Method and system for containerized collaborative deployment of heterogeneous components of a security luring system

Abstract

The application discloses a kind of heterogeneous component containerization collaborative deployment methods and systems for security luring system, it is related to security luring system deployment, containerization orchestration technical field.The application is first according to component function and operation demand different functional roles are divided into system component;Then different container running strategies are generated for different role components;Again, the binding of physical interface to logical role is completed;Finally, in the running process, combined with environment perception, state synchronization and run-time updating mechanism, the deployment, discovery, synchronization and update integrated closed loop are realized.Through the above design, the application solves the problems that the role difference is not uniformly modeled in the containerization process of the existing security luring system, the physical interface binding relies on manual, the deployment and running stage are fragmented, and the run-time changes are difficult to close-loop process, can reduce the deployment complexity from the system level, improve the component collaboration ability, improve the heterogeneous environment adaptability and system running continuity.

Description

Technical Field

[0001] This invention belongs to the fields of safe trapping system deployment, containerized orchestration, runtime collaborative updates, heterogeneous environment adaptation, security policy synchronization, and cross-border communication. Specifically, it relates to a method and system for containerized collaborative deployment of heterogeneous components for safe trapping systems. Background Technology

[0002] Existing security trapping systems typically consist of multiple functional components, including traffic acquisition, policy management, data storage, status display, and operational control. Traditional solutions often employ a distributed deployment approach in physical or virtual machine environments, with operations and maintenance personnel responsible for the software installation, dependency configuration, network access, interface binding, and operation and maintenance of each component.

[0003] With the application of container technology, some existing solutions have begun to encapsulate individual components as containers for runtime, but such solutions suffer from the following three major categories of core technical defects: Category 1: Lack of a system-level collaborative deployment mechanism. Existing solutions typically only address the encapsulation and startup of individual programs, failing to provide a unified design for the differentiated operational needs of different roles and components within a security trapping system, thus failing to form a system-level collaborative deployment framework. Specifically, this manifests as follows: 1. Deployment is centered around individual components, lacking collaborative planning for the entire security trapping system; 2. Different functional components have different requirements for network capabilities, permission boundaries, and operational dependencies, which existing solutions cannot accommodate simultaneously; 3. The physical interface and logical role usually rely on manual configuration, and the ability to adapt to heterogeneous hardware environments is insufficient; 4. The deployment phase is separated from the operation phase, lacking a continuous closed loop of discovery, synchronization, and updating; 5. When the configuration, status, or interface topology changes, manual intervention or restarting of the relevant components is usually required; 6. The cost of migrating the system across environments is relatively high.

[0004] like Figure 1 As shown, traditional security trapping systems employ a decentralized deployment and manual maintenance approach, with each component installed, configured, and operated independently. This lack of a unified system-level collaborative deployment mechanism results in high deployment complexity, high operation and maintenance costs, and a high error rate.

[0005] The second category: Network mode and container compatibility issues. Regarding network access and containerization adaptation, existing security device containerization solutions typically adopt a "one-size-fits-all" unified network access mode, which cannot simultaneously meet the differentiated network requirements of different components. Furthermore, there are serious compatibility issues when migrating traditional security programs to container environments. Specifically, this manifests as follows: 1. If a unified host network access mode is adopted, it is not conducive to achieving service discovery, isolation and fine-grained collaboration within the container; 2. If a unified virtual network access mode is adopted, it cannot meet the high-performance access requirements of traffic capture components to the host network stack. 3. There is a lack of stable cross-boundary addressing and communication mechanisms between components of different network modes; 4. Traditional security programs often include low-level paths designed for physical host environments (such as interface management and system capability calls), which are prone to compatibility and stability issues in containerized environments. 5. To ensure compatibility, existing solutions often use excessively broad permissions, which poses security risks.

[0006] like Figure 5 As shown, existing security device containerization solutions typically only allow choosing between a unified host network mode and a unified bridged network mode, failing to simultaneously meet the needs of traffic capture components for host network capabilities and the needs of management and coordination components for containerized service discovery and isolation.

[0007] Category 3: Defects in the dynamic update mechanism of security policies Regarding security policy updates, existing solutions rely excessively on active polling and full reload at the execution end, failing to meet the requirements for dynamic policy distribution with low interruption, loose coupling, and high consistency during runtime. Specifically: 1. The policy's effectiveness is delayed due to the polling cycle, making real-time updates impossible; 2. Even if no changes occur, the system continues to consume database and network resources for invalid polling; 3. The execution end undertakes a large amount of difference identification and state recovery logic, and is highly coupled with the underlying data structure; 4. Applying policies by reloading configuration files or restarting processes severely impacts the continuity of runtime services; 5. It has a weak ability to express changes in multiple objects and cascading changes, which can easily lead to inconsistent states; 6. There is a lack of effective automatic compensation mechanisms when notifications are interrupted, events are missed, or statuses are inconsistent.

[0008] like Figure 9 As shown, existing security system policy update schemes typically involve the execution node periodically polling the data source / configuration library to obtain the full configuration, or modifying the policy on the management side and then making the new policy take effect by batch reloading, reloading the configuration file, or restarting the execution process. These schemes suffer from drawbacks such as high latency, high resource consumption, and impact on business continuity. Summary of the Invention

[0009] To address the shortcomings of existing technologies, such as the lack of system-level collaborative deployment mechanisms, network mode and container compatibility issues, and deficiencies in dynamic security policy update mechanisms, this application designs a heterogeneous component containerized collaborative deployment method and system for security trapping systems. This aims to achieve system-level collaborative deployment of security trapping systems through role-based partitioning, differentiated operation strategies, automatic interface binding, and continuous operation closed loops, reducing deployment complexity and improving component collaboration capabilities and heterogeneous environment adaptability. Furthermore, it enhances container compatibility and system communication stability of traditional security programs by employing differentiated allocation of heterogeneous network modes, cross-boundary addressing mechanisms, and dual compatibility processing at compile and runtime, while retaining critical network capabilities and containerized management and collaboration capabilities. Finally, it achieves real-time incremental updates of security policies through native event capture at the data layer, standardized incremental event distribution, runtime hot application, and automatic compensation and repair, shortening policy activation time, reducing resource consumption, and ensuring business continuity and state consistency.

[0010] A method for containerized collaborative deployment of heterogeneous components for a secure trapping system includes the following steps: Step S1: Obtain the deployment description information of the security trapping system and identify the functional roles of each component; Step S2: Generate corresponding differentiated container operation strategies based on the identified component functional roles; Step S3: Obtain the host machine interface attribute information and complete the binding of physical interfaces to logical roles; Step S4: Establish initial collaboration relationships and communication paths between components; Step S5: Perform runtime environment awareness and compatibility processing on incompatible runtime paths; Step S6: Write the system running status into the unified status plane and synchronize it to the management view; Step S7: Monitor changes in system configuration, interface topology, or operating status, and transmit these changes to relevant components; Step S8: Form a continuous operation closed loop of deployment, discovery, synchronization, and update.

[0011] Preferably, in step S1, the functional roles of the components include a capture plane component, a management plane component, and a data plane component; wherein, the capture plane component is used to carry capture-type logic that requires proximity to the host machine's network capabilities, the management plane component is used to provide a configuration interface, status display, and control entry point, and the data plane component is used to carry policy data, running status, and persistent information. Optionally, the role division method can be expanded to log plane, analysis plane, control plane, execution plane, etc., according to the actual scenario.

[0012] Preferably, in step S2, the differentiated container operation strategy includes network access strategy, permission boundary strategy, dependency order strategy, and mounting strategy for different role components.

[0013] Preferably, in step S2, the network access strategy includes: identifying a first type of component in the system that relies on the host network capabilities and a second type of component suitable for virtual network collaboration, and assigning different network access modes to them respectively; simultaneously establishing cross-boundary addressing and communication paths between the two types of components. The first type of component includes capture plane components, and the second type of component includes management plane components and data plane components. The network mode combination can adopt both host-side access and virtual network-side access, or it can adopt proxy, relay, or dedicated data plane network methods. Cross-boundary addressing can be achieved through fixed paths, or through dynamic addressing, shared endpoints, or proxy forwarding.

[0014] Preferably, step S2 further includes performing compile-time trimming on underlying paths that are incompatible with the container environment. Compile-time trimming and runtime awareness can be used individually or in combination.

[0015] Preferably, in step S3, the binding of the physical interface to the logical role is achieved by matching the interface declaration with the host interface attributes. Optionally, the interface role binding can also be achieved based on tags, topology files, or rules issued by the management terminal.

[0016] Preferably, in step S5, the runtime environment awareness includes identifying the current running hardware and software environment, and shielding or replacing incompatible underlying call paths and functional modules.

[0017] Preferably, in step S6, the unified state plane is used to centrally store the actual running states of each component, and the management view is updated in real time based on the data of the unified state plane to maintain the consistency of the system view. Optionally, state synchronization can also be achieved through a message bus, configuration center, or shared storage.

[0018] Preferably, in step S7, when a change in configuration, interface, or state is detected, the relevant role components are driven to update.

[0019] Preferably, in step S7, the runtime update includes: directly sensing changes in security policy objects and related configuration objects at the data layer, converting the changes into incremental events with a unified structure, and then having the execution end receive, parse, and apply them to runtime rules or state structures through a subscription method, thereby realizing incremental distribution and hot application of policies; when the link is abnormal or the state is inconsistent, the consistency between the execution end state and the data layer state is restored through a compensation and repair mechanism.

[0020] Data layer change capture can be implemented based on native database capabilities, or on log streams, version comparisons, or state snapshots. Incremental events can adopt a unified object-operation-payload structure, or a differential or versioned structure. Compensation and repair can be achieved through partial compensation, full calibration, version resynchronization, or snapshot recovery.

[0021] This invention also provides a heterogeneous component containerized collaborative deployment system for a secure trapping system, comprising: The role recognition module is used to obtain deployment description information and identify the functional roles of each component; The deployment coordination module is used to generate differentiated container runtime strategies based on the functional roles of components; The interface role mapping module is used to obtain host machine interface attribute information and complete the binding of physical interfaces to logical roles; The environment awareness module is used to perform runtime environment awareness and compatibility processing for incompatible paths; The status synchronization module is used to write the system's operating status into a unified status plane and synchronize it to the management view; The runtime update module is used to monitor system changes and drive the updates of relevant components, forming a continuous operation loop of deployment, discovery, synchronization and update.

[0022] Preferably, the system further includes a traffic input and processing component, a management component, and a data component; wherein the traffic input and processing component corresponds to the capture plane role, the management component corresponds to the management plane role, and the data component corresponds to the data plane role.

[0023] Preferably, the system further includes: The network role recognition module is used to identify the network capability requirements of different components; The network mode allocation module is used to allocate different network access modes based on the identification results; The cross-boundary addressing module is used to establish communication paths between components of different network modes; Compile-time trimming modules are used to trim low-level functional paths that are not compatible with container environments; The dependency pre-check module is used to verify whether cross-boundary dependency services are ready before the main logic starts.

[0024] Preferably, the system further includes: The data layer change capture module is used to natively capture changes to policy objects and related configuration objects; The event standardization module is used to convert raw changes into incremental events with a uniform structure; The event distribution module is used to distribute the incremental events to the execution end; The execution-side subscription module is used to continuously receive the incremental events; The event routing module is used to distribute incremental events to the corresponding processing logic based on event attributes; The hot application module is used to apply incremental events to runtime rules, state structures, or execution logic. The compensation and repair module is used to restore state consistency in abnormal situations.

[0025] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in any of the preceding claims.

[0026] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any of the preceding claims.

[0027] The advantages and effects of this application are as follows: I. System-level collaborative deployment 1. By dividing the components of the security trapping system into three roles—capture, management, and data—based on their functions and operational requirements, and generating differentiated container operation strategies for each role, the system can take into account the differences in network access, permission boundaries, dependencies, and mounting requirements of different components. This avoids the problem that a single deployment mode cannot adapt to all components and improves the overall system collaboration capability.

[0028] 2. By matching interface declarations with host machine interface attributes, the physical interface is automatically bound to the logical role, thus replacing the traditional manual configuration method, reducing the risk of manual configuration errors, and improving the system's adaptability to heterogeneous environments with different hardware configurations.

[0029] 3. By establishing a continuous operation closed loop of deployment-discovery-synchronization-update, the deployment phase and the operation phase are connected, thereby realizing the automatic perception and transmission of changes in system configuration, interface topology and operation status. System updates can be completed without manual intervention or component restarts, which significantly improves the continuity of system operation and reduces operation and maintenance costs.

[0030] 4. By centrally storing the actual running state of each component through a unified state plane and synchronizing it to the management view, the consistency between the system state seen by the administrator and the actual running state is ensured, avoiding management chaos caused by state asynchrony.

[0031] II. Network Mode and Container Compatibility 1. By identifying the first type of components that depend on the host network capabilities and the second type of components that are suitable for virtual network collaboration, and assigning different network access modes to them respectively, the high-performance access capabilities of key components to the host network stack and the containerized collaboration and isolation capabilities of management components are preserved at the same time, thus solving the problem of the unified network mode being incomplete.

[0032] 2. By establishing a dedicated cross-boundary addressing and communication mechanism, the problem of unstable interoperability between components of different network modes is solved, ensuring normal data interaction between system components in a heterogeneous network environment.

[0033] 3. By combining compile-time feature trimming with runtime environment awareness, a dual compatibility processing mechanism is used to automatically shield or replace unsuitable underlying paths designed for physical host environments in traditional security programs. This significantly reduces the cost of migrating traditional security programs to container environments and improves the system's compatibility and stability in different software environments.

[0034] 4. By performing cross-boundary dependency service pre-checks before the main logic starts, dependency missing or communication failure issues can be detected and resolved in advance, avoiding operational anomalies after system startup and improving the reliability of the system startup phase.

[0035] III. Dynamic updates to security policies 1. By moving the awareness of policy changes forward to the data layer and replacing the periodic polling at the execution end with a native change capture mechanism, the database and network resource consumption caused by invalid polling is fundamentally eliminated. At the same time, the policy activation delay is reduced from the second level (polling cycle) to the millisecond level (event-driven), realizing real-time policy updates.

[0036] 2. By abstracting different types of original changes into standardized incremental events and structurally decomposing complex updates and cascading changes, the coupling degree between the execution end and the underlying data structure is reduced. The execution end only needs to process standardized events and does not need to understand the table structure and relationships of the data layer, which simplifies the design and maintenance of the execution end.

[0037] 3. Incremental event distribution is carried out through a publish-subscribe model, and the events are directly applied to the running rules or state structure to achieve hot application. This allows the policy to be updated without restarting the execution process or interrupting the main business logic, thus ensuring the continuity of the security trapping business.

[0038] 4. By establishing a compensation and repair mechanism for abnormal situations, the system can automatically restore the consistency of the execution end and the data layer in the event of link interruption, event omission, or state inconsistency, thereby improving the robustness of the system in complex network environments.

[0039] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the preferred embodiments of this application are described in detail below with reference to the accompanying drawings.

[0040] The above and other objects, advantages and features of this application will become more apparent to those skilled in the art from the following detailed description of specific embodiments in conjunction with the accompanying drawings. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In all drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0042] Figure 1 This is a schematic diagram of an existing technical solution; Figure 2 This is a diagram of the overall system architecture of the present invention; Figure 3 This is a flowchart of the method of the present invention; Figure 4 A diagram illustrating the deployment-discovery-synchronization-update closed loop; Figure 5 This is a schematic diagram of an existing network model scheme. Figure 6 This is a system architecture diagram of the heterogeneous network mode of the present invention; Figure 7 This is a flowchart of the heterogeneous network mode method of the present invention; Figure 8 A diagram illustrating cross-boundary addressing and interface role binding; Figure 9 A schematic diagram of the existing technology strategy update plan; Figure 10 This is a diagram of the incremental distribution system architecture for the security policy of this invention. Figure 11 This is a flowchart of the incremental distribution method for security policies of the present invention; Figure 12 This is a diagram illustrating standardized incremental events and compensation / repair. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. In the following description, specific details such as specific configurations and components are provided merely to help fully understand the embodiments of this application. Therefore, those skilled in the art should understand that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this application. In addition, for clarity and brevity, descriptions of known functions and structures are omitted in the embodiments.

[0044] It should be understood that the phrase "an embodiment" or "this embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "an embodiment" or "this embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0045] Furthermore, reference numerals and / or letters may be repeated in different examples within this application. Such repetition is for the purpose of simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or settings discussed.

[0046] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, B exists alone, and A and B exist simultaneously. The term " / and" in this article describes another type of relationship between related objects, indicating that two relationships can exist. For example, A / and B can mean: A exists alone, and A and B exist alone. In addition, the character " / " in this article generally indicates that the related objects before and after it are in an "or" relationship.

[0047] In this article, the term "at least one" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, "at least one of A and B" can mean: A exists alone, A and B exist simultaneously, or B exists alone.

[0048] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion.

[0049] This application divides the components of the security trapping system into roles according to their functions and operational requirements, generates differentiated container operation strategies for different roles, realizes automatic binding of physical interfaces to logical roles, and establishes a continuous closed loop in the deployment and operation phases, thereby forming a system-level collaborative deployment mechanism.

[0050] Example 1: This example mainly introduces the specific design of basic collaborative deployment. like Figure 2 As shown, the heterogeneous component containerized collaborative deployment system for a secure trapping system of the present invention includes: 1. Functional Component Layer: This layer includes traffic input and processing components, management components, and data components. The traffic input and processing components correspond to the capture plane role, handling capture logic that requires proximity to the host network capabilities. The management components correspond to the management plane role, providing configuration interfaces, status displays, and control entry points. The data components correspond to the data plane role, handling policy data, operational status, and persistent information.

[0051] 2. Deployment Coordination Layer: This layer includes the deployment coordination module, interface role mapping module, environment awareness module, state synchronization module, and runtime update module.

[0052] Deployment coordination module: used to generate network access, permission boundaries, dependency order, and mounting policies based on role differences; Interface Role Mapping Module: Used to obtain host machine interface attributes and complete logical role binding; Environment awareness module: used to identify the current operating environment and perform compatibility processing on incompatible paths; State synchronization module: used to synchronize the actual running state to a unified state plane; Runtime update module: Used to drive updates of relevant role components when changes in configuration, interface, or state are detected.

[0053] 3. Unified State Surface: Used to centrally store the actual running state of each component, providing data support for the management view.

[0054] like Figure 3 As shown, the heterogeneous component containerized collaborative deployment method for a secure trapping system of the present invention includes the following steps: Step S1: Obtain deployment description information and identify component roles. The deployment description information includes the functional definition, operational requirements, and dependencies of each component. Based on this information, the system automatically identifies the functional role (capture plane, management plane, or data plane) of each component.

[0055] Step S2: Generate differentiated operation strategies based on component roles. For components with different roles, generate corresponding network access strategies, permission boundary strategies, dependency order strategies, and mounting strategies. For example, assign permissions close to the host machine's network stack to the capture plane component, and assign persistent storage mounting to the data plane component.

[0056] Step S3: Obtain host machine interface information and complete interface role binding. The system automatically scans all physical interfaces of the host machine, obtains their attribute information (such as interface name, MAC address, speed, etc.), and automatically binds the physical interfaces to the corresponding logical roles (such as business capture port, management port, data port) according to the predefined interface declarations.

[0057] Step S4: Establish initial collaboration relationships and communication paths. Based on the dependencies between components, automatically establish communication connections between each component to ensure that the system can start and run normally.

[0058] Step S5: Perform runtime environment awareness and handle incompatible paths. The system automatically identifies the current hardware and software environment, and masks or replaces incompatible underlying call paths and functional modules to ensure system compatibility under different environments.

[0059] Step S6: Write to the unified state plane and synchronize the management view. Each component reports its own operating status to the unified state plane, and the management view is updated in real time based on the data in the unified state plane to ensure that the administrator can see an accurate and consistent system status.

[0060] Step S7: Monitor configuration, interface, or status changes and transmit them to relevant components. The system continuously monitors changes in configuration files, interface topology, and component operating status. Once a change is detected, it immediately notifies the relevant components to handle it.

[0061] Step S8: Establish a continuously running deployment-discovery-synchronization-update closed loop. Through the cyclical execution of the above steps, full lifecycle management of the system from deployment to operation is achieved, ensuring that the system is always in an optimal operating state.

[0062] like Figure 4 As shown, this invention is not a one-time deployment method, but a continuous closed loop oriented towards the entire operation process.

[0063] Example 2: This example mainly introduces the specific design of the heterogeneous network mode. like Figure 6 As shown in the preferred embodiment of the present invention, the system further includes a network role recognition module, a network pattern allocation module, a cross-boundary addressing module, a compile-time trimming module, and a dependency pre-checking module.

[0064] like Figure 7As shown, the method in this embodiment includes the following steps: Step S1: Identify the first type of components and the second type of components. The first type of components are those that depend on the host machine's network capabilities, such as traffic input and processing components; the second type of components are those suitable for virtual network collaboration, such as management components and data components.

[0065] Step S2: Assign different network access modes to the two types of components. Assign the host network access mode to the first type of component and the virtual network access mode to the second type of component.

[0066] Step S3: Establish cross-boundary addressing paths. The cross-boundary addressing module establishes communication paths between components of different network modes.

[0067] Step S4: Perform compile-time feature trimming. Perform compile-time trimming on underlying paths that are not compatible with the container environment.

[0068] Step S5: Perform runtime environment awareness. Identify the environment and adjust behavior paths during runtime.

[0069] Step S6: Complete the interface role binding. Obtain the interface attributes and complete the interface role binding.

[0070] Step S7: Perform dependency pre-check. Verify whether cross-boundary dependency services are ready before the main logic starts.

[0071] Step S8: Start the main security logic and keep it running.

[0072] like Figure 8 As shown, after the physical interfaces are bound to roles, they serve different network mode components and establish interoperability through cross-boundary addressing.

[0073] Example 3: This example mainly introduces the specific design of incremental distribution of security policies. like Figure 10 As shown, in another preferred embodiment of the present invention, the system further includes a data layer change capture module, an event standardization module, an event distribution module, an execution end subscription module, an event routing module, a hot application module, and a compensation and repair module.

[0074] like Figure 11 As shown, the method in this embodiment includes the following steps: Step S1: Establish a native change capture mechanism in the data layer.

[0075] Step S2: The execution end completes the initial baseline loading.

[0076] Step S3: Capture object changes.

[0077] Step S4: Convert the original changes into incremental events with a unified structure.

[0078] Step S5: Decompose complex updates and cascading changes in a structured manner.

[0079] Step S6: Asynchronously distribute incremental events to the execution end.

[0080] Step S7: Execute the parsing, routing, and hot application.

[0081] Step S8: Trigger compensation and repair in abnormal scenarios.

[0082] like Figure 12 As shown, complex changes are first transformed into unified events, which are then consumed by the execution end; in case of anomalies, consistency is restored through compensation and repair.

[0083] The above description is merely a preferred embodiment of the present invention and does not limit the scope of protection of the present invention. For those skilled in the art, the present invention can have various modifications and variations. Any changes, modifications, substitutions, integrations, and parameter alterations to these embodiments within the spirit and principles of the present invention, achieved through conventional substitutions or by achieving the same function without departing from the principles and spirit of the present invention, fall within the scope of protection of the present invention.

Claims

1. A method for containerized collaborative deployment of heterogeneous components in a secure trapping system, characterized in that: Includes the following steps: Step S1: Obtain the deployment description information of the security trapping system and identify the functional roles of each component; Step S2: Generate corresponding differentiated container operation strategies based on the identified component functional roles; Step S3: Obtain the host machine interface attribute information and complete the binding of physical interfaces to logical roles; Step S4: Establish initial collaboration relationships and communication paths between components; Step S5: Perform runtime environment awareness and compatibility processing on incompatible runtime paths; Step S6: Write the system running status into the unified status plane and synchronize it to the management view; Step S7: Monitor changes in system configuration, interface topology, or operating status, and transmit these changes to relevant components; Step S8: Form a continuous operation closed loop of deployment-discovery-synchronization-update.

2. The heterogeneous component containerized collaborative deployment method for a secure trapping system according to claim 1, characterized in that, In step S1, the functional roles of the components include the capture surface component, the management surface component, and the data surface component; Among them, the capture plane component is used to carry capture-type logic that needs to access the host machine's network capabilities; The management interface component provides a configuration interface, status display, and control entry point; The data plane component is used to carry policy data, runtime status, and persistent information.

3. The heterogeneous component containerized collaborative deployment method for a secure trapping system according to claim 1, characterized in that, In step S2, the differentiated container operation strategy includes network access strategy, permission boundary strategy, dependency order strategy and mounting strategy for different role components.

4. The heterogeneous component containerized collaborative deployment method for a safe trapping system according to claim 1, characterized in that, In step S3, the binding of the physical interface to the logical role is achieved by matching the interface declaration with the host interface attributes.

5. The heterogeneous component containerized collaborative deployment method for a safe trapping system according to claim 1, characterized in that, In step S5, the runtime environment awareness includes identifying the current running hardware and software environment, and shielding or replacing incompatible underlying call paths and functional modules.

6. The heterogeneous component containerized collaborative deployment method for a secure trapping system according to claim 1, characterized in that, In step S6, the unified state plane is used to centrally store the actual running state of each component. The management view is updated in real time based on the data of the unified state plane to maintain the consistency of the system view.

7. The heterogeneous component containerized collaborative deployment method for a safe trapping system according to claim 1, characterized in that, In step S7, when a change in configuration, interface, or state is detected, the relevant role components are driven to update.

8. A heterogeneous component containerized collaborative deployment system for a secure trapping system, characterized in that, include: The role recognition module is used to obtain deployment description information and identify the functional roles of each component; The deployment coordination module is used to generate differentiated container runtime strategies based on the functional roles of components; The interface role mapping module is used to obtain host machine interface attribute information and complete the binding of physical interfaces to logical roles; The environment awareness module is used to perform runtime environment awareness and compatibility processing for incompatible paths; The status synchronization module is used to write the system's operating status into a unified status plane and synchronize it to the management view; The runtime update module is used to monitor system changes and drive the updates of relevant components, forming a continuous operation loop of deployment-discovery-synchronization-update.

9. The heterogeneous component containerized collaborative deployment system for a secure trapping system according to claim 8, characterized in that, It also includes a traffic input and processing component, a management component, and a data component; among which, the traffic input and processing component corresponds to the capture plane role, the management component corresponds to the management plane role, and the data component corresponds to the data plane role.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images