Lightweight trusted container sandbox construction method and system, terminal and medium

Abstract

The invention discloses a lightweight trusted container sandbox construction method and system, a terminal and a medium, and relates to the technical field of trusted computing, and the technical scheme is characterized by comprising the following steps: constructing an extremely simple container basic environment; integrating a built-in trusted measurement mechanism; realizing kernel-level static measurement; dynamic measurement of a user mode is realized; and establishing trusted sandbox isolation. According to the method, the container mirror image is generated in a rootfs mode under the same system environment, system components are simplified greatly, a hardware-level trusted root is constructed, and innovative technologies such as full-link trusted measurement are realized, so that the problems of insufficient mirror image security, insufficient isolation, lack of trusted mechanisms, high resource consumption, high system overhead and the like in the existing container technology are solved; and high-security, high-credibility and lightweight deployment of the container environment is realized.

Description

Technical Field

[0001] This invention relates to the field of trusted computing technology, and more specifically, to a lightweight trusted container sandbox construction method, system, terminal, and medium. Background Technology

[0002] Container technology is an operating system-level virtualization technology that decouples applications from the underlying operating system and hardware by packaging applications and all their dependencies into standardized container images. Container images can be quickly deployed in any environment that supports container runtime, forming independent and isolated running units, ensuring application consistency in development, testing, and production environments.

[0003] Current container technologies (such as Docker and Kubernetes) have the following shortcomings in data security and privacy protection: 1) Insufficient image security: Traditional container images are usually built based on official base images, containing a large number of unnecessary components and dependencies. This not only increases the image size but also expands the attack surface. Especially in domestically developed systems, many systems do not provide official container images, resulting in uncontrollable image sources and security vulnerabilities. This also leads to large image sizes, slow startup, and high resource consumption. 2) Insufficient isolation: Traditional container technologies achieve isolation based on Linux kernel namespaces and cgroups, but they share the host kernel, posing a risk of container escape and failing to meet the requirements of high-security scenarios. 3) Lack of a trust mechanism: Existing container technologies lack a full-link trust measurement mechanism from hardware to application, failing to ensure the integrity of the container environment and runtime security.

[0004] Therefore, researching and designing a lightweight and trustworthy container sandbox construction method, system, terminal, and medium that can overcome the above-mentioned defects is an urgent problem to be solved. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention aims to provide a lightweight, trusted container sandbox construction method, system, terminal, and medium. Through innovative technologies such as generating container images using a rootfs approach within a co-system environment, simplifying system components, constructing a hardware-level root of trust, and implementing end-to-end trusted measurement, it solves problems in existing container technologies such as insufficient image security, inadequate isolation, lack of trusted mechanisms, high resource consumption, and large system overhead. This achieves high security, high trustworthiness, and lightweight deployment of the container environment. This method can be widely applied in scenarios such as enterprise collaborative R&D, AI model training and inference, and trusted data spaces, exhibiting significant security performance advantages and commercial application value.

[0006] The above-mentioned technical objective of the present invention is achieved through the following technical solution: Firstly, a lightweight and trustworthy container sandbox construction method is provided, including the following steps: A minimal container base environment is built. The minimal container base environment is implemented by building a rootfs in a virtual machine environment on the same system. The rootfs retains only the core components necessary for container operation, removes unnecessary system services, drivers and / or device files, and uses static linking to compile the core components and simplifies the system call interface. An integrated built-in trusted measurement mechanism is included, which includes an integrated hardware-level root of trust, whitelisting of container files and establishing a file integrity baseline. Implement kernel-level static metrics, which include trusted metrics and static whitelist verification of the container startup process; Implement user-mode dynamic measurement, which includes real-time monitoring and measurement of files, directories and processes within the container; A trusted sandbox isolation is constructed, which is based on hardware virtualization technology to achieve multi-dimensional isolation of computing, network and storage, and dynamically adjusts the isolation strategy in combination with the trust measurement results.

[0007] Furthermore, the construction of the minimalist container base environment specifically includes: Create a minimal rootfs directory structure using rootfs build units, containing only necessary system directories, copying binary files and libraries, compiling core components using static linking, creating necessary device files, and configuring a minimal system configuration file; Remove unnecessary system services, drivers, and / or device files through streamlined system component elements, and restrict system calls through seccomp filters; The runtime supports hardware trust metrics through a lightweight container runtime unit design, integrates hardware virtualization support, optimizes the startup process, and pre-allocates resources.

[0008] Furthermore, the integrated built-in trust measurement mechanism specifically includes: The trusted platform module is integrated as a hardware trusted root through the hardware trusted root integration unit, the trusted platform module is initialized and its communication mechanism with the container runtime is configured. The container file whitelist scanning unit scans all files during the container build process, calculates hash values, and records permissions and timestamps to establish a file integrity baseline and form a whitelist, supporting dynamic updates of the whitelist and signature verification.

[0009] Furthermore, the implementation of kernel-level static metrics specifically includes: The trust measurement unit in the startup process verifies the image signature and integrity during container startup, measures key startup steps and stores the results in the platform configuration register, thus enabling remote verification. The static whitelist verification unit performs static whitelist verification on executable files, dynamic libraries, and configuration files within the container, supporting national cryptographic algorithm signature verification and certificate management.

[0010] Furthermore, the implementation of user-state dynamic measurement specifically includes: The file-level dynamic measurement unit monitors file creation, modification, and deletion operations in user space, measures them in real time, compares them with a whitelist, blocks unauthorized operations, and issues alerts. Monitor access to critical directories through directory-level dynamic metric units, implement directory permission control and whitelist mechanisms, and record permission changes; The system monitors process creation, execution, and termination through process-level dynamic measurement units, verifies process permissions, periodically measures process memory, and detects anomalies.

[0011] Furthermore, the construction of the trusted sandbox isolation specifically includes: By using a multi-dimensional isolation mechanism unit based on hardware virtualization technology, independent virtual CPU, memory, network card and storage space are allocated to containers to achieve isolation and policy control of computing, network and storage resources; By dynamically adjusting the isolation strategy through trusted enhancement isolation units and trusted measurement results, untrusted containers are isolated, secure terminal access is provided and file transfer is restricted, and operation logs are recorded.

[0012] Furthermore, the method also includes: A secure terminal access container is provided through the secure terminal access unit to restrict file transfer and copy-paste operations and record terminal operation logs. Hardware key devices are supported through a hardware key integration unit to enable data access control; The remote proof unit enables end-to-end remote trusted verification in the container environment, supporting the generation and verification of proof reports.

[0013] Secondly, a lightweight trusted container sandbox construction system is provided, which is used to implement a lightweight trusted container sandbox construction method as described in any one of the first aspects, including: The container environment building module is configured to build a minimal container base environment. The minimal container base environment is implemented by building a rootfs in a virtual machine environment on the same system. The rootfs retains only the core components necessary for container operation, removes unnecessary system services, drivers and / or device files, and uses static linking to compile the core components and simplifies the system call interface. The built-in measurement integration module is configured to integrate a built-in trusted measurement mechanism, which includes integrating a hardware-level root of trust, performing a whitelist scan on container files and establishing a file integrity baseline. The kernel measurement implementation module is configured to implement kernel-level static measurement, which includes trusted measurement and static whitelist verification of the container startup process. The user measurement implementation module is configured to implement user-mode dynamic measurement, which includes real-time monitoring and measurement of files, directories and processes within the container. The sandbox isolation construction module is configured to build a trusted sandbox isolation. The trusted sandbox isolation is based on hardware virtualization technology to achieve multi-dimensional isolation of computing, network and storage, and dynamically adjusts the isolation strategy in combination with the trust measurement results.

[0014] Thirdly, a computer terminal is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement a lightweight trusted container sandbox construction method as described in any one of the first aspects.

[0015] Fourthly, a computer-readable medium is provided having a computer program stored thereon, the computer program being executed by a processor to implement a lightweight trusted container sandbox construction method as described in any one of the first aspects.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention addresses the shortcomings of existing container technologies, such as insufficient image security, inadequate isolation, lack of trust mechanisms, high resource consumption, and large system overhead, by using innovative technologies such as generating container images through rootfs construction in a homogeneous system environment, greatly simplifying system components, building hardware-level trusted roots, and implementing end-to-end trusted measurement. This achieves high security, high trustworthiness, and lightweight deployment of the container environment. This method can be widely applied in scenarios such as enterprise collaborative R&D, AI model training and inference, and trusted data spaces, demonstrating significant security performance advantages and commercial application value. 2. This invention improves startup speed by implementing a lightweight container runtime and reduces CPU overhead by unloading through the user-space file system; 3. This invention provides end-to-end trusted measurement from hardware to application, ensuring the integrity of the container environment; the container image is completely autonomous and controllable, avoiding the security risks of third-party images, and supporting domestically produced system environments; 4. This invention is transparent and seamless, and can be used without modifying existing applications; it also supports national cryptographic algorithms and can provide complete management and monitoring interfaces, making it convenient for operation and maintenance management. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings: Figure 1 This is the overall flowchart of Embodiment 1 of the present invention; Figure 2 This is a flowchart illustrating the construction process of the container base environment in Embodiment 1 of the present invention; Figure 3 This is a system block diagram in Embodiment 2 of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0019] rootfs: short for "Root Filesystem", the root file system; cgroups: short for "Control Groups"; Docker: An open-source containerization platform; Kubernetes: An open-source container orchestration system; seccomp: short for "Secure Computing Mode"; TPM stands for "Trusted Platform Module". TCM stands for "Trusted Cryptography Module".

[0020] PCR stands for "Platform Configuration Register". CPU: Short for "Central Processing Unit"; OS stands for "Operating System".

[0021] Example 1: A lightweight and trustworthy container sandbox construction method, such as Figure 1 As shown, this is achieved through the following steps.

[0022] Step S1: Build a minimalist container base environment.

[0023] The minimal container base environment in this invention is implemented by building a rootfs in a virtual machine environment on the same system. The rootfs retains only the core components necessary for the container to run, removes unnecessary system services, drivers and device files, and uses static linking to compile the core components and simplifies the system call interface.

[0024] Specifically, such as Figure 2 As shown, a minimal OS is installed in the virtual machine environment. A minimal rootfs directory structure is created using the rootfs build unit, containing only the necessary system directories; necessary binary files and libraries are copied, and core components are compiled using static linking to reduce dynamic library dependencies; necessary device files are created, and the minimal system configuration file is configured.

[0025] By simplifying system components, unnecessary system services, drivers, and device files are removed. System services such as cron and syslog are removed, and device files are simplified to retain only the devices necessary for container operation, reducing the attack surface. System calls are restricted through seccomp filters, limiting the system resources that applications within the container can access.

[0026] The runtime supports hardware trust metrics through a lightweight container runtime unit design, integrates hardware virtualization support, optimizes the startup process, and pre-allocates resources.

[0027] For example, it can build a lightweight container runtime based on hardware virtualization technology; integrate trusted platform module interfaces to support hardware-level trusted measurement; implement lightweight resource management, including resource isolation such as CPU, memory, storage, and network, for example, optimizing the container startup process and reducing initialization steps; implement resource pre-allocation to reduce runtime resource allocation overhead; support fast container startup and shutdown to improve resource utilization. A built-in trusted measurement mechanism is also included.

[0028] Step S2: Integrate the built-in trust measurement mechanism.

[0029] The built-in trust measurement mechanism in this invention includes integrating a hardware-level root of trust, performing a whitelist scan on container files and establishing a file integrity baseline, and finally packaging the rootfs into a container image.

[0030] Specifically, a Trusted Platform Module (TPM / TCM) is integrated as a hardware root of trust through a hardware root of trust integration unit. The TPM / TCM is initialized and its communication mechanism with the container runtime is configured. This includes configuring TPM / TCM parameters to ensure proper functioning; establishing a communication mechanism between the TPM / TCM and the container runtime, such as building a trust chain based on the TPM / TCM's Platform Configuration Registers (PCR); performing measurements throughout the entire process from hardware startup to container execution and storing the measurement values ​​in the PCR; and implementing a remote verification mechanism to allow remote verification of the trusted state of the container environment.

[0031] The container file whitelist scanning unit scans all files during the container build process, calculates hash values, and records information such as permissions and timestamps to establish a file integrity baseline and form a whitelist. It supports dynamic whitelist updates and signature verification. Features include: dynamic whitelist updates to accommodate legitimate changes to files within the container; signature verification of whitelist updates to ensure the trustworthiness of the whitelist itself; and whitelist version management for easy tracking and auditing.

[0032] Step S3: Implement kernel-level static metrics.

[0033] The kernel-level static measurement in this invention includes trusted measurement and static whitelist verification of the container startup process.

[0034] Specifically, the image signature and integrity are verified during the container startup process through the startup process trust measurement unit, which verifies the image signature and ensures that the image source is trustworthy.

[0035] Measuring key startup steps and storing the results in the platform configuration register enables remote verification, such as allowing remote verification of the trusted state of the container startup process, generating verification reports based on metrics in PCR, supporting signature verification of verification reports, and ensuring the authenticity of the verification.

[0036] The static whitelist verification unit performs static whitelist verification on executable files, dynamic libraries, and configuration files within the container, supporting Chinese cryptographic algorithm signature verification and certificate management. For example, it calculates the file hash value and compares it with the expected value in the whitelist to ensure the file has not been tampered with; files that fail verification are isolated or alerted. It supports signature verification based on Chinese cryptographic algorithms to enhance security; it performs signature verification on critical files within the container to ensure file integrity and trustworthy origin; and it implements a management and update mechanism for signature certificates.

[0037] Step S4: Implement dynamic measurement in user space.

[0038] The user-mode dynamic measurement in this invention includes real-time monitoring and measurement of files, directories, and processes within the container.

[0039] Specifically, file creation, modification, and deletion operations are monitored in user space through file-level dynamic measurement units. These operations are measured in real time and compared against a whitelist to intercept unauthorized operations and trigger alerts. For example, unauthorized file operations are intercepted and alerted; detailed information about unauthorized operations is recorded for auditing and traceability; and policy-based response mechanisms such as isolation and termination are supported.

[0040] Monitoring access to critical directories is achieved through directory-level dynamic metric units, implementing directory access control and a whitelist mechanism, and recording permission changes. For example, directory access control prohibits unauthorized modifications to critical directories; a directory-level whitelist mechanism ensures that only authorized directory operations are permitted; and directory permission changes are audited and recorded.

[0041] The system monitors process creation, execution, and termination using a process-level dynamic measurement unit, verifies process permissions, periodically measures process memory, and detects anomalies. For example, it verifies permissions during process creation to ensure only authorized processes are allowed to run; it records process lifecycle information for auditing and traceability; it periodically measures process memory space to detect abnormal modifications; it implements integrity verification of process memory to prevent malicious code injection; and it intercepts and alerts on abnormal memory access.

[0042] Step S5: Build a trusted sandbox for isolation.

[0043] The trusted sandbox isolation in this invention achieves multi-dimensional isolation of computing, network, and storage based on hardware virtualization technology, and dynamically adjusts the isolation strategy in combination with the trusted measurement results.

[0044] Specifically, a multi-dimensional isolation mechanism, based on hardware virtualization technology, allocates independent virtual CPUs, memory, network interface cards (NICs), and storage space to containers. This achieves isolation and policy control of computing, network, and storage resources, ensuring strict isolation of CPU and memory resources to prevent a single container from affecting other containers. It also supports resource quotas and limits to ensure fair resource sharing among containers. For example, allocating an independent virtual NIC to each container isolates network traffic, preventing a single container from sniffing the network traffic of other containers; and supports network policy control to restrict network access permissions for containers. Similarly, allocating independent storage space to each container isolates storage resources, preventing a single container from accessing the data of other containers; and supports storage encryption to ensure data security.

[0045] By dynamically adjusting isolation strategies using trusted enhancement isolation units combined with trusted measurement results, untrusted containers are isolated, secure terminal access is provided, file transfer is restricted, and operation logs are recorded. For example, by incorporating a trusted measurement mechanism, container isolation is enhanced, and stricter isolation measures are implemented for untrusted containers.

[0046] The lightweight trusted container sandbox construction method of the present invention further includes: providing secure terminal access to the container through a secure terminal access unit, restricting file transfer and copy-paste operations to prevent data leakage, and recording terminal operation logs for easy auditing and traceability; supporting hardware key devices through a hardware key integration unit to realize and enhance data access control; and realizing end-to-end remote trusted verification of the container environment through a remote proof unit, supporting the generation and verification of proof reports.

[0047] Example 2: A lightweight and trustworthy container sandbox construction system, such as Figure 3 As shown, the system is used to implement a lightweight trusted container sandbox construction method described in Example 1, including a container environment construction module, a built-in metric integration module, a kernel metric implementation module, a user metric implementation module, and a sandbox isolation construction module.

[0048] Specifically, the container environment building module is configured to build a minimal container base environment. The minimal container base environment is implemented by building a rootfs in a virtual machine environment on the same system. The rootfs retains only the core components necessary for the container to run, removes unnecessary system services, drivers and / or device files, uses static linking to compile core components and simplifies system call interfaces.

[0049] In some optional examples, the container environment building blocks include the rootfs building block, the system component simplification building block, and the lightweight container runtime building block.

[0050] Specifically, the built-in metrics integration module is configured to integrate a built-in trusted metrics mechanism, which includes integrating a hardware-level root of trust, performing whitelist scanning on container files, and establishing a file integrity baseline.

[0051] In some optional examples, the built-in metric integration module includes a hardware root of trust integration unit and a container file whitelist scanning unit.

[0052] Specifically, the kernel measurement implementation module is configured to implement kernel-level static measurement, which includes trusted measurement and static whitelist verification of the container startup process.

[0053] In some optional examples, the kernel metrics implementation module includes a boot process trusted metrics unit and a static whitelist verification unit.

[0054] Specifically, the user metrics implementation module is configured to implement dynamic user-mode metrics, which include real-time monitoring and measurement of files, directories, and processes within the container.

[0055] In some optional examples, the user metrics implementation module includes file-level dynamic metrics units, directory-level dynamic metrics units, and process-level dynamic metrics units.

[0056] Specifically, the sandbox isolation building module is configured to build a trusted sandbox isolation. The trusted sandbox isolation is based on hardware virtualization technology to achieve multi-dimensional isolation of computing, network, and storage, and dynamically adjusts the isolation strategy in combination with the trust measurement results.

[0057] In some optional examples, the sandbox isolation building block includes a multi-dimensional isolation mechanism unit and a trusted enhancement isolation unit.

[0058] Example 3: A computer terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a lightweight trusted container sandbox construction method as described in Example 1.

[0059] Example 4: A computer-readable medium having a computer program stored thereon, which, when executed by a processor, can implement a lightweight trusted container sandbox construction method as described in Example 1.

[0060] Working principle: By building a rootfs in a virtual machine environment on the same system, the system's components, software, drivers, and devices are greatly simplified to achieve a lightweight container base environment. This can effectively reduce the image size, achieve a comprehensive security isolation mechanism, and effectively prevent unknown attacks and malware based on the end-to-end trust measurement of the hardware root of trust.

[0061] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A lightweight, trusted container sandbox construction method, characterized in that, Includes the following steps: A minimal container base environment is built. The minimal container base environment is implemented by building a rootfs in a virtual machine environment on the same system. The rootfs retains only the core components necessary for container operation, removes unnecessary system services, drivers and / or device files, and uses static linking to compile the core components and simplifies the system call interface. An integrated built-in trusted measurement mechanism is included, which includes an integrated hardware-level root of trust, whitelisting of container files and establishing a file integrity baseline. Implement kernel-level static metrics, which include trusted metrics and static whitelist verification of the container startup process; Implement user-mode dynamic measurement, which includes real-time monitoring and measurement of files, directories and processes within the container; A trusted sandbox isolation is constructed, which is based on hardware virtualization technology to achieve multi-dimensional isolation of computing, network and storage, and dynamically adjusts the isolation strategy in combination with the trust measurement results.

2. The lightweight and trustworthy container sandbox construction method according to claim 1, characterized in that, The construction of the minimalist container base environment specifically includes: Create a minimal rootfs directory structure using rootfs build units, containing only necessary system directories, copying binary files and libraries, compiling core components using static linking, creating necessary device files, and configuring a minimal system configuration file; Remove unnecessary system services, drivers, and / or device files through streamlined system component elements, and restrict system calls through seccomp filters; The runtime supports hardware trust metrics through a lightweight container runtime unit design, integrates hardware virtualization support, optimizes the startup process, and pre-allocates resources.

3. The lightweight and trustworthy container sandbox construction method according to claim 1, characterized in that, The integrated built-in trust measurement mechanism specifically includes: The trusted platform module is integrated as a hardware trusted root through the hardware trusted root integration unit, the trusted platform module is initialized and its communication mechanism with the container runtime is configured. The container file whitelist scanning unit scans all files during the container build process, calculates hash values, and records permissions and timestamps to establish a file integrity baseline and form a whitelist, supporting dynamic updates of the whitelist and signature verification.

4. The lightweight and trustworthy container sandbox construction method according to claim 1, characterized in that, The implementation of kernel-level static metrics specifically includes: The trust measurement unit in the startup process verifies the image signature and integrity during container startup, measures key startup steps and stores the results in the platform configuration register, thus enabling remote verification. The static whitelist verification unit performs static whitelist verification on executable files, dynamic libraries, and configuration files within the container, supporting national cryptographic algorithm signature verification and certificate management.

5. The lightweight and trustworthy container sandbox construction method according to claim 1, characterized in that, The implementation of dynamic user-mode measurement specifically includes: The file-level dynamic measurement unit monitors file creation, modification, and deletion operations in user space, measures them in real time, compares them with a whitelist, blocks unauthorized operations, and issues alerts. Monitor access to critical directories through directory-level dynamic metric units, implement directory permission control and whitelist mechanisms, and record permission changes; The system monitors process creation, execution, and termination through process-level dynamic measurement units, verifies process permissions, periodically measures process memory, and detects anomalies.

6. The lightweight and trustworthy container sandbox construction method according to claim 1, characterized in that, The construction of the trusted sandbox isolation specifically includes: By using a multi-dimensional isolation mechanism unit based on hardware virtualization technology, independent virtual CPU, memory, network card and storage space are allocated to containers to achieve isolation and policy control of computing, network and storage resources; By dynamically adjusting the isolation strategy through trusted enhancement isolation units and trusted measurement results, untrusted containers are isolated, secure terminal access is provided and file transfer is restricted, and operation logs are recorded.

7. The lightweight and trustworthy container sandbox construction method according to claim 1, characterized in that, The method also includes: A secure terminal access container is provided through the secure terminal access unit to restrict file transfer and copy-paste operations and record terminal operation logs. Hardware key devices are supported through a hardware key integration unit to enable data access control; The remote verification unit enables end-to-end remote trusted verification in the container environment, supporting the generation and verification of verification reports.

8. A lightweight, trustworthy container sandbox construction system, characterized in that, This system is used to implement a lightweight trusted container sandbox construction method as described in any one of claims 1-7, comprising: The container environment building module is configured to build a minimal container base environment. The minimal container base environment is implemented by building a rootfs in a virtual machine environment on the same system. The rootfs retains only the core components necessary for container operation, removes unnecessary system services, drivers and / or device files, and uses static linking to compile the core components and simplifies the system call interface. The built-in measurement integration module is configured to integrate a built-in trusted measurement mechanism, which includes integrating a hardware-level root of trust, performing a whitelist scan on container files and establishing a file integrity baseline. The kernel measurement implementation module is configured to implement kernel-level static measurement, which includes trusted measurement and static whitelist verification of the container startup process. The user measurement implementation module is configured to implement user-mode dynamic measurement, which includes real-time monitoring and measurement of files, directories and processes within the container. The sandbox isolation construction module is configured to build a trusted sandbox isolation. The trusted sandbox isolation is based on hardware virtualization technology to achieve multi-dimensional isolation of computing, network and storage, and dynamically adjusts the isolation strategy in combination with the trust measurement results.

9. A computer terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a lightweight trusted container sandbox construction method as described in any one of claims 1-7.

10. A computer-readable medium having a computer program stored thereon, characterized in that, The computer program, when executed by a processor, can implement a lightweight, trusted container sandbox construction method as described in any one of claims 1-7.

Images