DNS request processing method and device for protecting cloud security, equipment and medium

Abstract

One or more embodiments of the present disclosure provide a DNS request processing method and apparatus for protecting cloud security, a device and a medium, applied to a first computing node, the DNS request processing method for protecting cloud security comprising: receiving a first network request generated by at least one container group running on the first computing node; and in response to the first network request being a DNS request, obtaining a first DNS detection strategy corresponding to the container group sending the first network request, and processing the first network request by using the first DNS detection strategy. The DNS detection strategy corresponding to the container group is utilized to carry out targeted processing, DNS defense of container group granularity is realized, the operation security of the computing node is protected, and the cloud security is further guaranteed.

Description

Technical Field

[0001] One or more embodiments of this disclosure relate to a DNS request processing method for protecting cloud security, a DNS request processing apparatus for protecting cloud security, an electronic device, and a computer-readable storage medium. Background Technology

[0002] A Domain Name System (DNS) request can be understood as a domain name resolution request, which is used to request the conversion of a domain name into an Internet Protocol (IP) address.

[0003] Effective handling of DNS requests within a computing cluster is crucial for ensuring cloud security. Summary of the Invention

[0004] This summary section is provided to briefly introduce the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] At least one embodiment of this disclosure provides a DNS request processing method for protecting cloud security, applied to a first computing node. The method includes: receiving a first network request generated by at least one container group running on the first computing node; in response to the first network request being a DNS request, obtaining a first DNS detection policy corresponding to the container group that sent the first network request; and processing the first network request using the first DNS detection policy.

[0006] At least another embodiment of this disclosure provides a DNS request processing apparatus for protecting cloud security, deployed on a first computing node. The apparatus includes: a receiving module configured to receive a first network request generated by at least one container group running on the first computing node; and a processing module configured to: in response to the first network request being a DNS request, obtain a first DNS detection policy corresponding to the container group that sent the first network request, and process the first network request using the first DNS detection policy.

[0007] At least one further embodiment of this disclosure provides an electronic device, including: a processing device; and a storage device including one or more computer program instructions; wherein the one or more computer program instructions are executed by the processing device to perform the DNS request processing method for protecting cloud security provided in at least one embodiment of this disclosure.

[0008] At least one further embodiment of this disclosure provides a computer-readable storage medium for non-transitory storage of computer-readable instructions, wherein the computer-readable instructions, when executed by a processor, implement the DNS request processing method for protecting cloud security provided in at least one embodiment of this disclosure.

[0009] At least one embodiment of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the DNS request processing method for protecting cloud security provided in at least one embodiment of this disclosure. Attached Figure Description

[0010] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0011] Figure 1 This illustration schematically depicts an application scenario of a DNS request processing system provided by at least one embodiment of the present disclosure;

[0012] Figure 2 The illustration schematically shows a flowchart of a DNS request processing method for protecting cloud security provided in at least one embodiment of the present disclosure;

[0013] Figure 3 The illustration shows a schematic diagram of a DNS detection strategy provided in at least one embodiment of the present disclosure;

[0014] Figure 4 This illustration schematically shows a user-mode and kernel-mode structure provided in at least one embodiment of the present disclosure;

[0015] Figure 5 This illustration schematically shows the interaction between a controller module and a cache module in user mode according to at least one embodiment of this disclosure;

[0016] Figure 6 This illustration schematically shows the interaction between a controller module and a cache module in user mode according to at least one embodiment of this disclosure;

[0017] Figure 7 This illustration schematically shows an interaction diagram of a user-mode cache module and an eBPF mapping in kernel mode, provided in at least one embodiment of this disclosure.

[0018] Figure 8 This illustration schematically shows an interaction diagram between a cache module and a processor module in user space, provided in at least one embodiment of this disclosure.

[0019] Figure 9This illustration schematically shows an interaction diagram between a cache module and a processor module in user space, provided in at least one embodiment of this disclosure.

[0020] Figure 10 The illustration shows a schematic diagram of the execution flow of an eBPF program in kernel mode according to at least one embodiment of the present disclosure;

[0021] Figure 11 This schematically illustrates a structural diagram of a DNS request processing apparatus for protecting cloud security provided in at least one embodiment of the present disclosure; and

[0022] Figure 12 The schematic diagram illustrates a structure suitable for implementing at least one embodiment of the present disclosure of an electronic device. Detailed Implementation

[0023] One or more embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0024] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0025] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0026] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0027] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0028] The names of the messages or information exchanged between the various devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0029] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0030] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, relevant users should be informed of the type, scope of use, and usage scenarios of the information involved in this disclosure through appropriate means in accordance with relevant laws and regulations, and authorization should be obtained from the relevant users. Among them, relevant users may include any type of rights holder, such as individuals, enterprises, and groups.

[0031] For example, in response to receiving an active request from a user, a prompt message is sent to the relevant user to clearly indicate that the operation requested by the user will require obtaining and using the user's information. This allows the relevant user to choose whether to provide information to the software or hardware such as the electronic device, application, server, or storage medium that performs the operation of any embodiment of the present disclosure based on the prompt message.

[0032] As an optional but non-restrictive implementation, in response to a user's active request, a prompt message can be sent to the user, such as a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide information to the electronic device.

[0033] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0034] A computing cluster typically consists of multiple computing nodes that work together to provide high-performance computing capabilities. A computing node can be understood as a host.

[0035] In a compute node, a container group (POD) is the smallest unit that can be created and managed. In other words, a container group can be understood as the basic deployment unit in a compute node. A container group typically encapsulates one or more containers, and containers running in the same container group share network and storage resources.

[0036] In a computing cluster, container groups (such as applications running within container groups) can send DNS requests to a DNS service. A DNS request can be understood as a network request used to convert a domain name into its corresponding IP address. By sending DNS requests, the contradiction of "domain names are easy to remember, but only IP addresses can be identified during communication" is resolved.

[0037] For example, when a container group needs to access a service domain name inside the compute cluster or an external domain name, the container group can send a DNS request to query the IP address of the service domain name inside the compute cluster or the external domain name. The DNS request is forwarded to the DNS service through the internal or external components of the container group according to the cluster network rules. The DNS service performs domain name resolution and returns the corresponding IP address.

[0038] Given that compute clusters are typically deployed in the cloud, insecure DNS requests can impact cloud security. Therefore, in some compute clusters, DNS requests are handled by a DNS service, for example, by the DNS service intercepting DNS requests. However, the DNS service within the compute cluster struggles to effectively intercept all DNS requests. For instance, when the DNS service is attacked (e.g., hijacked), DNS requests sent by container groups may not be forwarded to the correct DNS service, making it difficult to effectively intercept DNS requests and thus impacting the operational security of cloud services.

[0039] To at least partially solve the above-mentioned technical problems, at least one embodiment of this disclosure provides a DNS request processing method for protecting cloud security. The method is applied to a first computing node and includes: receiving a first network request generated by at least one container group running on the first computing node; in response to the first network request being a DNS request, obtaining a first DNS detection policy corresponding to the container group that sent the first network request; and processing the first network request using the first DNS detection policy.

[0040] In a DNS request processing method for protecting cloud security provided in at least one embodiment of this disclosure, a corresponding DNS detection policy is configured for each container group running on a compute node. For DNS requests generated by the container group, the corresponding DNS detection policy is used for targeted processing, thereby realizing DNS defense at the container group level, protecting the operational security of the compute node, and thus ensuring cloud security.

[0041] Based on the DNS request processing method for protecting cloud security provided in at least one embodiment of this disclosure, at least one embodiment of this disclosure also provides a DNS request processing apparatus, electronic device, computer-readable storage medium, and computer program product for protecting cloud security.

[0042] The present disclosure and some examples thereof will now be described in detail with reference to the accompanying drawings.

[0043] Figure 1 The illustration shows an application scenario diagram of a DNS request processing system provided by at least one embodiment of the present disclosure.

[0044] like Figure 1 As shown, the application scenario provided in this embodiment may include computing node 10. Computing node 10 can be any computing node running in the computing cluster. Computing node 10 can use cloud resources provided by the computing cluster to execute computing tasks.

[0045] Compute node 10 runs container group 11 and container group 12. Container group 11 encapsulates container 111, and container group 12 encapsulates container 121. Container group 11 uses protocol stack 112, and container group 12 uses protocol stack 122. Container group 11 uses virtual network interface card 113, and container group 12 uses virtual network interface card 123. In compute node 10, virtual network interface card 113 communicates with virtual Ethernet device 114, and virtual network interface card 123 communicates with virtual Ethernet device 124. In addition, compute node 10 uses eth0 14.

[0046] For example, the container group running on compute node 10 can be orchestrated by the Kubernetes container orchestration system.

[0047] In one or more embodiments of this disclosure, a DNS request processing system 13 is deployed on the compute node 10. The DNS request processing system 13 can be deployed in the user space of the compute node 10. The DNS request processing system 13 is used to process DNS requests for the container group running on the compute node 10. That is, by deploying a DNS request processing system on each compute node in the compute cluster, the DNS request processing is performed on each compute node in the compute cluster, thereby ensuring the security of DNS requests on each compute node.

[0048] The DNS request processing system 13 can receive network requests generated by container group 11 or container group 12 running on compute node 10. In response to the network request being a DNS request, the DNS request processing system 13 can obtain the DNS detection policy corresponding to the container group (container group 11 or container group 12) that sent the network request, and process the network request using the DNS detection policy.

[0049] Thus, on the one hand, the DNS request processing system 13 is deployed in the user space of the compute node 10. The DNS request processing system 13 can process the DNS requests generated by each container group running on the compute node 10. Since the number of DNS requests generated by a container group running on a compute node is limited, the efficiency of DNS request processing can be ensured. Furthermore, compared with deploying a DNS request processing system for each container group, computing resources can be saved.

[0050] In some embodiments, the DNS request processing system 13 can process DNS requests by deploying an eBPF program. For example, the DNS request processing system 13 can deploy an eBPF program corresponding to the container group in the kernel mode of the compute node 10. Considering that network requests generated by the container group running on the compute node will first be transmitted to the virtual Ethernet device through the virtual network card inside the container group, the DNS request processing system 13 can deploy an eBPF program 131 for the container group 11. The eBPF program 131 can be deployed inside the virtual Ethernet device 114. As another example, the DNS request processing system 13 can deploy an eBPF program 132 for the container group 12. The eBPF program 132 can be deployed inside the virtual Ethernet device 124.

[0051] Furthermore, the DNS request processing system 13 can exchange data with the eBPF program 131 or eBPF program 132 through the eBPF mapping 133. For example, the DNS request processing system 13 can process the DNS requests sent by the container group 11 or container group 12 by running the eBPF program 131 or eBPF program 132. During the processing of the DNS request, the eBPF program 131 or eBPF program 132 can read the corresponding DNS detection policy from the eBPF mapping 133 and use the DNS detection policy to process the DNS request.

[0052] Since the eBPF program runs in the kernel mode of compute node 10 and does not affect the normal operation of the relevant source code in the kernel mode of compute node 10, it can process the DNS requests of each container group running on compute node 10 without harming the kernel mode of compute node 10, thereby realizing access control of DNS requests, improving the accuracy and efficiency of DNS request processing, and ensuring the operational security of compute node 10.

[0053] The following will combine Figures 2 to 10 This disclosure provides a detailed description of a DNS request processing method for protecting cloud security, based on at least one embodiment.

[0054] Figure 2The illustration shows a flowchart of a DNS request processing method for protecting cloud security provided in at least one embodiment of the present disclosure.

[0055] like Figure 2 As shown, the DNS request processing method for protecting cloud security in this embodiment includes steps S201 to S202. In some embodiments, the executing entity of the DNS request processing method for protecting cloud security can be a first computing node, such as a DNS request processing system deployed in user space on the first computing node. The DNS request processing method for protecting cloud security includes:

[0056] Step S201: Receive a first network request generated by at least one container group running on the first compute node.

[0057] The first compute node can be any compute node in the compute cluster. The first compute node can run in the cloud and utilize the cloud resources of the compute cluster to perform compute tasks. At least one container group can run on the first compute node, and at least one container group can run one or more containers.

[0058] The first network request can be understood as any network request generated by the container group running on the first computing node. In one or more embodiments of this disclosure, any network request generated by the container group running on the first computing node is intercepted, the DNS request is identified, and the DNS request is processed using the corresponding DNS detection strategy.

[0059] Step S202: In response to the first network request being a DNS request, obtain the first DNS detection policy corresponding to the container group that sent the first network request, and process the first network request using the first DNS detection policy.

[0060] For a first network request generated by at least one container group, the type of the first network request is first determined, and the first network request that belongs to DNS request is identified so as to perform targeted DNS request processing.

[0061] In some possible implementations, in response to the field values ​​of the first field indicating the network layer communication protocol, the second field indicating the transport layer communication protocol, and the third field indicating the destination port in the first network request, which characterize the first network request as a DNS request, a first DNS detection policy corresponding to the container group that sent the first network request is obtained.

[0062] For example, when the value of the first field is IP protocol, the value of the second field is UDP protocol, and the value of the third field is 53, it indicates that the first network request is a DNS request.

[0063] Thus, by combining the characteristics of DNS requests, by extracting field values ​​from different levels in the first network request, it can be determined whether the first network request has the characteristics of a DNS request, thereby identifying the first network request that belongs to the DNS request, so as to process the first network request that belongs to the DNS request.

[0064] For the first network request that is a DNS request, the processing strategy for the first network request is determined by obtaining the first DNS detection policy corresponding to the container group that sent the first network request, and the first network request is processed.

[0065] In other words, in one or more embodiments of this disclosure, a corresponding DNS detection policy is configured for each container group in the computing node, and the DNS requests generated by the container group are processed using the DNS detection policy on a container group basis, thereby achieving DNS protection at the container group level.

[0066] A DNS detection strategy can be understood as a strategy for handling different DNS requests. The following explains how a DNS detection strategy is generated.

[0067] In some embodiments, the DNS detection policies corresponding to at least one container group running on the first computing node can be generated as follows: obtaining multiple detection rules, each of the multiple detection rules including: container group information, DNS domain name and processing policy; then, for each of the multiple detection rules, establishing a mapping relationship between the DNS domain name in the detection rule and the processing policy to obtain the DNS detection policy corresponding to the detection rule; and generating the DNS detection policy corresponding to at least one container group running on the first computing node based on the container group information included in each of the multiple detection rules.

[0068] A detection rule can be understood as a DNS domain name detection rule (DNS policy). A detection rule includes container group information, DNS domain name, and processing policy. The container group information can be used to indicate the container group to which the detection rule applies. For example, the container group information can be the namespace name and / or label of the container group. The DNS domain name can be used to indicate the DNS domain name to which the detection rule applies. For example, the DNS domain name can be *.example.com, indicating that the detection rule applies to DNS domain names with the first-level domain name "com", the second-level domain name "example", and the third-level domain name any value. The processing policy can be used to indicate how to process the DNS domain name to which the detection rule applies. For example, the processing policy can be to allow or deny.

[0069] Since a detection rule includes a DNS domain name and a processing policy, and the processing policy can be understood as a processing policy for a DNS domain name, the DNS domain name and the processing policy are integrated into a DNS detection policy. A mapping relationship between DNS domain names and processing policies is established in the DNS detection policy. Then, using container group information, the container groups to which multiple detection rules apply are determined. The DNS detection policies are classified according to the container group, and a DNS detection policy applicable to each container group is generated.

[0070] In this way, by processing multiple detection rules, a DNS detection policy corresponding to each container group is generated, which includes the mapping relationship between DNS domain names and processing policies. When the DNS detection policy is needed in the future, a DNS detection policy at the container group level can be provided. At the same time, the DNS detection policy can intuitively represent the applicable DNS domain names and specific processing policies.

[0071] In some embodiments, the first DNS detection strategy includes a mapping relationship between DNS domain names and processing strategies. In this case, the first DNS domain name is extracted from the first network request, and the first network request is processed based on the first DNS detection strategy and the processing strategy corresponding to the first DNS domain name.

[0072] For the first network request, which is a DNS request, the first network request carries a domain name. This domain name can be understood as the domain name that the container group that generated the first network request wants to access. By extracting the domain name from the first network request, we obtain the first DNS domain name carried by the first network request.

[0073] For example, extract the value of the qname field from the first network request, and obtain the first DNS domain name based on the qname field value. For instance, when the qname field value is 3www7example3com0, the first DNS domain name could be www.example.com.

[0074] The first DNS domain can be a multi-level domain, with each level separated by a ".". The rightmost level domain is the first domain. Typically, the first DNS domain does not exceed five levels. For example, in www.example.com, "com" is the first-level domain, "example" is the second-level domain, and "www" is the third-level domain.

[0075] By extracting the first DNS domain name from the first network request, matching the first DNS domain name with multiple "mapping relationships between DNS domain names and processing strategies" in the first DNS detection strategy, determining the processing strategy corresponding to the first DNS domain name, and using the processing strategy corresponding to the first DNS domain name to process the first network request.

[0076] In some embodiments, considering the low matching efficiency of DNS domain names in string form during the matching process, DNS domain names can also be encoded. For example, the mapping relationship between DNS domain names and processing policies includes the mapping relationship between the encoded data obtained after processing the DNS domain names according to the domain name encoding rules and the processing policies.

[0077] Domain name encoding rules can be understood as rules for encoding DNS domain names. Using domain name encoding rules, DNS domain names in string form can be converted into encoded data in numeric form. In other words, by pre-configuring domain name encoding rules, a mapping relationship is established between the DNS domain name and the processing policy when generating the DNS detection policy, in the form of "encoded data of the DNS domain name after processing according to the domain name encoding rules".

[0078] In this way, by converting DNS domain names from string form into encoded data in numeric form, the storage cost of DNS detection strategies is reduced, and the matching cost is reduced and the efficiency of DNS domain name matching is improved during subsequent domain name matching.

[0079] In some embodiments, the DNS domain name may include domain names at multiple levels, and the domain name encoding rules may include the encoding of the candidate domain name at each of the multiple levels.

[0080] In other words, domain names at each level are encoded separately, and corresponding encodings are configured for each candidate domain name at each level, thus forming domain name encoding rules.

[0081] Thus, by taking advantage of the multi-level domain characteristics of DNS domains, the domain name encoding process can be broken down into a multi-level encoding process. When encoding DNS domains using domain name encoding rules, it is only necessary to determine each level of the DNS domain name and then determine the corresponding encoding of the domain name in each level in the domain name encoding rules, so as to form the encoded data corresponding to the DNS domain name and complete the DNS domain name encoding.

[0082] For example, candidate domain names may include at least one of the following: null, arbitrary, and set values.

[0083] A null value can be understood as the domain name at this level being empty. For example, some DNS domain names only include the third-level domain name, while the fourth-level and fifth-level domain names are empty. In this case, the candidate domain names for the fourth-level and fifth-level domain names can be null values. An arbitrary value can be understood as the domain name at this level being any string. That is, the domain name at this level does not affect the final processing strategy. A set value can be understood as the domain name at this level being a preset specific string.

[0084] Figure 3 The illustration shows a schematic diagram of a DNS detection strategy provided by at least one embodiment of the present disclosure.

[0085] like Figure 3 As shown, the domain name encoding rules include the encoding of candidate domain names at each of the multiple levels.

[0086] For example, the DNS domain names in the detection rule can be *.example1.com and www.example2.com. The processing policy for these two DNS domain names can be to allow them, where "*" represents any value. First, the DNS domain name is split into five levels of domain names. *.example1.com can include empty.empty.*.example1.com, empty.*.*.example1.com, and *.*.*.example1.com. www.example2.com can be empty.empty.www.example2.com.

[0087] In the domain name encoding rules, candidate domain names for fifth-level domains can include empty values ​​and arbitrary values, with empty values ​​being encoded as 0 and arbitrary values ​​as 1; candidate domain names for fourth-level domains can include empty values ​​and arbitrary values, with empty values ​​being encoded as 0 and arbitrary values ​​as 1; candidate domain names for third-level domains can include empty values, arbitrary values, and www, with empty values ​​being encoded as 0, arbitrary values ​​as 1, and www as 2; candidate domain names for second-level domains can include empty values, arbitrary values, example1, and example2, with empty values ​​being encoded as 0, arbitrary values ​​as 1, example1 as 2, and example2 as 3; candidate domain names for first-level domains can include empty values, arbitrary values, and com, with empty values ​​being encoded as 0, arbitrary values ​​as 1, and com as 2.

[0088] The DNS domain names in the detection rules are encoded using domain name encoding rules. The encodings of each level of domain name are combined to form encoded data. For example, the encoded data corresponding to *.example1.com can be 00122, 01122, and 11122, and the encoded data corresponding to www.example2.com can be 00232. The processing policy of 1 indicates that the data is allowed, thus forming the processing policy corresponding to the encoded data.

[0089] In this case, the matching process between DNS domain names and DNS detection policies can also be performed using encoded data. For example, based on domain name encoding rules, first encoded data corresponding to the first DNS domain name is generated. The processing policy corresponding to the first encoded data is then retrieved from the first DNS detection policy, and the first network request is processed using the processing policy corresponding to the first encoded data.

[0090] See Figure 3In the example shown, when the first DNS domain name extracted from the first network request is tech.example1.com, the first DNS domain name is encoded according to the domain name encoding rules, and the first encoded data is 00122. The first encoded data is matched with the first DNS detection policy, and the processing policy corresponding to the first network request is determined to be 1, that is, allowed.

[0091] Thus, in the process of domain name matching, the method of matching "encoded data in numerical form" is also adopted. The matching between encoded data in numerical form is less difficult, has a higher accuracy rate, and uses less computing resources, which can achieve efficient and accurate domain name matching, thereby improving the accuracy of DNS request processing.

[0092] After completing domain name matching and determining the processing strategy for the first network request from the first DNS detection strategy, the first network policy is processed using the first network request processing strategy to achieve DNS request filtering and processing. For example, in response to the processing strategy corresponding to the first DNS domain name being the first strategy, the first network request is sent to the DNS service to receive the IP address corresponding to the first DNS domain name returned by the DNS service; or in response to the processing strategy corresponding to the first DNS domain name being the second strategy, the transmission of the first network request is rejected.

[0093] The first strategy can be understood as a pass-through strategy, and the second strategy can be understood as a denial strategy. When the processing strategy for the first network request is the first strategy, it indicates that the first network request is safe and can be forwarded to the DNS service to perform the normal domain name to IP address conversion steps. When the processing strategy for the first network request is the second strategy, it indicates that the first network request is risky and the transmission of the first network request is rejected to prevent the first network request from affecting the operational security of the first computing node and to ensure the cloud security of the first computing node.

[0094] In some possible implementations, the steps of determining whether the first network request is a DNS request, obtaining the first DNS detection policy, and processing the first network request that is a DNS request can be executed by an eBPF program.

[0095] For example, the container group that sends the first network request can be the first container group, which can be understood as any container group running on the first compute node. The first container group can have one or more containers running in it.

[0096] In response to the first container group running on the first compute node, the first eBPF program is loaded in the kernel mode of the first compute node, and the DNS detection policy corresponding to the first container group is written into the eBPF mapping in the kernel mode of the first compute node, thus associating the first eBPF program with the first container group.

[0097] The first eBPF program can be understood as the eBPF program associated with the first container group. The eBPF program can be understood as a programmable code unit running in the kernel mode of the first compute node. The eBPF program is verified by the kernel verifier in the first compute node to ensure its security. It can run in the kernel mode of the first compute node. Compared with traditional kernel modules, the eBPF program can achieve kernel-level functional extensions without modifying the kernel source code.

[0098] The eBPF map resides in the kernel space of the first compute node. It can be understood as a key-value kernel database for data exchange between eBPF programs in the kernel space and other modules in the user space (such as the DNS request processing system). The eBPF map is written from the user space according to the configured DNS detection policy, and the eBPF program in the kernel space can read the DNS detection policy from the eBPF map.

[0099] Thus, when a new container group is running on the first compute node, the above initialization steps configure the eBPF program and corresponding DNS detection policy for the newly running container group, providing comprehensive DNS protection for each container group running on the first compute node and avoiding omissions.

[0100] In some embodiments, the first eBPF program may be deployed in a virtual Ethernet device that communicates with a virtual network interface card within the first container group.

[0101] A virtual network interface card (NIC) can be understood as a network interface within the network namespace of the first container group. It serves as the entry and exit point for the first container group to communicate with the outside world and is used to handle network traffic within the first container group. For example, a virtual NIC could be eth0.

[0102] The virtual Ethernet device is connected to the virtual network interface card (NIC) in the first container group, serving as a communication bridge between the network namespace of the first container group and the network namespace of the first compute node. One end of the virtual Ethernet device is located inside the network namespace of the first container group (i.e., connected to the virtual NIC of the first container group), and the other end is mounted on the network namespace of the first compute node, enabling traffic exchange between the first container group and the first compute node. For example, the virtual Ethernet device can be veth. Network requests issued by the first container group can first pass through eth0 in the first container group, and then through veth connected to eth0 in the first container group, before being forwarded to the destination.

[0103] For example, the first eBPF program can be deployed at the egress point of the traffic controller component in the virtual Ethernet device. The traffic controller component can schedule, distribute, and detect network requests, dynamically adjust the resource consumption between different network requests, and optimize the network performance of the first container group. In other words, for network requests generated by the first container group, after traffic control by the traffic controller component in the virtual Ethernet device, the first eBPF program will process them.

[0104] In other words, during the operation of the first container group, the network requests generated by the first container group will first pass through the virtual network card, and then through the virtual Ethernet device. Since the first eBPF program is deployed in the virtual Ethernet device, the first network request is processed by running the first eBPF program.

[0105] For example, when a new container group is launched on the first compute node, the virtual Ethernet device that communicates with the virtual network interface card (NIC) in the first container group is determined. For example, the virtual Ethernet device that communicates with the virtual NIC in the first container group can be determined by executing the following command:

[0106] kubectl describe pod <pod-name> -n <namespace>| grep "Container ID"

[0107] crictl inspect <container-id>--output go-template --template '{{.info.pid}}'

[0108] nsenter -t $PID -n ip link show eth0

[0109] After determining the virtual Ethernet device in communication with the virtual network card in the first container group, the first eBPF program is loaded to deploy the first eBPF program in the virtual Ethernet device in communication with the virtual network card in the first container group.

[0110] In one or more embodiments of the present disclosure, the first eBPF program can be configured to detect the DNS request and determine the processing policy of the DNS request. For example, in response to the first network request reaching the first eBPF program, the first eBPF program is run to perform the following steps: in response to the first network request being a DNS request, reading the first DNS detection policy from the eBPF map, and processing the first network request using the first DNS detection policy.

[0111] In some embodiments, the first container group and the first eBPF program can be associated with a first identifier (e.g., eBPF_ID), and the first eBPF program can read the first DNS detection policy corresponding to the first container group from the DNS detection policies respectively corresponding to the plurality of container groups stored in the eBPF map of the first computing node according to the first identifier.

[0112] Since the eBPF map of the first computing node can store the DNS detection policies of the plurality of container groups running on the first computing node, by configuring the first identifier corresponding to the first container group and the first eBPF program, the first eBPF program can read the first DNS detection policy corresponding to the first container group from the DNS detection policies respectively corresponding to the plurality of container groups stored in the eBPF map of the first computing node, thereby achieving the screening of the DNS detection policy.

[0113] Further, considering that the resource information of the first computing node can change, an update mechanism of the DNS detection policy can also be configured, for example, in response to the resource information of the first computing node changing, updating the DNS detection policy stored in the eBPF map in the kernel state of the first computing node. The resource information of the first computing node can include at least one of the following: container group information running on the first computing node, and detection rules applied to the first computing node.

[0114] For example, in the first computing node orchestrated by the Kubernetes container orchestration system, the container group information running on the first computing node and the detection rule applied to the first computing node can be obtained through the ApiServer component provided by the Kubernetes container orchestration system.

[0115] When the container group information running on the first computing node changes, the DNS detection policy stored in the eBPF map in the kernel mode of the first computing node also changes. For example, when a new container group runs on the first computing node, a DNS detection policy corresponding to the new container group can be added in the DNS detection policy stored in the eBPF map in the kernel mode of the first computing node; when the container group information of a running container group is modified, the DNS detection policy corresponding to the container group whose container group information is modified and stored in the eBPF map in the kernel mode of the first computing node can be modified synchronously; when a running container group is deleted, the DNS detection policy corresponding to the container group can be deleted in the DNS detection policy stored in the eBPF map in the kernel mode of the first computing node.

[0116] When the detection rule applied to the first computing node changes, the DNS detection policy stored in the eBPF map in the kernel mode of the first computing node also changes. For example, when a new detection rule is added, a corresponding DNS detection policy can be generated according to the new detection rule, and the corresponding DNS detection policy can be added in the DNS detection policy stored in the eBPF map in the kernel mode of the first computing node; when an existing DNS detection policy is modified, the corresponding DNS detection policy in the eBPF map in the kernel mode of the first computing node can be modified synchronously; when an existing DNS detection policy is deleted, the corresponding DNS detection policy can be deleted in the DNS detection policy stored in the eBPF map in the kernel mode of the first computing node.

[0117] In this way, by detecting the resource information of the first computing node, the DNS detection policy stored in the eBPF map in the kernel mode of the first computing node is updated in real time, ensuring the real-time performance of the DNS detection policy stored in the eBPF map in the kernel mode of the first computing node, and improving the accuracy of DNS protection.

[0118] The foregoing describes the cloud security-protecting DNS request processing method provided by one or more embodiments of the present disclosure, and the following describes the DNS request processing flow in combination with a specific DNS request processing system.

[0119] Figure 4 An illustrative structure diagram of a user mode and a kernel mode provided by at least one embodiment of the present disclosure is shown.

[0120] The DNS request processing system can be deployed in the user space, as shown in Figure 4 From the perspective of the control layer, the DNS request processing system can include a controller module, a cache module, and a handle module. The controller is configured to perceive changes in resource information of the first computing node, such as changes in container group resources and changes in policy resources. The cache module is configured to cache data in the DNS request processing system, such as container group cache, policy cache, and domain name cache. The handle module is configured to compile and load eBPF programs in the kernel space and write eBPF maps in the kernel space.

[0121] In this way, the DNS request processing system is logically divided into three modules, so that the DNS request processing system can update eBPF programs and eBPF maps in the kernel space in real time based on changes in resource information of the first computing node.

[0122] Figure 5 An interaction diagram between the controller module and the cache module in the user space is schematically shown.

[0123] As shown in Figure 5 , the controller module can perceive that a container group is running on the first computing node, modify container group information of a running container group, or delete a container group. For changes in container group resources on the first computing node, the controller module can obtain container group cache from the cache module, compare the container group cache, and update data cached in the cache module.

[0124] For example, for a container group running on the first computing node, if there is no data of a container group to be added in the container group cache, a container group addition request (e.g., a message of container group addition) can be submitted to the cache module. For example, for modifying container group information (e.g., modifying a label of a container group) of a running container group or deleting a container group on the first computing node, if there is data of a container group to be modified / deleted in the container group cache, a container group modification / deletion request can be submitted to the cache module.

[0125] Figure 6 An interaction diagram between the controller module and the cache module in the user space is schematically shown.

[0126] As shown in Figure 6 , the controller module can perceive that a detection rule is added, an existing detection rule is modified, or a detection rule is deleted on the first computing node. For changes in policy resources on the first computing node, the controller module can obtain policy cache from the cache module, compare the policy cache, and update data cached in the cache module.

[0127] For example, for adding a detection rule on the first computing node, if there is no DNS detection policy to be added in the policy cache, a policy adding request (for example, a message of policy adding) can be submitted to the cache module; for example, for modifying or deleting an existing detection rule on the first computing node, if there is a DNS detection policy to be modified / deleted in the policy cache, a policy modification / deletion request can be submitted to the cache module.

[0128] In this way, the data cached in the cache module in the DNS request processing system is updated in real time, so that the cache module can push the latest DNS detection policy to the kernel state in real time through the processor module.

[0129] Figure 7 An interaction schematic diagram of the cache module in the user state and the eBPF map in the kernel state provided by at least one embodiment of the present disclosure is schematically shown.

[0130] As shown in Figure 7 The container group cache in the cache module can include the identifier of the eBPF program, the container group information, the information of the virtual Ethernet device, and the DNS detection policy, the policy cache in the cache module can include the container group information and the DNS detection policy, and the domain name cache in the cache module can include the domain name encoding rule.

[0131] The identifier of the eBPF program can be eBPF_ID, which can uniquely identify the eBPF program and thus uniquely identify the container group. When deploying the eBPF program, the identifier of the eBPF program needs to be written together, so as to query the DNS detection policy corresponding to the container group by using the identifier of the eBPF program later. The container group information can be the attribute information of the container group, which can include the namespace of the container group and the label of the container group, for example. The container group information can be used to determine the container group to which the detection rule applies. The information of the virtual Ethernet device can be the identifier of the virtual Ethernet device, such as the veth device ID. The information of the virtual Ethernet device can be used to determine the location where the eBPF program is deployed. The DNS detection policy is consistent with the DNS detection policy stored in the eBPF map in the kernel state, which is used for information backup in the DNS request processing system. The domain name encoding rule can be a key-value pair of "candidate domain name" and "encoding". The domain name encoding rule is consistent with the domain name encoding rule stored in the eBPF map in the kernel state, which is used for information backup in the DNS request processing system.

[0132] Figure 8 An interaction schematic diagram of the cache module in the user state and the processor module provided by at least one embodiment of the present disclosure is schematically shown.

[0133] As shown in Figure 8 As shown, when a container group is added or modified, the container group cache is updated, and the processor module is invoked to synchronously update the eBPF program and eBPF mapping in kernel mode. For example, when a container group is added, the processor module is invoked, causing it to execute S12, S13, and S14. That is, the processor module uses the `map create` command to create the identifier corresponding to the eBPF program, uses the `map add` command to add a DNS detection policy to the identifier corresponding to the eBPF program, and uses the `prog compile / load` command to compile and load the eBPF program. As another example, when a container group is modified, the processor module is invoked, causing it to execute S11 and S13. That is, the processor module uses the `map delete` command to delete the existing DNS detection policy for the identifier corresponding to the eBPF program, and uses the `map add` command to add a DNS detection policy to the identifier corresponding to the eBPF program.

[0134] When a container group is deleted, the processor module is invoked to synchronously delete the eBPF program and eBPF mapping in kernel mode, and to delete the container group cache. For example, the processor module is invoked to execute S21 and S22, that is, the processor module deletes the eBPF program using the prog drop command and deletes the DNS detection policy corresponding to the eBPF program using the map drop command.

[0135] Figure 9 The illustration shows an interactive diagram of a cache module and a processor module in user space, provided in at least one embodiment of the present disclosure.

[0136] like Figure 9 As shown, when a detection rule is updated, it is first determined whether the detection rule has been deleted. If so, the container group that needs to be updated is identified, and the DNS detection policy is regenerated for the container group that needs to be updated. If not, the domain name cache is updated, the DNS detection policy is checked to see if it has changed, and the DNS detection policy is regenerated.

[0137] Next, the processor module is invoked to synchronously update the eBPF program and eBPF mapping in kernel mode, and to update the container group cache and policy cache. For example, the processor module is invoked to execute S31, S32, and S33. That is, the processor module uses the map delete command to delete the existing DNS detection policy for the identifier corresponding to the eBPF program, and uses the map add command to add a DNS detection policy and a new domain name encoding rule for the identifier corresponding to the eBPF program.

[0138] In this way, by triggering system calls through the processor module, real-time updates of eBPF programs and eBPF mappings in kernel mode can be achieved.

[0139] Figure 10 The illustration shows a schematic diagram of the execution flow of an eBPF program in kernel mode provided by at least one embodiment of the present disclosure.

[0140] like Figure 10 As shown, from the data layer perspective, DNS request filtering and interception are achieved by running eBPF programs. For example, when a network request reaches a virtual Ethernet device through a virtual network interface card in a container group, the eBPF program runs to filter network requests, identifying those that are DNS requests. For these DNS requests, the domain name is extracted, and the domain name encoding rules and the corresponding DNS detection policy of the container group are read from the eBPF mapping. The domain name is encoded according to the domain name encoding policy and matched with the DNS detection policy to determine the processing policy for the DNS requests, such as allowing or denying them. If allowed, the DNS requests are sent to the compute node's eth0, so that the compute node's eth0 will forward the DNS requests to the DNS service for IP address translation.

[0141] Based on the DNS request processing method for protecting cloud security provided in at least one embodiment of this disclosure, at least one embodiment of this disclosure also provides a DNS request processing apparatus for protecting cloud security. The following will be combined with... Figure 11 This DNS request processing device, which protects cloud security, is described in detail.

[0142] Figure 11 The illustration shows a schematic diagram of the structure of a DNS request processing apparatus for protecting cloud security provided in at least one embodiment of the present disclosure.

[0143] like Figure 11 As shown, the DNS request processing device 1100 for protecting cloud security in this embodiment includes a receiving module 1101 and a processing module 1102. For example, the receiving module 1101 and the processing module 1102 can be implemented using hardware (e.g., circuit) modules or software modules. The following embodiments are similar and will not be described again. For example, the receiving module 1101 and the processing module 1102 can be implemented using a central processing unit (CPU), a general-purpose graphics processing unit (GPGPU), a graphics processing unit (GPU), a tensor processor (TPU), a field-programmable gate array (FPGA), or other forms of processing units with data processing capabilities and / or instruction execution capabilities, along with corresponding computer instructions.

[0144] The receiving module 1101 is configured to receive a first network request generated by at least one container group running on the first computing node. For example, the receiving module 1101 can be configured to execute step S201 described above; its specific implementation principle can be found in the relevant description of step S201, and will not be repeated here.

[0145] The processing module 1102 is configured to: in response to the first network request being a DNS request, obtain a first DNS detection policy corresponding to the container group that sent the first network request, and process the first network request using the first DNS detection policy. For example, the processing module 1102 can be configured to execute step S202 described above; its specific implementation principle can be found in the relevant description of step S202, and will not be repeated here.

[0146] In at least one embodiment of this disclosure, the DNS detection policies corresponding to at least one container group running on the first computing node are generated as follows: multiple detection rules are obtained, wherein each detection rule includes: container group information, DNS domain name, and processing policy; for each detection rule, a mapping relationship is established between the DNS domain name and the processing policy in the detection rule to obtain the DNS detection policy corresponding to the detection rule; based on the container group information included in each detection rule, a DNS detection policy corresponding to at least one container group running on the first computing node is generated.

[0147] In at least one embodiment of this disclosure, the first DNS detection strategy includes a mapping relationship between DNS domain names and processing strategies, and the processing module 1102 is further configured to: extract a first DNS domain name from the first network request; and process the first network request based on the first DNS detection strategy and using the processing strategy corresponding to the first DNS domain name.

[0148] In at least one embodiment of this disclosure, the processing module 1102 is further configured to: in response to the processing policy corresponding to the first DNS domain name being a first policy, send the first network request to the DNS service to receive the IP address corresponding to the first DNS domain name returned by the DNS service; or in response to the processing policy corresponding to the first DNS domain name being a second policy, reject the transmission of the first network request.

[0149] In at least one embodiment of this disclosure, the mapping relationship between the DNS domain name and the processing strategy includes: the mapping relationship between the encoded data obtained after processing the DNS domain name according to the domain name encoding rules and the processing strategy.

[0150] In at least one embodiment of this disclosure, the DNS domain name includes multiple levels of domain names, and the domain name encoding rule includes: the encoding corresponding to the candidate domain name under each of the multiple levels.

[0151] In at least one embodiment of this disclosure, the candidate domain name includes at least one of the following: null value, arbitrary value, and set value.

[0152] In at least one embodiment of this disclosure, the processing module 1102 is further configured to: generate first encoded data corresponding to the first DNS domain name based on the domain name encoding rules; find the processing strategy corresponding to the first encoded data from the first DNS detection strategy; and process the first network request using the processing strategy corresponding to the first encoded data.

[0153] In at least one embodiment of this disclosure, the processing module 1102 is further configured to: in response to the field value of the first field indicating the network layer communication protocol, the field value of the second field indicating the transport layer communication protocol, and the field value of the third field indicating the destination port in the first network request indicating that the first network request is a DNS request, obtain a first DNS detection policy corresponding to the container group that sent the first network request.

[0154] In at least one embodiment of this disclosure, the container group that sends the first network request is a first container group, and the DNS request processing device 1100 for protecting cloud security further includes a configuration module, which is configured to: in response to the first container group running on the first computing node, load a first eBPF program in the kernel mode of the first computing node, and write the DNS detection policy corresponding to the first container group into the eBPF mapping in the kernel mode of the first computing node; wherein, the first eBPF program is associated with the first container group.

[0155] In at least one embodiment of this disclosure, the processing module 1102 is further configured to: in response to the arrival of the first network request in the first eBPF program, run the first eBPF program to perform the following steps: in response to the first network request being a DNS request, read the first DNS detection policy from the eBPF mapping, and process the first network request using the first DNS detection policy.

[0156] In at least one embodiment of this disclosure, the first eBPF program is deployed in a virtual Ethernet device that communicates with a virtual network interface card within the first container group.

[0157] In at least one embodiment of this disclosure, the DNS request processing apparatus 1100 for protecting cloud security further includes an update module, which is configured to update the DNS detection policy stored in the eBPF mapping in the kernel mode of the first computing node in response to a change in the resource information of the first computing node, wherein the resource information of the first computing node includes at least one of the following: container group information running on the first computing node and detection rules applied to the first computing node.

[0158] It should be noted that, for clarity and brevity, at least one embodiment of this disclosure does not show all the constituent units of the DNS request processing device 1100 for protecting cloud security. To achieve the necessary functions of the DNS request processing device 1100 for protecting cloud security, those skilled in the art can provide and set other constituent units (not shown) according to specific needs, and one or more embodiments of this disclosure do not limit this.

[0159] At least one embodiment of this disclosure also provides an electronic device, including a processing device and a storage device, the storage device including one or more computer program modules; wherein the one or more computer program modules are stored in the storage device and configured to be executed by the processing device, the one or more computer program modules being used to implement the DNS request processing method for protecting cloud security provided in any embodiment of this disclosure.

[0160] For example, the processing device may be a processor, such as a central processing unit (CPU), digital signal processor (DSP), image processor (GPU), general-purpose graphics processor (GPGPU), or other form of processing unit with data processing capabilities and / or instruction execution capabilities. It may be a general-purpose processor or a dedicated processor and may control other components in the electronic device to perform the desired functions.

[0161] For example, the storage device may be a memory, which may include one or more computer program products. These computer program products may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and a processing device may execute these program instructions to implement the functions (implemented by the processing device) in at least one embodiment of this disclosure and / or other desired functions. Various application programs and various data may also be stored in the computer-readable storage medium, which is not limited by one or more embodiments of this disclosure.

[0162] The following is for reference. Figure 12 The diagram illustrates a structural schematic of an electronic device (e.g., a terminal device or a server) 1200 suitable for implementing at least one embodiment of the present disclosure. The terminal device in at least one embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 12 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of at least one embodiment of this disclosure.

[0163] like Figure 12 As shown, the electronic device 1200 may include a processing unit (e.g., a central processing unit, a graphics processor, etc.) 1201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1202 or a program loaded from a storage device 1208 into a random access memory (RAM) 1203. The RAM 1203 also stores various programs and data required for the operation of the electronic device 1200. The processing unit 1201, ROM 1202, and RAM 1203 are interconnected via a bus 1204. An input / output (I / O) interface 1205 is also connected to the bus 1204.

[0164] Typically, the following devices can be connected to I / O interface 1205: input devices 1206 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 1207 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1208 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1209. Communication device 1209 allows electronic device 1200 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 12 An electronic device 1200 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0165] In particular, according to one or more embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, one or more embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 1209, or installed from storage device 1208, or installed from ROM 1202. When the computer program is executed by processing device 1201, it performs the functions defined in the methods of at least one embodiment of this disclosure.

[0166] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0167] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol), and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks ("LANs"), wide area networks ("WANs"), the Internet (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0168] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0169] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the aforementioned DNS request processing method for protecting cloud security.

[0170] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0171] One or more embodiments of this disclosure also provide a computer program product comprising one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in any embodiment of this disclosure are generated.

[0172] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0173] When the computer program product is executed by a computer, the computer performs any of the aforementioned DNS request processing methods for protecting cloud security. The computer program product can be a software installation package; when any of the aforementioned DNS request processing methods for protecting cloud security is required, the computer program product can be downloaded and executed on the computer.

[0174] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0175] The units or modules described in at least one embodiment of this disclosure can be implemented in software or hardware. The names of the units or modules do not necessarily limit the specific unit or module itself.

[0176] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0177] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0178] According to one or more embodiments of this disclosure, Example 1 provides a DNS request processing method for protecting cloud security, applied to a first computing node, the method comprising:

[0179] Receive a first network request generated by at least one container group running on the first computing node;

[0180] In response to the first network request being a DNS request, a first DNS detection policy corresponding to the container group that sent the first network request is obtained, and the first network request is processed using the first DNS detection policy.

[0181] According to one or more embodiments of this disclosure, Example 2 provides that the DNS detection policies corresponding to at least one container group running on the first computing node in Example 1 are generated in the following manner:

[0182] Multiple detection rules are obtained, wherein each of the multiple detection rules includes: container group information, DNS domain name, and processing policy;

[0183] For each of the plurality of detection rules, a mapping relationship is established between the DNS domain name in the detection rule and the processing strategy to obtain the DNS detection strategy corresponding to the detection rule;

[0184] Based on the container group information included in each of the plurality of detection rules, a DNS detection policy corresponding to at least one container group running on the first computing node is generated.

[0185] According to one or more embodiments of this disclosure, Example 3 provides the first DNS detection strategy in Example 1, which includes: a mapping relationship between DNS domain names and processing strategies. The step of processing the first network request using the first DNS detection strategy includes:

[0186] The first DNS domain name is extracted from the first network request;

[0187] Based on the first DNS detection strategy, the first network request is processed using the processing strategy corresponding to the first DNS domain name.

[0188] According to one or more embodiments of this disclosure, Example 4 provides the processing strategy corresponding to the first DNS domain name in Example 3 for processing the first network request, including:

[0189] In response to the processing policy corresponding to the first DNS domain name being the first policy, the first network request is sent to the DNS service to receive the IP address corresponding to the first DNS domain name returned by the DNS service; or

[0190] In response to the second policy corresponding to the first DNS domain name, the transmission of the first network request is rejected.

[0191] According to one or more embodiments of this disclosure, Example 5 provides the mapping relationship between DNS domain names and processing strategies in Example 3, including: the mapping relationship between encoded data obtained after processing the DNS domain names according to domain name encoding rules and the processing strategy.

[0192] According to one or more embodiments of this disclosure, Example Six provides that the DNS domain name in Example Five includes domain names at multiple levels, and the domain name encoding rule includes: the encoding corresponding to the candidate domain name under each of the multiple levels.

[0193] According to one or more embodiments of this disclosure, Example 7 provides that the candidate domain name in Example 6 includes at least one of the following: null value, arbitrary value, and set value.

[0194] According to one or more embodiments of this disclosure, Example 8 provides the processing of the first network request based on the first DNS detection strategy and utilizing the processing strategy corresponding to the first DNS domain name, as described in Example 5, including:

[0195] Based on the domain name encoding rules, generate the first encoded data corresponding to the first DNS domain name;

[0196] The processing strategy corresponding to the first encoded data is obtained from the first DNS detection strategy;

[0197] The first network request is processed using the processing strategy corresponding to the first encoded data.

[0198] According to one or more embodiments of this disclosure, Example 9 provides the method described in Example 1 for obtaining a first DNS detection policy corresponding to the container group that sent the first network request in response to the first network request being a DNS request, including:

[0199] In response to the field values ​​of the first field indicating the network layer communication protocol, the second field indicating the transport layer communication protocol, and the third field indicating the destination port in the first network request, which indicate that the first network request is a DNS request, a first DNS detection policy corresponding to the container group that sent the first network request is obtained.

[0200] According to one or more embodiments of this disclosure, Example 10 provides that the container group sending the first network request in any of Examples 1 to 9 is a first container group, and the method further includes:

[0201] In response to the first container group running on the first compute node, the first eBPF program is loaded in the kernel mode of the first compute node, and the DNS detection policy corresponding to the first container group is written into the eBPF mapping in the kernel mode of the first compute node.

[0202] The first eBPF program is associated with the first container group.

[0203] According to one or more embodiments of this disclosure, Example 11 provides, as in Example 10, obtaining a first DNS detection policy corresponding to the container group that sent the first network request when the first network request is a DNS request, and processing the first network request using the first DNS detection policy, including:

[0204] In response to the arrival of the first network request in the first eBPF program, the first eBPF program is run to perform the following steps: in response to the first network request being a DNS request, the first DNS detection policy is read from the eBPF mapping, and the first network request is processed using the first DNS detection policy.

[0205] According to one or more embodiments of this disclosure, Example Twelve provides a first eBPF program, as in Example Ten, deployed in a virtual Ethernet device that communicates with a virtual network interface card within the first container group.

[0206] According to one or more embodiments of this disclosure, Example Thirteen provides the method of Example Ten, further comprising:

[0207] In response to a change in the resource information of the first compute node, the DNS detection policy stored in the eBPF mapping in the kernel mode of the first compute node is updated, wherein the resource information of the first compute node includes at least one of the following: container group information running on the first compute node, and detection rules applied to the first compute node.

[0208] According to one or more embodiments of this disclosure, Example Fourteen provides a DNS request processing apparatus for protecting cloud security, deployed on a first computing node, the apparatus comprising:

[0209] The receiving module is configured to receive a first network request generated by at least one container group running on the first computing node;

[0210] The processing module is configured to: in response to the first network request being a DNS request, obtain a first DNS detection policy corresponding to the container group that sent the first network request, and process the first network request using the first DNS detection policy.

[0211] According to one or more embodiments of this disclosure, Example Fifteen provides an electronic device, including:

[0212] Processing device; and

[0213] Storage device, including one or more computer program instructions;

[0214] The one or more computer program instructions are executed by a processing device to perform the DNS request processing method for protecting cloud security provided in at least one embodiment of the present disclosure.

[0215] According to one or more embodiments of the present disclosure, Example Sixteen provides a computer-readable storage medium that non-transitory stores computer-readable instructions, wherein the computer-readable instructions, when executed by a processor, implement the DNS request processing method for protecting cloud security provided in at least one embodiment of the present disclosure.

[0216] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0217] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0218] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims. < / namespace> < / pod-name>

Claims

1. A DNS request processing method for protecting cloud security, applied to a first computing node, the method comprising: Receive a first network request generated by at least one container group running on the first computing node; In response to the first network request being a DNS request, a first DNS detection policy corresponding to the container group that sent the first network request is obtained, and the first network request is processed using the first DNS detection policy.

2. The method according to claim 1, wherein, The DNS detection policies corresponding to at least one container group running on the first compute node are generated in the following manner: Multiple detection rules are obtained, wherein each of the multiple detection rules includes: container group information, DNS domain name, and processing policy; For each of the plurality of detection rules, a mapping relationship is established between the DNS domain name in the detection rule and the processing strategy to obtain the DNS detection strategy corresponding to the detection rule; Based on the container group information included in each of the plurality of detection rules, a DNS detection policy corresponding to at least one container group running on the first computing node is generated.

3. The method according to claim 1, wherein, The first DNS detection strategy includes: the mapping relationship between DNS domain names and processing strategies. The step of processing the first network request using the first DNS detection strategy includes: The first DNS domain name is extracted from the first network request; Based on the first DNS detection strategy, the first network request is processed using the processing strategy corresponding to the first DNS domain name.

4. The method according to claim 3, wherein, The step of processing the first network request using the processing strategy corresponding to the first DNS domain name includes: In response to the processing policy corresponding to the first DNS domain name being the first policy, the first network request is sent to the DNS service to receive the IP address corresponding to the first DNS domain name returned by the DNS service; or In response to the second policy corresponding to the first DNS domain name, the transmission of the first network request is rejected.

5. The method according to claim 3, wherein, The mapping relationship between the DNS domain name and the processing strategy includes the mapping relationship between the encoded data obtained after processing the DNS domain name according to the domain name encoding rules and the processing strategy.

6. The method according to claim 5, wherein, The DNS domain name includes multiple levels of domain names. The domain name encoding rules include: the encoding corresponding to the candidate domain names under each of the multiple levels.

7. The method according to claim 6, wherein, The candidate domain name includes at least one of the following: null value, arbitrary value, and set value.

8. The method according to claim 5, wherein, The step of processing the first network request based on the first DNS detection strategy and utilizing the processing strategy corresponding to the first DNS domain name includes: Based on the domain name encoding rules, generate the first encoded data corresponding to the first DNS domain name; The processing strategy corresponding to the first encoded data is obtained from the first DNS detection strategy; The first network request is processed using the processing strategy corresponding to the first encoded data.

9. The method according to claim 1, wherein, The step of responding to the first network request being a DNS request and obtaining the first DNS detection policy corresponding to the container group that sent the first network request includes: In response to the field values ​​of the first field indicating the network layer communication protocol, the second field indicating the transport layer communication protocol, and the third field indicating the destination port in the first network request indicating that the first network request is a DNS request, a first DNS detection policy corresponding to the container group that sent the first network request is obtained.

10. The method according to any one of claims 1 to 9, wherein, The container group that sends the first network request is the first container group, and the method further includes: In response to the first container group running on the first compute node, the first eBPF program is loaded in the kernel mode of the first compute node, and the DNS detection policy corresponding to the first container group is written into the eBPF mapping in the kernel mode of the first compute node. The first eBPF program is associated with the first container group.

11. The method according to claim 10, wherein, The step of responding to the first network request being a DNS request by obtaining a first DNS detection policy corresponding to the container group that sent the first network request, and processing the first network request using the first DNS detection policy, includes: In response to the arrival of the first network request in the first eBPF program, the first eBPF program is run to perform the following steps: in response to the first network request being a DNS request, the first DNS detection policy is read from the eBPF mapping, and the first network request is processed using the first DNS detection policy.

12. The method according to claim 10, wherein, The first eBPF program is deployed in a virtual Ethernet device that communicates with the virtual network interface card within the first container group.

13. The method of claim 10, further comprising: In response to a change in the resource information of the first compute node, the DNS detection policy stored in the eBPF mapping in the kernel mode of the first compute node is updated, wherein the resource information of the first compute node includes at least one of the following: container group information running on the first compute node, and detection rules applied to the first compute node.

14. A DNS request processing device for protecting cloud security, deployed on a first computing node, the device comprising: The receiving module is configured to receive a first network request generated by at least one container group running on the first computing node; The processing module is configured to: in response to the first network request being a DNS request, obtain a first DNS detection policy corresponding to the container group that sent the first network request, and process the first network request using the first DNS detection policy.

15. An electronic device comprising: Processing device; as well as Storage device, including one or more computer program instructions; The one or more computer program instructions are executed by the processing device to perform the method according to any one of claims 1 to 13.

16. A computer-readable storage medium for non-transitory storage of computer-readable instructions, wherein, The method of any one of claims 1 to 13 is implemented when the computer-readable instructions are executed by a processor.

Images