Container-based cloud access control system and method

Abstract

The present invention relates to an access control system and method for controlling security in a cloud service environment, and more specifically, to a container-based cloud access control system and method in which processes and threads generated in a container environment are clustered according to container attribute information, and access to all of actions of the processes and threads is controlled according to security policies set for each cluster.

Description

Container-based cloud access control system and method

[0001] The present invention relates to an access control system and method for security control in a cloud service environment, and more particularly, to a container-based cloud access control system and method that clusters processes and threads (hereinafter collectively referred to as “processes”) created in a container environment by container attribute information and performs access control on all actions of the processes according to a security policy set for each cluster.

[0002] Currently, container-based application development and operation in cloud environments is rapidly expanding due to its advantages such as portability, scalability, efficiency, continuous integration (CI) / deployment (Continuous Delivery & Continuous Deployment (CD), and automation.

[0003] Container technology uses namespaces and control groups (cgroups) to provide isolated virtual spaces at the operating system level. Because containers do not support device or kernel virtualization, they share the operating system (OS), kernel, and devices. By isolating virtualized spaces using namespaces and limiting hardware resources like CPU and memory using cgroups, containers can operate two or more systems.

[0004] Typically, computer systems such as desktops and servers use access control security technology to restrict access to information based on security policies to protect stored information.

[0005] However, these general access control security technologies are applied in a single environment by a single operating system, and thus have the problem of being difficult to apply to a container environment.

[0006] Due to these problems, conventional container environments provide whitelist system call-based control, which creates a list of trusted system calls to be allowed as a profile, such as SECCOMP (Secure Computing Mode), and applies the profile when executing a container.

[0007] However, applications within containers require system calls such as execute, read, write, and create to operate. If these system calls are included in the list of trusted system calls, unauthorized applications within containers can potentially bypass existing security controls.

[0008] In addition, in a container environment, security control through control groups (cgroups) is limited to limiting the allocation of system resources to containers, and security control through namespaces has a problem in that it is limited in executing security control because it cannot be identified by container attribute information. The container attribute information refers to the container-related information of the process created in the container environment, and includes the container ID, container image ID, POD name, and LABEL name.

[0009] Therefore, a new access control method is required that can control the behavior of all processes created in a container environment according to a security policy based on container attribute information.

[0010] Accordingly, the purpose of the present invention is to provide a container-based cloud access control system and method for security control in a cloud service environment, which clusters processes created in a container environment by container attribute information and performs access control on all actions of the processes according to a security policy set for each cluster.

[0011] In order to achieve the above object, the container-based cloud access control system according to the present invention is characterized in that it includes: an access control system for a container environment including one or more containers executed by a container image, and including a container engine that manages by assigning a POD and a LABEL for the containers, and distributes and manages at least one of the containers and the PODs, the system comprises: an application layer unit that includes a plurality of containers and the container engine, collects and manages container attribute information related to the containers and the PODs through the container engine, sets a security policy for a cluster according to the container attribute information, and performs an execution request of an arbitrary container through the container engine; and a kernel layer unit that clusters a container initial process created according to the container execution request and all processes created within the container according to the container attribute information, and performs access control according to the security policy set for each cluster for the actions of all processes within the container.

[0012] The above container property information includes a container ID, a container image ID, a POD name, and a LABEL name, which represent container-related information of a process created in a container environment, and the application layer unit includes: a container operation environment monitoring unit that collects and manages the container property information for the plurality of containers; the container engine; one or more containers executed through the container engine; and a security policy management unit that collects information about the cluster created through the kernel layer unit when a security policy setting event occurs and sets a security policy for each cluster by receiving input from an administrator.

[0013] The kernel layer unit is characterized by including a system call interface unit that interfaces system calls and responses thereto between the application layer unit and the kernel layer unit; a process creation unit that creates a process when a container execution event occurs from the container engine or a process creation event occurs within the container through the system call interface unit; a security kernel unit that monitors the system call interface unit to detect container execution and termination requested from the container engine, clusters all processes within the container created through the process creation unit by container attribute information acquired through the container operating environment monitoring unit, and performs access control on all actions of the processes within the container according to a security policy set for each cluster; and an OS kernel unit that interfaces with a hardware layer unit including hardware that stores information resources according to the access control of the security kernel unit.

[0014] The above security kernel unit is characterized by including a container cluster management unit that manages cluster creation and cluster removal; a container event monitoring unit that monitors system calls generated by the container engine through the system call interface unit to detect execution and termination of a container, clusters all processes within a container created through the process creation unit according to container property information acquired through the container operating environment monitoring unit, and removes a cluster when the container is terminated; and a container access control unit that performs access control on all actions of processes within the container according to a security policy set for each cluster.

[0015] The container cluster management unit is characterized by including a cluster allocation unit that creates a cluster under the control of the container event monitoring unit; a cluster removal unit that removes a cluster under the control of the container event monitoring unit; and a cluster query unit that queries and returns a cluster when a cluster query is requested by cluster attribute information from either the container event monitoring unit or the security policy management unit.

[0016] The container event monitoring unit is characterized by including a container execution monitoring unit that monitors the system call interface unit to detect container execution and termination requested from the container engine; and a container clustering unit that clusters all processes within the container created through the process creation unit according to container property information obtained through the container operation environment monitoring unit.

[0017] The container access control unit is characterized by including a container process behavior detection unit that monitors the system call interface unit to monitor whether a process inside the container is created or terminated and whether a behavior event of the processes has occurred, and performs clustering through the container clustering unit when a process is created or terminated; a security policy inquiry unit that loads and queries a security policy for each cluster from a hardware layer unit; and an access control execution unit that performs access control according to the security policy for each cluster when a behavior event of the processes inside the container occurs.

[0018] In order to achieve the above object, the present invention provides a container-based cloud access control method, comprising: a container environment access control method including one or more containers executed by a container image, and including a container engine that manages by assigning a POD and a LABEL for the containers, and distributes and manages at least one of the containers and the PODs, wherein the method comprises a security policy setting process in which an application layer unit including the plurality of containers and the container engine collects and manages container attribute information related to the containers and the PODs through the container engine, and sets a security policy to a cluster according to the container attribute information; a clustering process in which a security kernel unit of a kernel layer unit clusters a container initial process created in response to a container execution request input through a container event monitoring unit and all processes created within the container according to the container attribute information; and an access control process in which the security kernel unit of the kernel layer unit performs access control according to the security policy set for each cluster for the actions of all processes within the container through a container access control unit.

[0019] The above container property information includes a container ID, a container image ID, a POD name, and a LABEL name, which represent container-related information of a process in a container environment, and the security policy setting process is characterized by including a container operation environment monitoring step in which the application layer collects and manages container property information for a plurality of containers executed through the container engine by the container operation environment monitoring step; and a security policy setting step in which the application layer receives input from an administrator and sets a security policy for each cluster when a security policy setting event occurs by the security policy management step.

[0020] The above clustering process is characterized by including a process creation step in which the kernel layer section creates a process when a container execution event occurs from the container engine through the system call interface section by the process creation section or when a process creation event occurs inside the container; and a clustering step in which the security kernel section of the kernel layer section monitors the system call interface section to detect container execution and termination requested from the container engine, and clusters all processes inside the container created through the process creation section by container property information acquired through the container operating environment monitoring section.

[0021] The above clustering step is characterized by including a step in which the security kernel unit detects container execution from the container engine through the system call interface unit; a step in which the security kernel unit detects creation of all processes within the container; a step in which the security kernel unit obtains container attribute information for all processes within the container through the container operating environment monitoring unit; a cluster creation step in which the security kernel unit clusters all processes according to the obtained container attribute information; and a cluster removal step in which the security kernel unit removes the cluster through the container cluster management unit when the container termination is detected through the container execution monitoring unit.

[0022] The above access control process is characterized by including a container process behavior detection step in which a container process behavior detection unit of a container access control unit monitors, through the system call interface unit, the creation and termination of all processes inside a container and whether a behavior event of the processes has occurred; a security policy inquiry step in which a security policy inquiry unit of the container access control unit loads and queries a security policy for each cluster from a hardware layer unit; and an access control execution step in which an access control execution unit of the container access control unit performs access control according to the security policy for each cluster when a behavior of processes inside the container occurs.

[0023] The present invention has the effect of enhancing the security of a container-based cloud service by clustering processes created in a container environment by container attribute information and performing access control on all actions of the processes according to a security policy set for each cluster.

[0024] FIG. 1 is a diagram showing the configuration of a container-based cloud access control system according to the present invention.

[0025] FIG. 2 is a diagram showing the configuration of a security kernel section of a kernel layer in a container-based cloud access control system according to the present invention.

[0026] Figure 3 is a flowchart illustrating a container-based cloud access control method according to the present invention.

[0027] The configuration and operation of a container-based cloud access control system according to the present invention are described in detail with reference to the attached drawings below, and an access control method of the system is described.

[0028] FIG. 1 is a diagram showing the configuration of a container-based cloud access control system according to the present invention.

[0029] Referring to FIG. 1, the container-based cloud access control system includes an application layer (10), a kernel layer (20), and a hardware layer (30).

[0030] The hardware layer (30) may include a display device such as a liquid crystal display (LCD), an input device such as a keyboard, a communication device that performs data communication by connecting to a network, a storage device such as a hard disk or RAM that stores various information, and performs operations such as displaying or storing information input from the kernel layer (20), or reading stored information at the request of the kernel layer (20) and outputting it to the kernel layer (20), or changing or deleting information at the request of the kernel layer (20).

[0031] The application layer (10) is configured with a plurality of application programs installed and operated, and forms a container environment by a plurality of containers (11) and a container engine (12) according to the present invention. The container (11) is created by executing a container image. The container image has a container image ID, and the container has a container ID. The container (11) includes one or more application programs within it, and generates events according to the execution of the application programs and information access actions such as reading information, writing information, and deleting information.

[0032] The container engine (12) may be Kubernetes (K8s), etc., and includes one or more containers. In the case of Kubernetes, it manages by creating and removing PODs and LABELs including one or more containers, and enables the deployment of the containers and PODs.

[0033] The container engine (12) may build a container environment including only one or more containers, or may build a container environment including a POD including one or more containers, depending on the required construction environment.

[0034] The above container engine (12) stores and manages container-related information such as the container ID, container image ID, POD name, and LABEL name of each container that constitutes the container environment.

[0035] The container operating environment monitoring unit (13) collects and manages container attribute information for a number of containers (11) executed through the container engine (12). The container attribute information includes container ID, container image ID, POD name, and LABEL name, which represent container-related information of a process created in a container environment.

[0036] The above container attribute information may include only the container ID and container image ID, or may include only the container ID, container image ID, and POD name, or may include the container ID, container image ID, POD name, and LABEL name, depending on whether there is a POD containing the executed container (11) and whether there is a LABEL of the POD.

[0037] The above process set (P) is defined as in the following mathematical expression 1.

[0038]

[0039] Here, pid is the process ID, and P pid represents the process whose process ID is pid.

[0040] The security policy management unit (14) provides a security policy setting user interface means through the input / output devices of the kernel layer (20) and the hardware layer (30) when a security policy setting event occurs.

[0041] The above security policy management unit (14) displays container property information managed through the container engine (12) or entered by an administrator through the security policy setting user interface means.

[0042] The security policy management unit (14) will display information on the cluster by container attribute information generated in the kernel layer unit (20) by the execution of the first process through the container operation environment monitoring unit (13) through the security policy setting user interface means.

[0043] The security policy management unit (14) sets the cluster-specific security policy by selecting the cluster-specific security policy from the administrator and assigning or removing the security policy through the security policy setting user interface means. The security policy will be stored in the storage device of the hardware layer unit (30).

[0044] The above security policy consists of a list of permissions (networking permissions, program execution permissions, file system access permissions, process signal control permissions, process force termination permissions, system resource use permissions, file system sharing permissions, file system sharing permissions, etc.) for all process actions within the container (process creation, process termination, network traffic transmission and reception, command and program execution, file system access, process signal reception, process force termination, file system sharing, shared file system access, system resource use permissions, file system sharing permissions, etc.).

[0045] The set of the above clusters is defined as C as in the following mathematical expression 2.

[0046]

[0047] Here, cid is the cluster ID, and C cid Represents a cluster whose cluster ID is cid.

[0048] Cluster (C cid ) is a set of processes included in ClusterPSet as shown in the following mathematical expression 3. cid is defined as

[0049]

[0050] Here, cp ij is cluster c i Process p included in j represents. i is the cluster ID and j is the process ID.

[0051] The cluster identification tag is defined as a ctag in the form of a tuple, as shown in the following mathematical expression 4.

[0052]

[0053] Here, type represents the type of cluster identification tag (ctag), ct represents the container, ctimg represents the container image type, pod represents the POD type, and label represents the LABEL type.

[0054] flag indicates the container attribute information value corresponding to the cluster identification tag (ctag) type, and id ct is the container ID, id ctimg is the container image ID, name pod is the POD name, name label indicates the LABEL name.

[0055] The set of cluster identification tags assigned the above cluster ID (cid) is defined as ClusterTagSet as shown in the following mathematical expression 5.

[0056]

[0057] The set of the above security policies is defined as SP as shown in the following mathematical expression 6.

[0058]

[0059] Here, sp spid represents the security policy, and spid represents the security policy ID.

[0060] Cluster (C cid ) is assigned to ClusterSPID as in mathematical formula 7.cid is defined as

[0061]

[0062] Here, ClusterSPID cid If the value is 0, the cluster (C cid ) indicates that no security policy has been assigned.

[0063] Process (P) pid ) cluster ID set is ProcCIDSet as shown in the following mathematical expression 8 pid is defined as

[0064]

[0065] Here, i is the cluster ID.

[0066] Process (P) pid ) is a set of security policies applied to ProcSPSet as shown in the following mathematical expression 9. pid is defined as

[0067]

[0068] The above security policy management unit (14) applies the assignSP() function as in the following mathematical expression 10 to the cluster to apply a security policy (sp spid ) and remove the security policy assigned to the cluster by applying the revokeSP() function as in the following mathematical expression 11.

[0069]

[0070]

[0071]

[0072] The kernel layer (20) clusters the container initial process created in response to a container execution request from the container engine and all processes created inside the container according to the container attribute information.

[0073] The above kernel layer (20) performs access control on all actions of processes within the container according to the security policy set for each cluster.

[0074] The above kernel layer (20) includes a system call interface (21), a process creation unit (22), a security kernel unit (23), and an OS kernel unit (24), and the operation of each component is described below.

[0075] The system call interface unit (21) interfaces system calls and responses thereto between the application layer unit (10) and the kernel layer unit (20).

[0076] The above process creation unit (22) creates a container initial process in response to a container execution request from the container engine or creates a process when a process creation request is made within the container.

[0077] The security kernel part (23) monitors the system calls generated by the container engine (12) through the system call interface part (21) to detect the execution and termination of the container.

[0078] When detecting container execution, the security kernel unit (23) obtains the container initial process created through the process creation unit (22) for the container (11) for which execution has been requested.

[0079] When a container initial process is created, the security kernel unit (23) obtains container attribute information through the container operating environment monitoring unit (13), and then clusters the information into clusters created based on container attribute information through the container clustering unit (122). In addition, the security kernel unit (23) also clusters all processes created within the container based on the container attribute information.

[0080] The security kernel (23) performs access control on all actions of processes within the container according to the security policy set in the cluster.

[0081] The OS kernel part (24) interfaces with the hardware layer part (30) that includes hardware that stores the information resource according to the access control of the security kernel part (23).

[0082] FIG. 2 is a diagram showing the configuration of a security kernel section of a container-based cloud access control system kernel layer according to the present invention.

[0083] Referring to FIG. 2, the security kernel unit (23) includes a container cluster management unit (110), a container event monitoring unit (120), and a container access control unit (130).

[0084] The container cluster management unit (110) includes a cluster query unit (111), a cluster allocation unit (112), and a cluster removal unit (113).

[0085] The cluster query unit (111) performs a cluster query by applying the getCID() function of the following mathematical expression 12 when a cluster query request is made by container attribute information from either the container event monitoring unit (120) or the security policy management unit (14).

[0086]

[0087] When it is confirmed that there is no cluster created through the cluster search unit (111), the cluster allocation unit (112) creates a cluster by applying the genCID() function of the following mathematical expression 13.

[0088]

[0089] The cluster removal unit (113) removes the cluster when the termination of the container (11) is detected through the container execution monitoring unit (121) of the container event monitoring unit (120). Cluster removal is performed by applying the deleteCID() function of the following mathematical expression 14, and if the cluster is no longer in use (if there is no security policy assigned to the cluster and no processes included in the cluster), the cluster is removed.

[0090]

[0091] The container event monitoring unit (120) includes a container execution monitoring unit (121) and a container clustering unit (122).

[0092] The container execution monitoring unit (121) monitors system calls generated by the container engine (12) through the system call interface unit (21) to detect the execution and termination of the container.

[0093] The container clustering unit (122) obtains the container property information through the container operating environment monitoring unit (13).

[0094] When container attribute information is obtained, the container clustering unit (122) controls the cluster allocation unit (112) of the container cluster management unit (110) to cluster the container initial process and all processes created within the container according to the container attribute information.

[0095] It is preferable that the above container clustering unit (122) be configured to check whether a previously created cluster exists for the container (11) through the cluster inquiry unit (111) of the container cluster management unit (110) before creating a cluster, and if so, not to create a new cluster, and if a previously created cluster does not exist, to create a new cluster.

[0096] In addition, the container clustering unit (122) controls the cluster removal unit (113) of the container cluster management unit (110) to remove the cluster when the termination of the container is detected.

[0097] The container access control unit (130) includes a container process behavior detection unit (131), a security policy inquiry unit (132), and an access control execution unit (133).

[0098] The container process behavior detection unit (131) monitors the system call interface unit (21) to monitor whether an event has occurred regarding the behavior of all processes within the container (process creation, process termination, network traffic transmission and reception, command and program execution, file system access, process signal reception, process forced termination, file system sharing and shared file system access, system resource use, etc.), and performs cluster-related tasks through the container clustering unit (122) when a process is created or terminated.

[0099] The security policy inquiry unit (132) loads and queries the security policy for each cluster from the hardware layer unit (30).

[0100] The access control execution unit (133) performs access control on all actions of processes within the container according to the security policy searched through the security policy search unit (132).

[0101] Figure 3 is a flowchart illustrating a container-based cloud access control method according to the present invention.

[0102] Referring to FIG. 3, the security policy management unit (14) of the application layer (10) monitors whether a security policy setting event occurs (S111). The security policy setting event may occur upon a request from an administrator through the hardware layer (30) and the kernel layer (20).

[0103] Since the initial security policy must be set, the security policy setting process is explained first.

[0104] When a security policy setting event occurs, the security policy management unit (14) obtains container attribute information for the container (11) configured in the application layer unit (10) through the container operating environment monitoring unit (13) (S113). The container attribute information includes container ID, container image ID, POD name, LABEL name, etc., which represent container-related information of the process created in the container environment.

[0105] The security policy management unit (14) assigns a security policy to a cluster according to container attribute information using the above mathematical expression 10 (S115).

[0106] After setting the security policy, the security kernel unit (23) monitors the system call of the system call interface unit (21) to determine whether a container execution event occurs from the container engine (12) of the application layer unit (10) (S117).

[0107] When a container execution event occurs due to the execution of the initial container (11), the security kernel unit (23) creates the initial container process through the process creation unit (22) via the system call interface unit (21). When the execution of the container (11) is requested through the low-level container runtime (Low-level Container Runtime) responsible for container execution of the container engine (12) through the container execution monitoring unit (121) of the container event monitoring unit (120), the security kernel unit (22) searches for / proc / processID / cgroup information based on the parameters and process ID (pid) of the low-level container runtime to obtain the container ID (S119).

[0108] When a container is created, the container clustering unit (122) of the security kernel unit (23) obtains container property information from the container operating environment monitoring unit (13) (S121).

[0109] When the container attribute information is acquired, the above container clustering unit (122) checks whether a previously created cluster exists through the cluster search unit (111), and if so, does not create a new cluster. If a previously created cluster does not exist, a new cluster is created through the cluster allocation unit (112) (S123).

[0110] The above process of S123 may be applied to the following mathematical formula 15.

[0111]

[0112]

[0113] Here, getCTAG(pid) is the process (p pid ) is a function to obtain the cluster identification tag (ctag).

[0114] The security kernel part (23) monitors the system call of the system call interface part (21) and determines whether a container termination event occurs from the container engine (12) of the application layer part (10) (S125).

[0115] When a container termination event occurs, the clusters for each attribute information of the container are removed (S127). The process of S127 may be applied to the following mathematical expression 16.

[0116]

[0117] The security kernel part (23) monitors the system call of the system call interface part (21) to determine whether any process activity within the container (process creation, process termination, network traffic transmission and reception, command and program execution, file system access, process signal reception, process forced termination, file system sharing and shared file system access, system resource use, etc.) is an event (S129).

[0118] When the security kernel part (23) determines that a process behavior event has occurred, it determines whether the process behavior event is an event that creates a process (S131) ​​or an event that terminates a process (S135).

[0119] If it is a process creation event (S131), the security kernel (23) clusters the process by container attribute information of the container (11) (S133).

[0120] This can be defined as in mathematical equation 17 below.

[0121]

[0122] The above mathematical expression 17 is a process (P) inside a container (11). pid ) when creating a parent process (P ppid , ppid is the parent process ID) and performs the clustering process.

[0123] If the above process action event is an event that terminates the process, the security kernel unit (23) performs a process of removing the cluster of the process through the above mathematical expression 16 (S137).

[0124] If the above process behavior event corresponds to an event such as network traffic transmission and reception, command and program execution, file system access, process signal reception, process forced termination, file system sharing and shared file system access, system resource use, etc., the security kernel unit (23) performs access control according to the security policy set for the process cluster (S139). The above set security policy may be changed and set by the administrator.

[0125] If the access control judgment result is allowed (S141), the security kernel part (23) processes the OS kernel operation for the corresponding process action through the OS kernel part (24) (S143), and if not allowed, the corresponding process action is blocked (S145).

[0126] Meanwhile, those skilled in the art will readily understand that the present invention is not limited to the aforementioned typical preferred embodiments, but can be implemented by various improvements, modifications, substitutions, or additions without departing from the spirit of the present invention. If such improvements, modifications, substitutions, or additions fall within the scope of the appended claims, the technical ideas thereof shall also be deemed to belong to the present invention.

[0127] [Explanation of symbols]

[0128] 10: Application Layer 11: Container

[0129] 12: Container Engine 13: Container Operation Environment Monitoring Department

[0130] 14: Security Policy Management Department 20: Kernel Layer Department

[0131] 21: System call interface section 22: Process creation section

[0132] 23: Security Kernel Section 24: OS Kernel Section

[0133] 30: Hardware layer 110: Container cluster management

[0134] 111: Cluster query section 112: Cluster allocation section

[0135] 113: Cluster Removal Section 120: Container Event Monitoring Section

[0136] 121: Container Execution Monitoring Unit 122: Container Clustering Unit

[0137] 130: Container Access Control Unit 131: Container Process Behavior Detection Unit

[0138] 132: Security Policy Inquiry Department 133: Access Control Enforcement Department

Claims

1. A container-based cloud access control system including one or more containers executed by a container image, and including a container engine that manages by assigning a POD and LABEL to the containers, and deploys and manages one or more of the containers and PODs. An application layer unit including the plurality of containers and the container engine, collecting and managing container property information related to the containers and the POD through the container engine, setting a security policy for a cluster according to the container property information, and executing an execution request of an arbitrary container through the container engine; A container-based cloud access control system characterized by including a kernel layer that clusters all processes created within a container and an initial process created in response to a container execution request based on the container attribute information, and performs access control based on the security policy set for each cluster for the actions of all processes within the container.

2. In paragraph 1, The above container attribute information includes container ID, container image ID, POD name, and LABEL name, which represent container-related information of the process in the container environment. The above application layer part, The above multiple containers; The above container engine; A container operation environment monitoring unit that collects and manages container property information for one or more containers executed through the container engine; and A container-based cloud access control system characterized by including a security policy management unit that collects information about the cluster created through the kernel layer when a security policy setting event occurs and sets a security policy for each cluster by receiving input from an administrator.

3. In paragraph 2, The above kernel layer is, A system call interface unit that interfaces system calls and responses thereto between the application layer unit and the kernel layer unit; A process creation unit that creates a process when a container execution event occurs from the container engine through the system call interface unit or a process creation event occurs inside the container; A security kernel unit that monitors the above system call interface unit to detect container execution and termination requested from the container engine, clusters all processes within the container created through the process creation unit by container attribute information obtained through the container operation environment monitoring unit, and performs access control on all actions of the processes within the container according to the security policy set for each cluster; and A container-based cloud access control system characterized by including an OS kernel unit that performs an interface with a hardware layer unit that includes hardware that stores information resources according to access control of the security kernel unit.

4. In paragraph 3, The above security kernel part, Container cluster management unit that manages cluster creation and cluster destruction; A container event monitoring unit that monitors system calls generated by the container engine through the system call interface unit to detect the execution and termination of a container, clusters all processes inside a container created through the process creation unit according to container property information obtained through the container operation environment monitoring unit, and removes the cluster when the container is terminated; and A container-based cloud access control system, characterized by including a container access control unit that performs access control on all actions of processes within the container according to a security policy set for each cluster.

5. In paragraph 4, The above container cluster management unit, A cluster allocation unit that creates a cluster under the control of the above container event monitoring unit; A cluster removal unit that removes a cluster under the control of the container event monitoring unit; and A container-based cloud access control system characterized by including a cluster query unit that queries and returns a cluster when a cluster query request is made by cluster attribute information from either the container event monitoring unit or the security policy management unit.

6. In paragraph 4, The above container event monitoring unit, A container execution monitoring unit that monitors the above system call interface unit to detect container execution and termination requested from the container engine; and A container-based cloud access control system, characterized in that it includes a container clustering unit that clusters all processes within a container created through the process creation unit according to container attribute information obtained through the container operation environment monitoring unit.

7. In paragraph 4, The above container access control unit is, A container process behavior detection unit that monitors the above system call interface unit to monitor whether creation and termination of processes within the container and whether behavior events of the processes have occurred, and performs clustering through the container clustering unit when processes are created or terminated; A security policy query unit that loads and queries security policies for each cluster from the hardware layer; and A container-based cloud access control system, characterized by including an access control execution unit that performs access control according to a security policy for each cluster when a behavioral event of processes within the container occurs.

8. A container-based cloud access control method including one or more containers executed by a container image, and a container engine that manages by assigning a POD and LABEL to the containers, and deploys and manages one or more of the containers and PODs. A security policy setting process in which an application layer including the plurality of containers and the container engine collects and manages container attribute information related to the containers and the POD through the container engine and sets a security policy for a cluster according to the container attribute information; A clustering process in which the security kernel part of the kernel layer clusters the container initial process created in response to the container execution request and all processes created inside the container by the container attribute information through the container event monitoring part; and A container-based cloud access control method characterized in that the security kernel section of the above kernel layer section includes an access control process for performing access control according to the security policy set for each cluster for the actions of all processes within the container through the container access control section.

9. In paragraph 8, The above container attribute information includes container ID, container image ID, POD name, and LABEL name, which represent container-related information of the process in the container environment. The above security policy setting process is: A container operation environment monitoring step in which the application layer collects and manages container property information for a plurality of containers executed through the container engine by the container operation environment monitoring step; and A container-based cloud access control method characterized in that the above application layer includes a security policy setting step in which a security policy for each cluster is set by receiving input from an administrator when a security policy setting event occurs by the security policy management unit.

10. In paragraph 9, The above clustering process is, A process creation step in which the kernel layer creates a process when a container execution event occurs from the container engine through the system call interface unit or a process creation event occurs inside the container; and A container-based cloud access control method characterized in that the security kernel part of the kernel layer part monitors the system call interface part to detect container execution and termination requested from the container engine, and includes a clustering step of clustering all processes inside the container created through the process creation part by container attribute information obtained through the container operating environment monitoring part.

11. In paragraph 10, The above clustering step is, A step in which the security kernel detects container execution from the container engine through the system call interface; A step in which the above security kernel detects the creation of all processes inside the container; A step in which the security kernel unit obtains container attribute information for all processes through the container operating environment monitoring unit; A cluster creation step in which the security kernel unit clusters all of the processes according to the acquired container attribute information; and A container-based cloud access control method characterized in that the security kernel unit includes a cluster removal step of removing a cluster through a container cluster management unit when the container termination is detected through a container execution monitoring unit.

12. In paragraph 8, The above access control process is, A container process behavior detection step in which the container process behavior detection unit of the container access control unit monitors whether creation and termination of all processes within the container and whether behavior events of the processes have occurred through the system call interface unit; and A container-based cloud access control method, characterized in that it comprises a security policy inquiry step in which the security policy inquiry step of the container access control unit loads and queries a security policy for each cluster from a hardware layer unit; and an access control execution step in which, when an action of a process within the container occurs, access control is performed according to the security policy for each cluster, thereby allowing or blocking the action of the corresponding process.

Images