service components as described in claim 1, characterized in that, The service components are used to describe services running on cluster nodes with different architectures, and are the components that actually provide business services.

6. The mimicry system based on service components as described in claim 1, characterized in that, The N cluster nodes are physical nodes with different architectures in the Kubernetes cluster, and are the host nodes that run the service components.

Images