Micro-isolation based security protection method and system for enterprise cloud workloads

Abstract

The application discloses a micro-isolation-based enterprise cloud work load security protection method and system, and relates to the technical field of cloud security and terminal network security protection, and aims at the problems that the existing micro-isolation technology cannot perceive the application layer semantics after enabling bidirectional transmission layer security authentication encryption in a service grid, and that the man-in-the-middle decryption method has high calculation overhead and destroys end-to-end encryption integrity, etc. The eBPF detection program is mounted to the target function entrance and exit position of the work load encryption dynamic link library, the application layer plaintext data is obtained under the premise of not decrypting the network message, and the zero-trust identity label is generated in combination with the network layer tuple, then the abnormal score is calculated according to the identity label confidence weight and the behavior deviation degree, and the low-delay blocking is executed in the kernel state or the hardware layer, so that the detection and low-delay blocking protection of abnormal behaviors in the encrypted channel are realized under the premise of not decryption.

Description

Technical Field

[0001] This invention relates to the field of cloud security and endpoint network security protection technology, specifically to a method and system for protecting enterprise cloud workloads based on micro-segmentation. Background Technology

[0002] With the popularization of the zero-trust architecture concept in enterprise security systems and the large-scale application of cloud-native technologies, cloud workload security platforms have become the core infrastructure for protecting east-west traffic within data centers. Micro-segmentation technology restricts unauthorized lateral communication by establishing fine-grained access control boundaries around each workload. To ensure transmission security, enterprises generally introduce service meshes in microservice clusters and enable bidirectional transport layer security authentication and encryption by default for inter-service communication. While this improves transmission security, it also makes it impossible for traditional security methods that rely on network packet content for detection to directly parse encrypted application layer data.

[0003] Existing micro-segmentation solutions mainly fall into two categories. The first category is based on access control lists or flow tables of network and transport layer tuples. The security agent collects network metadata of the workload and generates policies by combining it with tag information. The kernel network stack then executes the pass-through or drop-through of packets. The policy dimension of this type of solution is limited to network layer tuples and cannot carry application layer identity information. When an attacker uses a legitimate digital certificate to launch an unauthorized call in the encrypted channel, the call appears as legitimate communication at the network layer, thus creating a detection blind spot. The second category is based on man-in-the-middle decryption. After terminating the encrypted connection and decrypting the traffic into plaintext at the service mesh agent node, deep packet inspection is performed, and then the data is re-encrypted and forwarded. This type of solution requires performing a complete decryption, inspection, and re-encryption process for each connection, resulting in significant computational overhead and forwarding latency. Furthermore, the agent needs to hold the workload's private key to complete the decryption, which compromises end-to-end encryption integrity and poses compliance risks. Summary of the Invention

[0004] The technical problem this invention aims to solve is that existing micro-segmentation technology, in scenarios where bidirectional transport layer security authentication and encryption are enabled by default in the service mesh, can only perform access control based on network layer tuples and cannot perceive application layer semantic information within the encrypted channel. This makes it difficult to detect attackers using legitimate certificates to perform unauthorized calls and lateral movement. However, using man-in-the-middle decryption to compensate for this blind spot introduces high computational overhead and forwarding latency, and undermines end-to-end encryption integrity. The technical problem this invention aims to solve is how to achieve the detection of application layer semantic features and low-latency blocking without decryption or undermining the integrity of the encrypted channel.

[0005] To address the aforementioned technical problems, this invention provides a micro-segmentation-based enterprise cloud workload security protection method, comprising:

[0006] The eBPF probe is attached to the entry and exit points of the target function in the encrypted dynamic link library loaded by the workload process to be protected. The target function includes a write function for writing data to the encrypted dynamic link library and a read function for reading data from the encrypted dynamic link library.

[0007] When the write function is called, the application layer plaintext data passed to the write function is obtained at the entry point of the write function;

[0008] When the read function is called, the application layer plaintext data in the memory buffer returned by the read function is obtained at the exit position of the read function;

[0009] Obtain the source IP address, destination IP address, source port, destination port, and transport layer protocol type corresponding to triggering the target function call, and construct an L4 layer network tuple;

[0010] Based on the application layer plaintext data and the L4 layer network tuple, a micro-segmentation access control policy is determined for the network connection corresponding to the workload.

[0011] In a preferred embodiment, the present invention further parses the application identity identifier from the application layer plaintext data, combines the application identity identifier, the L4 layer network tuple and the current timestamp to generate a zero-trust identity label, and calculates the confidence weight based on the time difference between the generation time and the query time of the mapping relationship, so that the identity mapping relationship can adapt to the scenario of container IP drift.

[0012] In another preferred embodiment, the present invention calculates a comprehensive anomaly score based on the degree of deviation between the observed behavior feature vector and the historical baseline feature vector and in combination with the confidence weight. When the anomaly score reaches a preset threshold, the corresponding L4 layer network tuple is written into the blocking policy table of the local node, which is then queried and executed by the filtering program mounted on the network card driver layer and the kernel flow control subsystem to drop packets.

[0013] Accordingly, this invention provides a micro-segmentation-based enterprise cloud workload security protection system, including a kernel-mode detection module, an identity mapping engine, a policy decision engine, and a cross-layer blocking execution module, with each module working together to implement the above-mentioned method.

[0014] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows:

[0015] Firstly, since the probe points are mounted at the entry and exit points of the encryption / decryption functions, the plaintext features of the application layer can be directly obtained in memory at the moment of function call. There is no need to perform any decryption operations on the network packets themselves, nor is it necessary to inject proxies or modify the business source code in the workload. This fundamentally solves the problem of application layer semantic awareness blind spots in micro-segmentation systems under bidirectional transport layer security authentication encryption scenarios.

[0016] Secondly, because the identity mapping process introduces a confidence weight mechanism that decays over time, the mapping relationship between application identity and network layer connection entity can automatically adapt to the frequent drift of container IPs, avoiding the misuse of outdated mapping relationships.

[0017] Third, since the judgment of abnormal scores and the writing of blocking policies are both completed in the local node kernel space, the blocking action can be directly executed by the filtering program mounted on the network card driver layer, kernel traffic control subsystem or DPU hardware. It does not need to be remotely issued through the centralized control plane, nor does it need to reach the business application process. Therefore, it can achieve identity binding and low-latency blocking response within milliseconds with a resource overhead far lower than the packet decryption-re-encryption scheme, and the blocking process is unaware of the forwarding of normal business traffic. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall architecture of the enterprise cloud workload security protection system based on micro-segmentation according to the present invention;

[0019] Figure 2 This is a flowchart illustrating the decryption-free L7 layer feature detection method based on eBPF of the present invention.

[0020] Figure 3 This is a flowchart illustrating the zero-trust identity tag generation and mapping binding method of the present invention;

[0021] Figure 4 This is a flowchart illustrating the cross-layer seamless blocking strategy issuance and execution method of the present invention. Detailed Implementation

[0022] The following is in conjunction with the appendix Figure 1-4 The specific embodiments of the present invention will be further described below. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0023] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0024] I. System Overall Architecture Implementation Example

[0025] In this embodiment, the system proposed in this invention is deployed in the form of a set of daemon processes on each working node of the cloud-native cluster, and mainly consists of four parts: kernel-mode detection module, identity mapping engine, policy decision engine, and cross-layer blocking execution module.

[0026] The kernel-mode detection module runs in the host machine's kernel sandbox. It includes user-mode dynamic probes mounted at the entry and exit points of encrypted dynamic link library functions loaded by the workload processes to be protected, and network filtering programs mounted in the host machine's network card driver layer and kernel flow control subsystem. The former is used to intercept application layer plaintext data instantly before encryption or after decryption, while the latter is used to obtain L4 layer network tuples and perform packet-level allow or drop actions. Kernel mode and user mode interact with each other through a mapping table structure and a ring buffer structure. The mapping table is used to store the mapping relationship between zero-trust identity labels and L4 layer network tuples, as well as the blocking policy table. The ring buffer is used to asynchronously report detection events to the user-mode security engine.

[0027] The identity mapping engine and policy decision engine run in the user-space security agent process. They are responsible for binding application layer identity information with network layer connection entities, and calculating anomaly scores and generating blocking instructions based on identity tags and behavioral characteristics, respectively. The centralized control plane is responsible for issuing global micro-segmentation policies to security agents at each node and aggregating security events reported by each node for post-event auditing by security administrators. In scenarios where nodes are equipped with smart network interface cards (NICs) that support hardware offloading capabilities, the cross-layer blocking execution module can further synchronize the blocking policy table to the hardware forwarding table entries of the data processor, so that the blocking action is completed at the NIC hardware layer.

[0028] II. Example of Undecrypted L7 Layer Feature Detection Based on eBPF

[0029] This embodiment utilizes the user-space dynamic probe mechanism provided by eBPF to achieve decryption-free detection of application layer plaintext features without modifying the workload service source code or injecting proxy components.

[0030] After detecting a new workload container creation event, the node reads the memory mapping information of the corresponding process, identifies the transport layer security protocol dynamic link library loaded by the process, parses the symbol table of the dynamic link library, and determines the address offset of the target function within the dynamic link library file. The target function includes a write function for encrypting transmitted data and a read function for decrypting received data. Subsequently, the system calls the user-space dynamic probe interface to mount the pre-compiled eBPF probe program to the function entry and exit positions corresponding to the above address offset. This mounting process does not require restarting the target process or modifying the target process's executable file.

[0031] When the business process actually calls the write function, the mounted eBPF program obtains the parameter register value passed to the function at the function entry point, and parses the user-space memory address and data length of the data to be encrypted from it. This memory area stores the application-layer plaintext data that has not yet been encrypted. When the business process actually calls the read function, the mounted eBPF program obtains the decrypted data address and actual read length of the data actually written to the memory buffer before the function returns. The eBPF program calls the secure memory read primitive provided by the kernel to securely copy the contents of the above memory area to the eBPF program's private buffer. This copying operation is completed entirely within the kernel sandbox and does not involve any decryption operations on the network packets themselves.

[0032] Meanwhile, the eBPF program reads the process identifier and file descriptor information associated with the current triggering context, and then queries the kernel socket structure to obtain the source IP address, destination IP address, source port, destination port, and transport layer protocol type corresponding to the function call, forming an L4 layer network tuple. The eBPF program organizes the obtained plaintext data fragments and L4 layer network tuples according to a predefined data structure and writes them into a circular buffer for asynchronous consumption by the user-space security engine. The user-space security engine continuously monitors this circular buffer and extracts structured L7 layer feature fields from the plaintext data fragments according to pre-registered application layer protocol parsing rules. These fields include the application layer request method, path information, request header fields, and key fields of the message body, completing a complete undecrypted application layer feature detection.

[0033] III. Examples of Zero-Trust Identity Tag Generation and Mapping Binding

[0034] To address the issues of frequent container IP address drift and the inability of a single network tuple to stably represent the identity of an application in cloud-native scenarios, this embodiment proposes an identity mapping and binding method. This method dynamically associates the L7 layer application identity information obtained in the aforementioned embodiment with the L4 layer network tuple to generate a time-sensitive zero-trust identity label.

[0035] The identity mapping engine receives the reported L7 layer feature data and the corresponding L4 layer network tuples, and parses the application identity identifier and user identity identifier from the L7 layer features. If the current data does not carry complete identity information, the identity identifier previously established for this connection is used. Subsequently, the identity mapping engine generates zero-trust identity labels according to the following relationship:

[0036] ;

[0037] In the above formula, This represents a pre-defined secure hash function used to map the concatenated bit string to a fixed-length, unique, and collision-resistant tag value. This represents the application identity identifier parsed from the L7 layer features. This represents the parsed user identity identifier. The L4 network tuple corresponding to the current connection is defined as:

[0038] ;

[0039] in and These represent the source IP address and the destination IP address, respectively. and These represent the source port and the destination port, respectively. Indicates the transport layer protocol type, symbol This indicates a bit concatenation operation. This indicates the moment the zero-trust identity tag was generated.

[0040] Identity mapping engine Used as the lookup key, it searches the mapping table to see if a corresponding historical mapping entry already exists: if not, then... , and The constructed entries are written into the mapping table. If an entry already exists but the corresponding one is missing... or If a change occurs, indicating that the IP port has been reassigned to a different application after the container migrates, the original entry will be overwritten with the newly generated zero-trust identity label, and the generation time will be reset to the current timestamp.

[0041] Considering that the L4 network tuples corresponding to the same application identity will change as the container drifts, this embodiment introduces a timeliness weight to quantify the reliability of the mapping relationship, and the relationship is as follows:

[0042] ;

[0043] In the above formula, This indicates the mapping relationship at the time of query. The confidence weights are greater than zero and not greater than one. This represents a pre-configured decay coefficient used to control the rate at which the confidence weight decreases over time. This indicates the time when the mapping relationship was generated. At the current query time, the system's background maintenance coroutine periodically traverses all entries in the mapping table, calculates the current confidence weight of each entry based on the above formula, marks entries with weights less than the preset confidence threshold as expired and deletes them from the mapping table. At the same time, it regenerates the zero-trust identity label based on the current application identity, the current L4 network tuple and the current timestamp to complete the rebinding, avoiding the misuse of outdated mapping relationships. When subsequent data packets arrive and trigger the aforementioned L7 feature detection process, the policy decision engine uses the L4 network tuple of the data packet as the key to query the mapping table. If a match is found, the corresponding zero-trust identity label and current confidence weight are obtained. If no match is found, it is regarded as an unknown connection and processed according to the preset default policy.

[0044] IV. Examples of Anomaly Scoring and Seamless Inter-Layer Blocking

[0045] Based on the zero-trust identity label and its confidence weight, the policy decision engine in this embodiment combines the historical behavior baseline of the workload to score the anomaly of the current communication behavior and decide whether to trigger cross-layer blocking accordingly.

[0046] The strategy decision engine constructs an observation behavior feature vector based on the currently reported L7 layer features. Its components include application layer path distribution, call frequency, and key field distribution of the request body. It also reads the historical baseline feature vector corresponding to this workload from the pre-maintained baseline feature library. Subsequently, the strategy decision engine calculates a comprehensive anomaly score based on the following formula:

[0047] ;

[0048] In the above formula, This represents the overall anomaly score. A higher value indicates that the communication behavior is more likely to be an abnormal unauthorized act or lateral movement. This represents a predefined behavioral feature distance metric function used to quantify the degree of deviation between observed behavior and historical baseline behavior. This represents the observation behavior feature vector constructed based on the current L7 layer features. This represents the baseline feature vector corresponding to the historical normal communication behavior of this workload. This represents the weighting coefficient of the behavioral anomaly item. This represents the weighting coefficient for the timeliness of the label. and The sum of the two is one, and their specific values ​​are pre-configured as constants by the security administrator based on the business scenario. The confidence weight described in the foregoing embodiments indicates that the lower the value, the more outdated the identity mapping relationship on which the communication is based.

[0049] The strategy decision engine will calculate the results. Compare with a pre-set anomaly scoring threshold: when When the threshold value is greater than or equal to the threshold value, the communication is determined to be an abnormal unauthorized access or lateral movement, and the process is initiated to block the communication. If the value is below the threshold, it is considered normal communication, and the connection is allowed to continue transmitting.

[0050] In cases where abnormal communication is detected, the policy decision engine generates a blocking instruction and writes the corresponding L4 network tuple into a predefined blocking policy table in the node's mapping table. This write operation is completed locally in the kernel space, without the need for remote distribution through a centralized control plane, thus avoiding the latency caused by policy synchronization in traditional solutions. The eBPF filtering programs, mounted on the network card driver layer and the kernel flow control subsystem respectively, query the blocking policy table when processing each arriving or departing packet. If the L4 network tuple of the current packet matches an entry in the table, a discard action is directly returned, intercepting the packet before it reaches the user-space protocol stack. In deployment scenarios where a data processor smart NIC with hardware offloading capability is equipped, the system further synchronizes the blocking policy table to the hardware forwarding table entries of the data processor, enabling blocking actions to be completed directly at the NIC hardware layer. This further reduces the occupancy of the host's central processing unit and shortens the blocking response latency. The blocking process does not interact with the business application process, and the business process is unaware of the blocking process. Thus, while enhancing security capabilities, it ensures the continuity of normal business operations. The system continuously records blocking events and reports them to the centralized control plane for post-event auditing. Entries in the blocking policy table automatically expire and are cleaned up according to a preset lifecycle to avoid permanent blocking caused by misjudgment.

[0051] V. Alternative Examples

[0052] In scenarios where it is inconvenient to mount user-mode probes, the probe point can be mounted to the kernel-mode system call function related to socket transmission and reception through the kernel-mode dynamic probe mechanism. During the data processing through the kernel socket buffer, the corresponding plaintext data or metadata information can be obtained. This can also achieve application layer feature detection without relying on man-in-the-middle decryption, as a supplementary implementation method to the aforementioned user-mode probe scheme.

[0053] In scenarios where a service mesh data plane proxy has been deployed, the proxy can be configured to forward the plaintext traffic obtained after the termination of transport layer security authentication to the user-space security engine of this invention via a bypass mirroring method for L7 layer feature extraction and identity mapping. Meanwhile, the kernel-space filtering program of this invention is still responsible for performing low-latency L4 layer blocking actions, thereby reusing the identity mapping and cross-layer blocking capabilities of this invention on the existing service mesh infrastructure as a compatibility supplementary implementation path.

[0054] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for protecting enterprise cloud workloads based on micro-segmentation, characterized in that, include: The eBPF probe is attached to the entry and exit points of the target function in the encrypted dynamic link library loaded by the workload process to be protected. The target function includes a write function for writing data to the encrypted dynamic link library and a read function for reading data from the encrypted dynamic link library. When the write function is called, the application layer plaintext data passed to the write function is obtained at the entry position of the write function; when the read function is called, the application layer plaintext data returned by the read function is obtained at the exit position of the read function. Obtain the source IP address, destination IP address, source port, destination port, and transport layer protocol type corresponding to triggering the target function call, and construct an L4 layer network tuple; Based on the application layer plaintext data and the L4 layer network tuple, a micro-segmentation access control policy is determined for the network connection corresponding to the workload.

2. The method according to claim 1, characterized in that, The steps of attaching the eBPF probe to the entry and exit points of the target function include: reading the memory mapping information of the workload process, identifying the encrypted dynamic link library loaded by the process, parsing the symbol table of the encrypted dynamic link library, determining the address offset of the target function in the encrypted dynamic link library, and attaching the eBPF probe to the location corresponding to the address offset through a user-mode dynamic probe mechanism.

3. The method according to claim 1, characterized in that, Also includes: The application identity identifier is parsed from the application layer plaintext data. A zero-trust identity label is generated by combining the application identity identifier, the L4 layer network tuple, and the current timestamp. The mapping relationship between the zero-trust identity label and the L4 layer network tuple is written into the mapping table, and the generation time of the mapping relationship is recorded.

4. The method according to claim 3, characterized in that, Also includes: Based on the time difference between the current query time and the generation time, the confidence weight of the mapping relationship is calculated according to a preset time decay relationship. The confidence weight decreases as the time difference increases, and its value is greater than zero and not greater than one.

5. The method according to claim 4, characterized in that, Also includes: When the confidence weight is less than the preset confidence threshold, the mapping relationship is determined to be expired, and a zero-trust identity label is regenerated based on the current application identity, the current L4 network tuple, and the current timestamp to update the mapping table.

6. The method according to claim 4, characterized in that, Also includes: Based on the current application layer plaintext data, an observation behavior feature vector is constructed. The deviation between the observation behavior feature vector and the pre-maintained historical baseline feature vector is calculated. The deviation is weighted and summed with the difference between the timeliness loss of the confidence weight (i.e., 1 minus the confidence weight) to obtain a comprehensive anomaly score. When the comprehensive anomaly score reaches a preset threshold, a blocking instruction is generated. The blocking instruction is used to write the corresponding L4 layer network tuple into the blocking policy table.

7. The method according to claim 6, characterized in that, The step of writing the corresponding L4 network tuple into the blocking policy table is completed in the kernel space of the local node, without needing to be forwarded through the centralized control plane.

8. The method according to claim 6, characterized in that, Also includes: The filtering programs mounted on the network card driver layer and the kernel flow control subsystem respectively query the blocking policy table and discard the packet before the packet matching the L4 network tuple reaches the user space protocol stack.

9. A micro-segmentation-based enterprise cloud workload security protection system, characterized in that, include: The kernel-mode detection module is used to attach the eBPF probe program to the entry and exit points of the target functions in the encrypted dynamic link library loaded by the workload process to be protected. The target functions include a write function for writing data to the encrypted dynamic link library and a read function for reading data from the encrypted dynamic link library. The kernel-mode detection module is used to obtain the application layer plaintext data passed to the write function at the entry point of the write function when the write function is called, and to obtain the application layer plaintext data returned by the read function at the exit point of the read function when the read function is called. It also obtains the source IP address, destination IP address, source port, destination port and transport layer protocol type corresponding to triggering the target function call to form an L4 layer network tuple. An identity mapping engine, connected to the kernel-mode detection module, is used to parse application identity identifiers from application layer plaintext data, generate zero-trust identity labels by combining application identity identifiers, L4 layer network tuples and current timestamps, write the mapping relationship between the zero-trust identity labels and the L4 layer network tuples into a mapping table and record the generation time of the mapping relationship, and calculate the confidence weight of the mapping relationship based on the time difference between the current query time and the generation time. The strategy decision engine, connected to the identity mapping engine, is used to construct an observation behavior feature vector based on the current application layer plaintext data, calculate the degree of deviation between the observation behavior feature vector and the pre-maintained historical baseline feature vector, calculate a comprehensive anomaly score by combining the degree of deviation with the confidence weight, and generate a blocking instruction when the comprehensive anomaly score reaches a preset threshold. The cross-layer blocking execution module, connected to the policy decision engine, is used to write the corresponding L4 layer network tuple into the blocking policy table according to the blocking instruction. The filtering programs mounted on the network card driver layer and the kernel flow control subsystem respectively query the blocking policy table so that the packets matching the L4 layer network tuple are dropped.

10. The system according to claim 9, characterized in that, It also includes a data processor, which is connected to the cross-layer blocking execution module and is used to synchronize the blocking policy table to the hardware forwarding table entry of the data processor, so that packets matching the L4 network tuple are dropped at the hardware layer of the data processor.

Images