Data isolation method and device, electronic equipment, storage medium and program

Abstract

This invention discloses a data isolation method, apparatus, electronic device, storage medium, and program. The method includes: responding to a user's data access request, sending a target container creation instruction to a runtime environment to create and start the target container; generating a storage access credential corresponding to the target container; receiving a kernel dynamic fingerprint of the target container sent by the runtime environment, binding the storage access credential to the kernel dynamic fingerprint, generating a permission access credential for the target container, and sending the permission access credential to the runtime environment. The technical solution of this invention enables container-level dynamic real-time authorization and adaptive adjustment of access permissions, thereby improving the security, flexibility, and controllability of data isolation.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of information security, and in particular to a data isolation method, apparatus, electronic device, storage medium and program. Background Technology

[0002] With the widespread adoption of cloud-native and microservice architectures, data security isolation in multi-tenant scenarios has become a key technical challenge. Especially in high-security application scenarios such as finance, healthcare, and power, it is necessary to ensure that data from different tenants achieves equivalent physical-level isolation within a shared storage resource environment.

[0003] Current mainstream technical solutions are based on the namespaces and CGroup (Control Group) mechanisms of container platforms such as Docker (container engine) or Kubernetes (container orchestration platform) to build logically isolated runtime environments. At the same time, by mounting dedicated storage paths to containers and combining them with access control policies such as ACL (Access Control List) and RBAC (Role-Based Access Control) at the operating system level, differentiated data access management between different containers can be achieved.

[0004] The inventors found that the existing technology has two major defects: (1) The access control is static and lagging, relying on the pre-configured storage path mapping and permission hash table. The access permissions are fixed before the container starts. If the container has a long life cycle or the storage access token is leaked, attackers can use static permissions to continuously exceed the limits. Dynamic real-time authorization and permission adjustment cannot be achieved. (2) The storage access credentials are statically and persistently stored. After the container environment is invaded and penetrated, they are easily stolen and used illegally. Moreover, the permissions cannot be completely invalidated synchronously with the destruction of the container. Summary of the Invention

[0005] This invention provides a data isolation method, apparatus, electronic device, storage medium, and program that can achieve container-level dynamic real-time authorization and adaptive adjustment of access permissions, thereby improving the security, flexibility, and controllability of data isolation.

[0006] According to one aspect of the present invention, a data isolation method is provided, applied to a control module on a server side, comprising: In response to a data access request from the user, a target container creation instruction is sent to the runtime environment to create and start the target container through the runtime environment; Generate storage access credentials corresponding to the target container; The system receives the kernel dynamic fingerprint of the target container sent by the runtime environment, binds the storage access credential to the kernel dynamic fingerprint, generates the permission access credential of the target container, and sends the permission access credential to the runtime environment.

[0007] According to another aspect of the present invention, a data isolation device is provided, comprising a control module configured on a server side, including: The target container creation instruction sending module is used to send a target container creation instruction to the runtime environment in response to a data access request from the user terminal, so as to create and start the target container through the runtime environment; A storage access credential generation module is used to generate storage access credentials corresponding to the target container; The access credential generation module is used to receive the kernel dynamic fingerprint of the target container sent by the runtime environment, bind the storage access credential to the kernel dynamic fingerprint, generate the access credential of the target container, and send the access credential to the runtime environment.

[0008] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data isolation method according to any embodiment of the present invention.

[0009] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the data isolation method described in any embodiment of the present invention.

[0010] According to another aspect of the present invention, a computer program product is also provided, comprising a computer program that, when executed by a processor, implements the data isolation method described in any embodiment of the present invention.

[0011] In this embodiment of the invention, the server-side control module, in response to a user's data access request, sends a target container creation instruction to the runtime environment to create and start the target container. Simultaneously, it generates storage access credentials corresponding to the target container and receives the target container's kernel dynamic fingerprint from the runtime environment. The storage access credentials are then bound to the kernel dynamic fingerprint to generate the target container's permission access credentials. After generating the target container's permission access credentials, these credentials are sent to the runtime environment. This solution addresses the rigid constraints and security vulnerabilities inherent in traditional static permission configurations in existing data isolation methods. It enables container-level dynamic real-time authorization and adaptive adjustment of access permissions, thereby improving the security, flexibility, and controllability of data isolation.

[0012] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a flowchart of a data isolation method provided in Embodiment 1 of the present invention; Figure 2 This is a timing diagram of a container access interaction logic provided in Embodiment 1 of the present invention; Figure 3 This is a schematic diagram of a data isolation device provided in Embodiment 2 of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present invention. Detailed Implementation

[0015] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0016] It should be noted that the terms "target," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0017] Example 1 Figure 1 This is a flowchart of a data isolation method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where container access credentials are generated based on the container's kernel dynamic fingerprint and storage access credentials. This method can be executed by a data isolation device, which can be implemented in software and / or hardware, and is generally integrated into an electronic device. This electronic device can be a server-side control module. The present invention does not limit the specific type of electronic device. Correspondingly, as... Figure 1 As shown, the method includes the following operations: S110. In response to the user's data access request, a target container creation instruction is sent to the runtime environment to create and start the target container through the runtime environment.

[0018] In this context, the user terminal can be a terminal device or application used to interact with the server. A data access request can be an instruction issued by the tenant to the server through the user terminal, requesting to obtain, manipulate, query, or modify a specific data resource. The runtime environment can be a comprehensive environment on the server that provides the necessary hardware and software resources, operating system, and dependent components for loading, executing, and scheduling applications, software modules, or code logic. The target container creation instruction can be an instruction to create a target container corresponding to the user terminal's data access request. The target container can be an independent runtime environment specifically designed to host, isolate, and process this data access request. For example, the target container can include, but is not limited to, a User Isolation Container (UIC) or a Task Isolation Container (TIC). This embodiment of the invention does not limit the specific type of the target container.

[0019] Figure 2 This is a timing diagram of a container access interaction logic provided in Embodiment 1 of the present invention. In this embodiment of the present invention, as... Figure 2As shown, tenants can initiate data access requests to the server via a client. Upon receiving the data access request, the server's control module generates a target container creation instruction based on the request and sends this instruction to the server's runtime environment. This instructs the runtime environment to create and start the target container corresponding to the current data access request. It should be noted that the control module can instruct the runtime environment to create different containers for different data access requests initiated by the client.

[0020] S120. Generate the storage access credentials corresponding to the target container.

[0021] Storage access credentials can be legitimate credentials used to verify a user's identity and determine whether they have the authority to access storage resources.

[0022] Correspondingly, such as Figure 2 As shown, after the server-side control module receives a data access request from the user, it can generate a storage access credential for the target container along with the target container creation instruction. For example, the storage access credential can be a token. It is understood that this storage access credential is a static credential.

[0023] S130. Receive the kernel dynamic fingerprint of the target container sent by the runtime environment, bind the storage access credential to the kernel dynamic fingerprint, generate the permission access credential of the target container, and send the permission access credential to the runtime environment.

[0024] The kernel dynamic fingerprint can be a fingerprint generated based on the dynamic characteristics of the target container. The access credentials can be generated by binding storage access credentials to the kernel dynamic fingerprint; these credentials are used to verify the user's legitimate identity and prove that they possess the corresponding operation permissions.

[0025] Correspondingly, such as Figure 2 As shown, after creating and starting the target container, the runtime environment can extract the target container's dynamic characteristics to generate a kernel dynamic fingerprint based on these characteristics. Furthermore, the runtime environment can send the target container's kernel dynamic fingerprint to the control module. The control module can receive the target container's kernel dynamic fingerprint from the runtime environment and bind its own generated storage access credentials to the kernel dynamic fingerprint, thereby generating dynamic access credentials corresponding to the target container.

[0026] It should be noted that the execution order of steps S120 and S130 is not limited in this embodiment of the invention. That is, steps S120 and S130 can be executed in parallel or adaptively according to the actual execution efficiency of the server.

[0027] Therefore, the access credentials provided in this invention are generated based on the dynamic characteristics of the target container after its creation and startup, using a kernel dynamic fingerprint. This deeply binds the access credentials to the container's runtime state, kernel environment, and dynamic identifier, ensuring uniqueness and strong correlation. Thus, when the target container undergoes lifecycle changes such as restarting, rebuilding, or destruction, the access credentials immediately become invalid, effectively avoiding security risks associated with long-term validity of credentials. This enables container-level dynamic real-time authorization and adaptive adjustment of access permissions. Furthermore, because the access credentials are strongly bound to the dynamic characteristics of the target container, even if the credentials are illegally intercepted, stolen, or tampered with during transmission, attackers cannot replay them in other containers for unauthorized access. This fundamentally defends against replay attacks, unauthorized access, and container escape, effectively improving the security, flexibility, and controllability of data isolation.

[0028] In an optional embodiment of the present invention, the runtime environment may also be used to: generate a temporary file system in the target container; and mount the access credentials of the target container to the target container through the temporary file system.

[0029] Among them, the Temporary File System (tmpfs) can be a special file system that resides entirely in memory.

[0030] like Figure 2 As shown, after the runtime environment creates and starts the target container, it can generate a tmpfs within the target container and mount the target container's access credentials to the container via tmpfs. In this solution, access credentials are not passed through environment variables or disk files, but are dynamically mounted into the container via tmpfs. This ensures that tmpfs is synchronously unmounted the moment the target container is destroyed, thus ensuring that access credentials are not left on the host machine's disk. Furthermore, the use of tmpfs mounting technology achieves "credential non-persistent" injection, providing extremely high-strength security isolation without modifying application code.

[0031] In an optional embodiment of the present invention, the runtime environment may also be used to: extract the container identifier, kernel namespace index and container startup timestamp of the target container; and generate the kernel dynamic fingerprint based on the container identifier, kernel namespace index and container startup timestamp of the target container.

[0032] The container identifier can be a string or number that uniquely identifies the target container instance. The kernel namespace index can be a globally unique numeric identifier assigned by the kernel to the namespace to which the target container is bound. The container startup timestamp can be the startup time of the target container.

[0033] Specifically, after the runtime environment creates and starts the target container, it can extract dynamic features such as the container identifier, kernel namespace index, and container startup timestamp of the target container through the kernel fingerprint extractor. This allows the generation of a kernel dynamic fingerprint based on the container identifier, kernel namespace index, and container startup timestamp of the target container.

[0034] In an optional embodiment of the present invention, the data isolation method may further include: responding to an access verification request sent by the data storage module, performing a validity check on the access credentials in the access verification request to obtain a credentials verification result; and sending the credentials verification result to the data storage module; the data storage module may be used to: receive the credentials verification result sent by the control module, and perform data access control operations based on the credentials verification result.

[0035] The access verification request can be a request to verify the validity of access credentials. The credential verification result can be the result of validating the access credentials. The credential verification result includes whether the verification passed or failed. The data storage module can be a module on the server side used for data storage.

[0036] like Figure 2 As shown, after receiving the access credentials sent by the control module, the target container in the runtime environment can send a storage access request to the data storage module carrying the access credentials. Upon receiving the storage access request from the runtime environment, the data storage module can send an access verification request to the control module to confirm the validity of the access credentials of the target container initiating the storage access request. Responding to the access verification request sent by the data storage module, the control module can verify the validity of the access credentials in the access verification request, obtaining a credential verification result, thereby effectively preventing container forgery caused by side-channel attacks. Furthermore, the control module can send the credential verification result to the data storage module to instruct the data storage module to perform data access control operations based on the credential verification result.

[0037] In a specific example, if the access credentials match the access credentials stored in the control module and are currently active, the credential verification result is "verification passed"; if the access credentials do not match the access credentials stored in the control module, or the access credentials are inactive, the credential verification result is "verification failed".

[0038] In an optional embodiment of the present invention, the data storage module can also be used to: authorize the target container in the runtime environment to perform data processing operations when the credential verification result is determined to be successful; and intercept the data storage access request of the target container in the runtime environment when the credential verification result is determined to be unsuccessful.

[0039] Specifically, if the credential verification result is determined to be successful, the data storage module can authorize the target container in the runtime environment to perform data processing operations; if the credential verification result is determined to be unsuccessful, the data storage module can intercept the data storage access request of the target container in the runtime environment and generate alarm information.

[0040] In an optional embodiment of the present invention, the data isolation method may further include: generating a resource purification instruction in response to a task completion instruction from the user terminal; sending the resource purification instruction to the runtime environment; the runtime environment is further configured to destroy the target container and its associated memory data in response to the resource purification instruction from the control module.

[0041] The task completion instruction can be a command sent by the user to indicate that the task has been completed. The resource cleanup instruction can be a command used to instruct the runtime environment to destroy the associated memory data of the target container. The associated memory data can be a set of runtime data that is directly bound to the target container, belongs exclusively to that container, and is stored in memory.

[0042] like Figure 2 As shown, after completing the data processing operation, the user client can send a task completion command to the control module. Upon receiving the task completion command from the user client, the control module can generate a resource cleanup command and send it to the runtime environment, instructing the runtime environment to destroy the target container and its associated memory data.

[0043] In a specific example, during the task termination phase, the runtime environment can use physical memory overwrite technology to fill the memory pages used by the tenant with random numbers or 0x00, eliminating the risk of side-channel leakage. The above solution enables strong binding and coordinated control between data access permissions and container liveness status. When a container is destroyed, its corresponding temporary authorization is simultaneously physically invalidated in the data storage module, thereby achieving fine-grained data permission management synchronized with the container's lifecycle and effectively improving the security and reliability of data access.

[0044] Optionally, if the runtime environment detects that the target container has been in an unused state for a long time, the target container can be automatically destroyed.

[0045] In this embodiment of the invention, the server-side control module, in response to a user's data access request, sends a target container creation instruction to the runtime environment to create and start the target container. Simultaneously, it generates storage access credentials corresponding to the target container and receives the target container's kernel dynamic fingerprint from the runtime environment. The storage access credentials are then bound to the kernel dynamic fingerprint to generate the target container's permission access credentials. After generating the target container's permission access credentials, these credentials are sent to the runtime environment. This solution addresses the rigid constraints and security vulnerabilities inherent in traditional static permission configurations for data isolation methods. It enables container-level dynamic real-time authorization and adaptive adjustment of access permissions, thereby improving the security, flexibility, and controllability of data isolation.

[0046] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information in this technical solution comply with relevant laws and regulations and do not violate public order and good morals.

[0047] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data comply with the relevant laws, regulations and standards of the relevant regions.

[0048] It should be noted that any arrangement or combination of the technical features in the above embodiments also falls within the protection scope of this invention.

[0049] Example 2 Figure 3 This is a schematic diagram of a data isolation device provided in Embodiment 2 of the present invention, as shown below. Figure 3 As shown, the device is configured in the server-side control module. The device includes: a target container creation instruction sending module 210, a storage access credential generation module 220, and a permission access credential generation module 230, wherein: The target container creation instruction sending module 210 is used to send a target container creation instruction to the runtime environment in response to a data access request from the user terminal, so as to create and start the target container through the runtime environment.

[0050] The storage access credential generation module 220 is used to generate storage access credentials corresponding to the target container.

[0051] The access permission generation module 230 is used to receive the kernel dynamic fingerprint of the target container sent by the runtime environment, bind the storage access credential to the kernel dynamic fingerprint, generate the access permission credential of the target container, and send the access permission credential to the runtime environment.

[0052] In this embodiment of the invention, the server-side control module, in response to a user's data access request, sends a target container creation instruction to the runtime environment to create and start the target container. Simultaneously, it generates storage access credentials corresponding to the target container and receives the target container's kernel dynamic fingerprint from the runtime environment. The storage access credentials are then bound to the kernel dynamic fingerprint to generate the target container's permission access credentials. After generating the target container's permission access credentials, these credentials are sent to the runtime environment. This solution addresses the rigid constraints and security vulnerabilities inherent in traditional static permission configurations for data isolation methods. It enables container-level dynamic real-time authorization and adaptive adjustment of access permissions, thereby improving the security, flexibility, and controllability of data isolation.

[0053] Optionally, the runtime environment is further configured to: generate a temporary file system in the target container; and mount the access credentials of the target container into the target container through the temporary file system.

[0054] Optionally, the runtime environment is further configured to: extract the container identifier, kernel namespace index, and container startup timestamp of the target container; and generate the kernel dynamic fingerprint based on the container identifier, kernel namespace index, and container startup timestamp of the target container.

[0055] Optionally, the above apparatus may further include a credential validity verification module, configured to, in response to a permission access verification request sent by the data storage module, perform a validity verification on the permission access credential in the permission access verification request to obtain a credential verification result; and send the credential verification result to the data storage module; the data storage module is configured to: receive the credential verification result sent by the control module, and perform data access control operations based on the credential verification result.

[0056] Optionally, the data storage module is further configured to: authorize the target container in the runtime environment to perform data processing operations if the credential verification result is determined to be successful; and intercept the data storage access request of the target container in the runtime environment if the credential verification result is determined to be unsuccessful.

[0057] Optionally, the above device may further include a resource purification module, used to generate a resource purification instruction in response to the task completion instruction of the user terminal; send the resource purification instruction to the runtime environment; the runtime environment is also used to destroy the target container and the associated memory data of the target container in response to the resource purification instruction of the control module.

[0058] The data isolation device described above can execute the data isolation method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the method. Technical details not described in detail in this embodiment can be found in the data isolation method provided in any embodiment of the present invention.

[0059] Since the data isolation device described above is an apparatus capable of executing the data isolation method in the embodiments of the present invention, those skilled in the art can understand the specific implementation and various variations of the data isolation device in this embodiment based on the data isolation method described in the embodiments of the present invention. Therefore, how the data isolation device implements the data isolation method in the embodiments of the present invention will not be described in detail here. Any apparatus used by those skilled in the art to implement the data isolation method in the embodiments of the present invention falls within the scope of protection of this application.

[0060] Example 3 Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0061] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0062] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0063] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as data isolation methods.

[0064] In some embodiments, the data isolation method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the data isolation method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the data isolation method by any other suitable means (e.g., by means of firmware).

[0065] Optionally, the data isolation method, applied to the server-side control module, may include: responding to a user's data access request by sending a target container creation instruction to the runtime environment to create and start the target container through the runtime environment; generating storage access credentials corresponding to the target container; receiving the kernel dynamic fingerprint of the target container sent by the runtime environment, binding the storage access credentials with the kernel dynamic fingerprint, generating permission access credentials for the target container, and sending the permission access credentials to the runtime environment.

[0066] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0067] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0068] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0069] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0070] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0071] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0072] This application also discloses a computer program product, which includes a computer program that, when executed by a processor, implements the data isolation method provided in any embodiment of this application. This program product and the data isolation methods disclosed in the embodiments of this application belong to the same inventive concept, and therefore will not be described in detail here.

[0073] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0074] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A data isolation method, characterized in that, The control module applied to the server includes: In response to a data access request from the user, a target container creation instruction is sent to the runtime environment to create and start the target container through the runtime environment; Generate storage access credentials corresponding to the target container; The system receives the kernel dynamic fingerprint of the target container sent by the runtime environment, binds the storage access credential to the kernel dynamic fingerprint, generates the permission access credential of the target container, and sends the permission access credential to the runtime environment.

2. The method according to claim 1, characterized in that, The operating environment is also used for: A temporary file system is generated in the target container; The temporary file system is used to mount the access credentials of the target container into the target container.

3. The method according to claim 1, characterized in that, The operating environment is also used for: Extract the container identifier, kernel namespace index, and container startup timestamp of the target container; The kernel dynamic fingerprint is generated based on the container identifier, kernel namespace index, and container startup timestamp of the target container.

4. The method according to claim 1, characterized in that, The method further includes: In response to the access verification request sent by the data storage module, the access credentials in the access verification request are validated to obtain the credentials validation result. The credential verification result is sent to the data storage module; The data storage module is used for: The system receives the credential verification result sent by the control module and performs data access control operations based on the credential verification result.

5. The method according to claim 4, characterized in that, The data storage module is also used for: If the verification result of the credential is determined to be successful, the target container in the runtime environment is authorized to perform data processing operations. If the verification result of the credential is determined to be a verification failure, the data storage access request of the target container in the runtime environment is intercepted.

6. The method according to claim 1, characterized in that, The method further includes: In response to the task completion instruction from the user terminal, a resource cleanup instruction is generated; Send the resource purification command to the operating environment; The operating environment is also used to respond to the resource cleanup command of the control module to destroy the target container and the associated memory data of the target container.

7. A data isolation device, characterized in that, The control module configured on the server side includes: The target container creation instruction sending module is used to send a target container creation instruction to the runtime environment in response to a data access request from the user terminal, so as to create and start the target container through the runtime environment; A storage access credential generation module is used to generate storage access credentials corresponding to the target container; The access credential generation module is used to receive the kernel dynamic fingerprint of the target container sent by the runtime environment, bind the storage access credential to the kernel dynamic fingerprint, generate the access credential of the target container, and send the access credential to the runtime environment.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that is executed by the at least one processor to enable the at least one processor to perform the data isolation method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the data isolation method according to any one of claims 1-6.

10. A computer program product, characterized in that, It includes a computer program / instruction, wherein the computer program / instruction, when executed by a processor, implements the data isolation method of any one of claims 1-6.

Images