Container isolation method, apparatus and system, electronic device, and storage medium

Abstract

The present disclosure relates to the technical field of network security, and provides a container isolation method, apparatus and system, an electronic device, and a storage medium. In embodiments of the present disclosure, a handshake packet is modified, a preset identifier is added, and an attribute tag group of a target container of and a target port of a network peer are carried in a response packet of the handshake packet, thereby achieving container identity confirmation of both parties of a network connection. Without affecting handshake performance, rule matching is performed by means of a container network rule set, so as to execute a container isolation action. The present invention does not depend on a network plug-in of a container network, and can achieve container isolation in environments where network plug-ins cannot provide support.

Description

[0001] This disclosure claims priority to Chinese patent application number 202410346511.2, filed with the China Patent Office on March 25, 2024, entitled "Container Isolation Method, Apparatus, System, Electronic Device, and Storage Medium," the entire contents of which are incorporated herein by reference. Technical Field: This disclosure relates to the field of network security technology, and more particularly to a container isolation method, apparatus, system, electronic device, and storage medium. Background: In a container cluster network, all containers in the cluster are interconnected. Once an intrusion occurs, an intruder can exploit the container network connectivity to move laterally across the entire container cluster, searching for further intrusion points and causing a wider intrusion. Therefore, it is necessary to isolate containers as needed to prevent malicious traffic from flowing freely within the container cluster. A container cluster network has the following characteristics:

[0002] 1. The Internet Protocol (IP) addresses and number of containers for the same application are not fixed, and containers will drift between different hosts in the cluster.

[0003] 2. Container cluster networks are network abstractions implemented based on the host information infrastructure network and cannot be processed conventionally at the physical network layer. Therefore, traditional network firewall technologies are not suitable for container network environments. Currently, open source container management platforms (e.g., Kubernetes, K8S) use network policies to isolate containers. This isolation approach relies on network plug-ins and is unusable for container cluster networks that do not use appropriate network plug-ins, making it infeasible. Furthermore, its use presents numerous limitations and inconveniences, placing high demands on the skills and professional expertise of operations and maintenance personnel. SUMMARY OF THE INVENTION Embodiments of the present disclosure provide a container isolation method, apparatus, system, electronic device, and storage medium to address the limited universality of container isolation achieved through network plug-ins. In a first aspect, an embodiment of the present disclosure provides a container isolation method, which is applied to a sending end, and the method includes: obtaining a handshake message and an attribute tag group of a source container to which the handshake message belongs; sending the handshake message with a preset identifier added to it to a receiving end, where the preset identifier is used by the receiving end to obtain the attribute tag group and target port of the target container and add them to a response message of the handshake message; determining the attribute tag group and target port of the target container based on the response message; matching the attribute tag group of the source container, the attribute tag group of the target container, and the target port with a container network rule set to obtain a matching result; and performing a container isolation action based on the matching result. In a second aspect, an embodiment of the present disclosure provides a container isolation method, which is applied to a receiving end. The method includes: receiving a handshake message sent by a sending end; if the handshake message contains a preset identifier, obtaining an attribute tag group and a target port of a target container and adding them to a response message of the handshake message; returning the response message to the sending end, where the response message is used by the sending end to determine the attribute tag group and target port of the target container, and matching the attribute tag group of the source container, the attribute tag group of the target container, and the target port with a container network rule set to obtain a matching result; and performing a container isolation action based on the matching result.In a third aspect, an embodiment of the present disclosure provides a container isolation device, which is applied to a sending end, and the device includes: an acquisition module, which is used to obtain a handshake message and an attribute tag group of a source container to which the handshake message belongs; a sending module, which is used to send the handshake message with a preset identifier added to the receiving end, and the preset identifier is used for the receiving end to obtain the attribute tag group and target port of the target container and add them to a response message of the handshake message; a determination module, which is used to determine the attribute tag group and target port of the target container based on the response message; a matching module, which is used to match the attribute tag group of the source container, the attribute tag group and the target port of the target container with the container network rule set to obtain a matching result; and an execution module, which is used to execute a container isolation action based on the matching result. In a fourth aspect, embodiments of the present disclosure provide a container isolation device, applied to a receiving end. The device comprises: an acquisition module, configured to receive a handshake message sent by a sending end. If the handshake message contains a preset identifier, the module obtains the target container's attribute tag group and target port and adds them to a response message to the handshake message; a sending module, configured to return the response message to the sending end. The response message is used by the sending end to determine the target container's attribute tag group and target port, match the source container's attribute tag group, the target container's attribute tag group, and the target port with a container network rule set, obtain a matching result, and perform container isolation actions based on the matching result. In a fifth aspect, embodiments of the present disclosure provide a container isolation system, comprising a sending end and a receiving end; the sending end performs any of the aforementioned methods; and the receiving end performs any of the aforementioned methods. In a sixth aspect, embodiments of the present disclosure provide an electronic device, comprising a memory, a processor, and a computer program stored in the memory. The processor implements any of the aforementioned methods when executing the computer program. In a seventh aspect, embodiments of the present disclosure provide a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements any of the aforementioned methods. In an eighth aspect, embodiments of the present disclosure provide a computer program product. The computer program product includes the computer program. When the computer program is executed by a processor, it implements any of the aforementioned methods.Compared to existing technologies, the present disclosure has the following advantages: The present disclosure provides a container isolation method, apparatus, system, electronic device, and storage medium. First, a sending end obtains a handshake message and the attribute tag group of the source container to which the handshake message belongs. The sending end then sends the handshake message, after adding a preset identifier, to a receiving end. The preset identifier is used by the receiving end to obtain the attribute tag group and target port of the target container and add it to the response message of the handshake message. The sending end then determines the attribute tag group and target port of the target container based on the response message. The attribute tag group of the source container, the attribute tag group of the target container, and the target port are matched against the container network rule set to obtain a matching result. Based on the matching result, the container isolation action is executed. In the embodiments of the present disclosure, by modifying the handshake message and adding a preset identifier, the response message of the handshake message carries the attribute tag group and target port of the target container on the network peer end, thereby confirming the container identity of both parties in the network connection. The container isolation action is executed by matching rules based on the container network rule set without affecting handshake performance. Without relying on network plug-ins for container networks, container isolation can be achieved in environments where network plug-ins are not supported. The above description is only an overview of the technical solutions of the present disclosure. To better understand the technical solutions of the present disclosure, implementation can be carried out in accordance with the contents of this specification. To make the above and other objectives, features, and advantages of the present disclosure more readily apparent, specific embodiments of the present disclosure are described below. In the accompanying drawings, unless otherwise specified, identical reference numerals throughout the various figures represent identical or similar components or elements. The drawings are not necessarily drawn to scale. It should be understood that these drawings depict only some embodiments of the present disclosure and should not be construed as limiting the scope of the present disclosure. Figure 1 is a schematic diagram of an application scenario of the container isolation method provided by the present disclosure; Figure 2 is a flowchart of the container isolation method according to one embodiment of the present disclosure; Figure 3 is a schematic diagram of a rule label tree according to one embodiment of the present disclosure; Figure 4 is a flowchart of the container isolation method according to one embodiment of the present disclosure; Figure 5 is a structural block diagram of a container isolation device according to one embodiment of the present disclosure; Figure 6 is a structural block diagram of a container isolation device according to one embodiment of the present disclosure; and Figure 7 is a block diagram of an electronic device used to implement one embodiment of the present disclosure. DETAILED DESCRIPTION OF THE EMBODIMENTS The following only briefly describes certain exemplary embodiments. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present disclosure. Therefore, the drawings and description are to be regarded as illustrative in nature, rather than restrictive. To facilitate understanding of the technical solutions of the embodiments of the present disclosure, the following describes the relevant technologies of the embodiments of the present disclosure.The following related technologies are optional solutions that can be combined with the technical solutions of the embodiments of the present disclosure in any manner and fall within the scope of protection of the embodiments of the present disclosure. It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, storage, and display) involved in this disclosure are all authorized by the user or fully authorized by all parties. The collection, use, and processing of the relevant data must comply with the relevant laws, regulations, and standards of the relevant region, and corresponding operation portals are provided for the user to choose to authorize or reject. Figure 1 is a flowchart of an application scenario of the container isolation method provided by the present disclosure. As shown in Figure 1, the source container on host A and the target container on host B are components of the container cluster network, and isolation actions are determined by sending handshake messages. It should be noted that the source container and the target container can also be on the same host, and the isolation implementation process is the same as that on different hosts. In addition, the source container and the target container can each be a container group, thereby achieving isolation between the container groups. In this embodiment, the container isolation method includes the following steps:

[0004] 1. The collection module of the application layer component on the sending end collects container information from the source container in real time. This container information includes at least one of the following: container identity (ID), container network namespace (NS), container name, container image, the namespace of the container management platform (e.g., k8s (Kubernetes)), and container application information. Specifically, a proxy probe program is deployed on the container host. This program obtains real-time container start and stop events and container information for each container on the host through interfaces or monitoring mechanisms (e.g., the Docker Unix API (Application Programming Interface), CRI (Container Runtime Interface), or the k8s watch mechanism). Upon container startup, the proxy probe program converts each container's container information into a format called NS + attribute tag group, which uniquely describes the attributes of a container or container group within the NS, and sends this information to the network driver component in the kernel.

[0005] 2. The sending end receives the user-defined container network rule set (shown as "rules" in Figure 1) through the application layer component and sends it to the network driver component. The container network rule set includes a rule identifier, multiple source container attribute tag groups, multiple target container attribute tag groups and target ports, and multiple container isolation actions. While container IP addresses and instances within a container cluster are variable, their identity attributes, such as image and namespace, are fixed. Each attribute tag can be defined in a key:value format. A set of multiple tags (i.e., an attribute tag group) can be used to describe a specific type of container. For example, "image:centos:latest,namespace:default,app:clientapp" represents a container with the application tag app:clientapp, the network namespace tag default, and the image tag image:centos:latest. Tags within the same attribute tag group are unique. By defining the container network rules between two types of containers using the source container attribute tag group, the target container attribute tag group, and the target port, the network topology between the two containers can be described. Here are some examples:

[0006] (image:centos:latest,namespace:defalut,app:clientapp) -

[0007] (image:nginx:latest,namespace:default

[0008] ,app:pop) :8080 indicates that a container with the app:clientapp label and the image:centos:latest in the default namespace can establish a network connection to port 8080 of a container with the app:pop label and the image:nginx:latest in the default namespace. Multiple sets of these container network rules constitute a container network rule set, which describes the network topology of the entire container cluster. Network connection behavior not included in the container network rule set can be audited, alerted, or intercepted based on actual production needs, thereby achieving container isolation.

[0009] 3. The sending end receives the container network rule set through the network driver component and constructs a rule label tree. The network driver component receives container information and constructs a mapping between the source container's attribute label group and the network namespace. The receiving end collects the target container's container information in the same manner and performs the pre-configuration process described above. The source and target containers exchange Transmission Control Protocol (TCP) handshake messages via the network port (as shown in "Network Packet Processing" in Figure 1).

[0010] 4. The sending network driver component uses a packet filtering module (for example, Netfilter) to intercept outgoing TCP handshake packets (such as "tcp syn" in Figure 1). Specifically, by registering callback functions at two hook points in the Layer 3 network input and output directions through the Netfilter interface, it can intercept IP layer packets in both directions of the kernel network stack, identify TCP handshake packets, and modify TCP handshake packets that meet preset conditions. Based on the network namespace of the current source container, a preset flag (the preset flag can be any form, such as the fast open option flag) is added to the TCP handshake packet to indicate that it is a modified TCP handshake packet.

[0011] 5. The receiving network driver component uses NetFilter to intercept the response message to the outgoing handshake message (such as the "tcp syn ack" message in Figure 1). Based on the target container's network namespace, it obtains the target container's attribute tag group and the target port of the current TCP connection, generates the payload data p ayload, inserts it into the response message header, recalculates the message checksum, and sends the modified response message.

[0012] 6. The sending network driver uses NetFilter to intercept the incoming TCP handshake response, parses the response payload, and retrieves the target container's attribute tag group and destination port. It also retrieves the source container's attribute tag group from the local cache based on the network namespace of the current network interface.

[0013] 7. The sender matches the attribute tag group of the source container with the attribute tag group of the target container in the rule tag tree and matches the target port with the target port set in the container network rule set to obtain a final match result. Based on the match result, the corresponding container isolation action is determined and executed. Container isolation actions include any of the following: intercept, release, audit, and drop. A corresponding container isolation action can be configured for each container network rule. For example, if rule 1 (not shown in the figure) matches successfully and the corresponding container isolation action is release, an acknowledgment message (such as "tcp ack" in Figure 1) is sent to the receiver, completing the three-way handshake. If rule 1 fails to match successfully, the response message is discarded, and the source and target containers cannot establish a connection.

[0014] 8. Send the execution results to the application layer component for display. In this embodiment of the present disclosure, by modifying the handshake message and adding a preset identifier, the response message to the handshake message carries the attribute tag group and target port of the target container on the network peer, thereby confirming the container identity of both parties in the network connection. Without affecting handshake performance, rule matching is performed using the container network rule set to execute container isolation actions. This method, which does not rely on the container network network plug-in, can achieve container isolation in environments where the network plug-in is not supported. This embodiment of the present disclosure provides a container isolation method, which can be applied to the sender of a network request. FIG2 is a flowchart of the container isolation method according to one embodiment of the present disclosure, comprising: Step S201: Obtaining a handshake message and an attribute tag group of the source container to which the handshake message belongs. The attribute tag group includes at least one attribute tag, which is determined based on the container information of the container. Container information includes at least one of the following: container identity (ID), container network namespace (NS), container name, container image, namespace of the container management platform (e.g., Kubernetes), and container application information. In step S202, a handshake message with a preset identifier added is sent to the receiving end. The preset identifier is used by the receiving end to obtain the target container's attribute tag group and target port and add it to the response message to the handshake message. The preset identifier can include any identifier that indicates that the network message needs to obtain the target container's attribute tag group and target port. In step S203, the target container's attribute tag group and target port are determined based on the response message. Specifically, the response message is parsed to obtain the target container's attribute tag group and target port. In step S204, the source container's attribute tag group, the target container's attribute tag group, and the target port are matched against the container network rule set to obtain a match result. The container network rule set includes multiple container network rules. The source container's attribute tag group, the target container's attribute tag group, and the target port are matched against the container network rules to obtain a matching result. In step S205, a container isolation action is executed based on the matching result. If the source container's attribute tag group, the target container's attribute tag group, and the target port successfully match a container network rule, the container isolation action corresponding to the container network rule is executed. Exemplary container isolation actions include any of the following: intercept, release, audit, and discard.The container isolation method provided by the embodiments of the present disclosure first obtains a handshake message and the attribute tag group of the source container to which it belongs. The handshake message, after adding a preset identifier, is sent to the receiving end. The preset identifier is used by the receiving end to obtain the attribute tag group and target port of the target container and add it to the response message of the handshake message. The sending end then determines the attribute tag group and target port of the target container based on the response message. The attribute tag group of the source container, the attribute tag group of the target container, and the target port are matched against the container network rule set to obtain a matching result. Based on the matching result, the container isolation action is executed. In the embodiments of the present disclosure, by modifying the handshake message and adding a preset identifier, the response message of the handshake message carries the attribute tag group and target port of the target container on the network peer, thereby confirming the container identity of both parties in the network connection. Without affecting handshake performance, the container isolation action is executed by matching rules based on the container network rule set. This method does not rely on the network plug-in of the container network, and can achieve container isolation in environments where the network plug-in does not support it. The specific implementation process of each of the above steps is described below through various implementation methods. In one implementation, the method further includes: obtaining attribute tag groups of multiple source containers, attribute tag groups of multiple target containers, and target ports; and configuring a container network rule set based on the attribute tag groups of the multiple source containers, the attribute tag groups of the multiple target containers, and the target ports, as well as the multiple container isolation actions. Each rule in the container network rule set includes the following information: a rule ID, a source tag list (i.e., the attribute tag groups of the source containers), a target tag list (the attribute tag groups of the target containers), and a target port. In one example, the container network rule set is shown in Table 1. Table 1: During the rule matching process, if the label list of the source container of a network connection matches the source label list in the rule, the label list of the target container matches the target label list in the rule, and the port belongs to the target port set in the rule, the rule is matched, and the container isolation action defined by the rule is executed. Specifically, by constructing a rule label tree and simplifying the rule set, when the attribute labels in the container network rule match the attribute labels of the container, the container network rule corresponding to each attribute label is quickly retrieved through a reverse index. The rule result is quickly matched based on the number of hits. The matching process is described in detail in the following embodiment. In one implementation, the matching results include tag matching results and port matching results. Matching the source container's attribute tag group, the target container's attribute tag group, and the target port with the container network rule set to obtain the matching results includes: generating a rule tag tree based on the container network rule set; matching the source container's attribute tag group and the target container's attribute tag group with the rule tag tree to obtain a tag matching result; and matching the target port with the target port set in the container network rule set to obtain a port matching result. The nodes in the rule tag tree represent attribute tag description information, which includes attribute tag text, a list of rule identifiers for which the current attribute tag appears in the source container's attribute tag group, and a list of rule identifiers for which the current attribute tag appears in the target container's attribute tag group. The rule identifier list includes the identifier of at least one container network rule. In actual applications, the application layer receives and processes user-defined container network rule sets. When the container network rule set changes, the latest container network rule set is updated to the kernel's network driver component. The network driver component receives the container network rule set issued by the application layer and parses it into a rule label tree to optimize performance during the subsequent rule matching process. A rule label tree is a data structure, which can be a red-black tree calculated using a red-black algorithm. Each node in the rule label tree contains information describing an attribute label, including: attribute label text, a list of rule identifiers where the current attribute label appears in the attribute label group of the source container, and a list of rule identifiers where the current attribute label appears in the attribute label group of the target container. In one example, the rule label tree generated based on the container network rule set in Table 1 is shown in Figure 3. Label 1, Label 2, ..., Label 6 represent the label text, the rule identifier corresponding to the source container represents the list of rule identifiers where the label appears in the attribute label group of the source container, and the rule identifier corresponding to the target container represents the list of rule identifiers where the label appears in the attribute label group of the target container.As shown in Table 1, label 1 appears in the attribute label group of the source container for both rules 1 and 2, and in the attribute label group of the target container for rule 1. Label 2 appears in the attribute label group of the source container for rule 1, and in the attribute label group of the target container for rule 2. Label 3 appears in the attribute label group of the source container for rule 1, and in the attribute label group of the target container for rule 2. Label 4 does not appear in the attribute label group of the source container for any rule in Table 1, but appears in the attribute label group of the target container for both rules 1 and 2. Label 5 appears in the attribute label group of the source container for rule 2, and in the attribute label group of the target container for rule 1. Label 6 appears in the attribute label group of the source container for rule 2, but does not appear in the attribute label group of the target container for any rule in Table 1. In one implementation, matching the attribute tag group of a source container and the attribute tag group of a target container with a rule tag tree to obtain a tag matching result includes: searching the rule tag tree for a first rule identifier list corresponding to the attribute tag groups of multiple source containers that match the attribute tag group of the current source container, and searching the rule tag tree for a second rule identifier list corresponding to the attribute tag groups of multiple target containers that match the attribute tag group of the current target container; and obtaining the tag matching result based on the first rule identifier list and the second rule identifier list. In an actual application, searching the rule tag tree for container network rules corresponding to the attribute tag groups of multiple source containers that match the attribute tag group of the current source container to obtain a container network rule identifier list, i.e., the first rule identifier list; searching the rule tag tree for container network rules corresponding to the attribute tag groups of multiple target containers that match the attribute tag group of the current target container to obtain a container network rule identifier list, i.e., the second rule identifier list; and calculating the tag matching result based on the first rule identifier list and the second rule identifier list. In one implementation, obtaining a label matching result based on a first rule identifier list and a second rule identifier list includes: obtaining a list of the number of rule identifiers hit during the matching process based on the intersection of the first rule identifier list and the second rule identifier list; generating a simplified rule set based on a rule label tree; the simplified rule set includes the number of attribute labels of the source container and the number of attribute labels of the target container in each rule in the container network rule set; and comparing the list of the number of rule identifiers hit with the simplified rule set to obtain a label matching result. For any label text, the rule label tree can be used to quickly retrieve the set of rule identifiers that appear in the attribute label group of the source container and the set of rule identifiers that appear in the attribute label group of the target container in the container network rule set.A simplified rule set is also generated. Each rule in the simplified rule set records the number of tags in the source container's attribute tag group and the number of tags in the target container's attribute tag group. In one example, the simplified rule set generated based on the rule tag tree shown in Figure 3 is shown in Table 2. The number of tags in the source tag list indicates the number of tags in the source container's attribute tag group, and the number of tags in the target tag list indicates the number of tags in the target container's attribute tag group. Table 2: When matching rules, each label in the source container's attribute label group is first traversed. The label description is quickly found in the rule label tree using the label. The rule identifier list for the source container's attribute label group within the label description is obtained. For example, if a network connection is initiated from a container with an attribute label group of (label 1, label 2, label 3) to another container with an attribute label group of (label 1, label 4, label 5), the matching process obtains the attribute labels of the source container to be matched and the corresponding rule identifier list in the label tree, as shown in Table 3: Table 3 Similarly, the same operation is performed on the attribute label group of the target container to obtain the attribute labels of the target container to be matched and the rule identifier list corresponding to the target container in the label tree, as shown in Table 4: Table 4 Based on the intersection count of the rule identifiers corresponding to the source container and the rule identifiers corresponding to the target container in the label trees obtained from the two matching process tables Table 3 and Table 4, a list of the number of hits for each rule ID in the match is obtained, as shown in Table 5: Table 5 compares the rule match count table (Table 5) with the simplified rule set (Table 2). If the number of source and target container attribute tags in Table 5 matches the number of tags in the source container's attribute tag group and the target container's attribute tag group in the simplified rule set, respectively, and the target port belongs to the target port set, the container network rule is considered matched, and the container isolation action defined by the container network rule is executed. In this example, the source container's attribute tags in Rule 1 match three times, and the target container's attribute tags match three times, successfully matching Rule 1 and executing the container isolation action defined by Rule 1. Optionally, a whitelist mode can be used in the container firewall. Network connections matching the container network rule are permitted, while other network connections not in the container network rule set are subject to the default action defined in the rule set, which includes interception, auditing, or alerting. In one implementation, obtaining the attribute tag group of the source container includes: obtaining the network namespace identifier of the source container to which the handshake message belongs, and obtaining the attribute tag group of the source container based on the network namespace identifier. In practical applications, the isolation of different independent network spaces on the same host machine is achieved through the kernel network namespace assigned to each container or container group by the host operating system. The network namespace identifier of each container can be used as a unique identifier to describe a container or container group at the kernel network driver layer. A mapping relationship between the network namespace identifier and the container's attribute tag group is pre-established, and the container's attribute tag group can be obtained from memory based on the network namespace identifier. An embodiment of the present disclosure provides a container isolation method, which can be applied to a receiving end of a network request. FIG4 is a flowchart of the container isolation method according to an embodiment of the present disclosure, including: Step S401: Receive a handshake message sent by a sending end. If the handshake message contains a preset identifier, obtain the attribute tag group and target port of the target container and add them to a response message to the handshake message. The attribute tag group includes at least one attribute tag, which is determined based on the container information of the container. Container information includes at least one of the following: container identity (ID), container network namespace (NS), container name, container image, the namespace of the container management platform (e.g., Kubernetes), and container application information. The preset identifier can include any identifier that indicates that the network packet needs to obtain the target container's attribute tag group and target port.In step S402, a response message is returned to the sender. The response message is used by the sender to determine the target container's attribute tag group and target port. The sender then matches the source container's attribute tag group, the target container's attribute tag group, and the target port with the container network rule set to obtain a match result. Based on the match result, a container isolation action is executed. If the source container's attribute tag group, the target container's attribute tag group, and the target port successfully match a container network rule, the container isolation action corresponding to the container network rule is executed. Exemplary container isolation actions include any of the following: intercept, release, audit, and discard. The container isolation method provided in the embodiments of the present disclosure first receives a handshake message sent by a sender. If the handshake message contains a preset identifier, the target container's attribute tag group and target port are obtained and added to the response message of the handshake message. The response message is then returned to the sender, which uses the response message to determine the target container's attribute tag group and target port. The sender then matches the source container's attribute tag group, the target container's attribute tag group, and the target port with the container network rule set to obtain a matching result. Based on the matching result, the container isolation action is executed. In the embodiments of the present disclosure, by modifying the handshake message and adding a preset identifier, the response message carries the target container's attribute tag group and target port of the network peer, thereby confirming the container identity of both parties in the network connection. Without affecting handshake performance, the container isolation action is executed by matching rules based on the container network rule set. This method does not rely on the container network's network plug-in, and can achieve container isolation in environments where network plug-ins do not support it. In one implementation, obtaining the target container's attribute tag group and target port and adding them to a response message to a handshake message includes: obtaining the target container's attribute tag group and target port, generating payload data; adding the payload data to the response message header, and calculating a checksum for the response message after adding the payload data. Specifically, the receiving-end network driver component uses NetFilter to intercept the outgoing response message to the handshake message, obtains the target container's attribute tag group and the target port of the current TCP connection based on the target container's network namespace, generates the payload data, inserts it into the response message header, recalculates the checksum for the response message, and sends the modified response message. Corresponding to the application scenarios and methods of the methods provided in the embodiments of the present disclosure, the embodiments of the present disclosure also provide a container isolation device. FIG5 is a block diagram of the container isolation device according to one embodiment of the present disclosure. The device includes an acquisition module 501 for obtaining the handshake message and the attribute tag group of the source container to which the handshake message belongs.A sending module 502 is configured to send the handshake message, after adding a preset identifier, to the receiving end. The preset identifier is used by the receiving end to obtain the target container's attribute tag group and target port and add them to the response message of the handshake message. A determining module 503 is configured to determine the target container's attribute tag group and target port based on the response message. A matching module 504 is configured to match the source container's attribute tag group, the target container's attribute tag group, and the target port with the container network rule set to obtain a matching result. An executing module 505 is configured to execute a container isolation action based on the matching result. The container isolation device provided in the embodiments of the present disclosure first obtains a handshake message and the attribute tag group of the source container to which it belongs. The handshake message, after adding a preset identifier, is then sent to the receiving end. The preset identifier is used by the receiving end to obtain the attribute tag group and target port of the target container and add it to the response message of the handshake message. The sending end then determines the attribute tag group and target port of the target container based on the response message. The attribute tag group of the source container, the attribute tag group of the target container, and the target port are matched against the container network rule set to obtain a matching result. Based on the matching result, the container isolation action is executed. In the embodiments of the present disclosure, by modifying the handshake message and adding a preset identifier, the response message of the handshake message carries the attribute tag group and target port of the target container on the network peer, thereby confirming the container identity of both parties in the network connection. The container isolation action is executed by matching rules based on the container network rule set without affecting handshake performance. This system does not rely on the network plug-in of the container network, and can achieve container isolation in environments where network plug-ins do not support it. In one implementation, the container isolation apparatus is further configured to: obtain attribute tag groups of multiple source containers, attribute tag groups of multiple target containers, and target ports; and configure a container network rule set based on the attribute tag groups of the multiple source containers, the attribute tag groups of the multiple target containers, and the target ports, as well as the multiple container isolation actions.In one implementation, the matching result includes a tag matching result and a port matching result. The matching module 504 is configured to: generate a rule tag tree based on the container network rule set; match the attribute tag group of the source container and the attribute tag group of the target container with the rule tag tree to obtain a tag matching result; and match the target port with the target port set in the container network rule set to obtain a port matching result. The nodes in the rule tag tree are attribute tag description information, and the attribute tag description information includes: attribute tag text, a list of rule identifiers where the current attribute tag appears in the attribute tag group of the source container, and a list of rule identifiers where the current attribute tag appears in the attribute tag group of the target container, where the rule identifier list includes the identifier of at least one container network rule. In one implementation, when matching the attribute tag group of the source container and the attribute tag group of the target container with the rule tag tree to obtain a tag matching result, the matching module 504 is configured to: search the rule tag tree for a first rule identifier list corresponding to the attribute tag groups of multiple source containers that match the attribute tag group of the current source container, and search the rule tag tree for a second rule identifier list corresponding to the attribute tag groups of multiple target containers that match the attribute tag group of the current target container; and obtain a tag matching result based on the first rule identifier list and the second rule identifier list. In one implementation, when obtaining a tag matching result based on the first rule identifier list and the second rule identifier list, the matching module 504 is configured to: obtain a list of the number of rule identifiers hit during the matching process based on the intersection of the first rule identifier list and the second rule identifier list; generate a simplified rule set based on the rule tag tree; the simplified rule set includes the number of source container attribute tags and the number of target container attribute tags in each rule in the container network rule set; and compare the list of the number of rule identifiers hit with the simplified rule set to obtain a tag matching result. In one implementation, when obtaining the attribute tag group of the source container, acquisition module 501 is configured to: obtain the network namespace identifier of the source container to which the handshake message belongs, and obtain the attribute tag group of the source container based on the network namespace identifier. In one implementation, the container isolation action includes any of the following: intercept, release, audit, and discard. The functions of each module in the embodiments of the present disclosure can be found in the corresponding description of the above method, and they have corresponding beneficial effects, so they are not further described here. Corresponding to the application scenarios and methods provided in the embodiments of the present disclosure, the embodiments of the present disclosure also provide a container isolation device.FIG6 is a block diagram of a container isolation device according to an embodiment of the present disclosure. The device includes an acquisition module 601 for receiving a handshake message sent by a sender. If the handshake message contains a preset identifier, the acquisition module 601 obtains the target container's attribute tag group and target port and adds them to a response message to the handshake message. A sending module 602 returns the response message to the sender. The response message is used by the sender to determine the target container's attribute tag group and target port, match the source container's attribute tag group, the target container's attribute tag group, and the target port with a container network rule set, obtain a matching result, and perform container isolation actions based on the matching result. The container isolation device provided in the embodiments of the present disclosure first receives a handshake message sent by a sender. If the handshake message contains a preset identifier, the device obtains the target container's attribute tag group and target port and adds them to the response message of the handshake message. The device then returns the response message to the sender, which uses the response message to determine the target container's attribute tag group and target port. The sender then matches the source container's attribute tag group, the target container's attribute tag group, and the target port with the container network rule set to obtain a matching result. Based on the matching result, the device performs container isolation. In the embodiments of the present disclosure, by modifying the handshake message and adding a preset identifier, the response message carries the target container's attribute tag group and target port on the network peer, thereby confirming the container identities of both parties in the network connection. Without impacting handshake performance, the device performs rule matching based on the container network rule set and executes the container isolation action. This device does not rely on the container network plug-in, and can achieve container isolation in environments where network plug-ins do not support it. In one implementation, when acquiring the target container's attribute tag group and target port to be added to a response message to a handshake message, the acquisition module 601 is configured to: acquire the target container's attribute tag group and target port, generate payload data; add the payload data to the header of the response message, and calculate a checksum of the response message after the payload data has been added. The functions of each module in the embodiments of the present disclosure can be found in the corresponding descriptions of the above-mentioned methods, and they have corresponding beneficial effects, so they are not further described here. Figure 7 is a block diagram of an electronic device for implementing the embodiments of the present disclosure. As shown in Figure 7, the electronic device includes a memory 710 and a processor 720. The memory 710 stores a computer program executable on the processor 720. When the processor 720 executes the computer program, the method in the above-mentioned embodiments is implemented. The number of the memory 710 and the processor 720 can be one or more. The electronic device also includes a communication interface 730 for communicating with external devices and exchanging data.If the memory 710, processor 720, and communication interface 730 are implemented independently, they can be interconnected via a bus and communicate with each other. This bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. This bus can be divided into address buses, data buses, control buses, etc. For ease of illustration, FIG7 shows only one thick line, but this does not mean that there is only one bus or only one type of bus. Optionally, in a specific implementation, if the memory 710, processor 720, and communication interface 730 are integrated on a single chip, the memory 710, processor 720, and communication interface 730 can communicate with each other via an internal interface. The present embodiment provides a container isolation system, including a sending end and a receiving end. The sending end executes the method provided in the present embodiment; the receiving end executes the method provided in the present embodiment. Embodiments of the present disclosure provide a computer-readable storage medium storing a computer program. When executed by a processor, the program implements the methods provided in the embodiments of the present disclosure. Embodiments of the present disclosure provide a computer program product comprising a computer program. When executed by a processor, the computer program implements the methods provided in the embodiments of the present disclosure. Embodiments of the present disclosure also provide a chip comprising a processor configured to retrieve and execute instructions stored in a memory, thereby enabling a communication device equipped with the chip to perform the methods provided in the embodiments of the present disclosure. Embodiments of the present disclosure also provide a chip comprising an input interface, an output interface, a processor, and a memory. The input interface, the output interface, the processor, and the memory are connected via an internal connection path. The processor is configured to execute code in the memory. When the code is executed, the processor performs the methods provided in the embodiments of the present disclosure.It should be understood that the processor described above may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor. It is worth noting that the processor may be a processor supporting the Advanced RISC Machines (ARM) architecture. Furthermore, optionally, the memory described above may include read-only memory and random access memory. The memory may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which serves as an external cache. By way of example and not limitation, many forms of RAM are available. For example, Static RAM (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Sync link DRAM (SLDRAM) and Direct Rambus RAM (DR RAM).The above embodiments can be implemented in whole or in part via software, hardware, firmware, or any combination thereof. When implemented using software, they can be implemented in whole or in part in the form of a computer program product. A computer program product comprises one or more computer instructions. When the computer program instructions are loaded and executed on a computer, they fully or partially generate the processes or functions according to the present disclosure. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. Throughout this specification, references to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present disclosure. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and assemble the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, features specified as "first" or "second" may explicitly or implicitly include at least one of such features. In the description of this disclosure, "plurality" means two or more, unless otherwise specifically defined. Any process or method described in a flowchart or otherwise herein may be understood to represent a module, segment, or portion of code comprising one or more executable instructions for implementing specific logical functions or process steps. Furthermore, the scope of the preferred embodiments of this disclosure includes alternative implementations in which functions may be performed out of the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved. The logic and / or steps described in the flowcharts or otherwise described herein may be considered, for example, a sequenced list of executable instructions for implementing the logical functions, and may be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device), or used in conjunction with such instruction execution systems, apparatuses, or devices.It should be understood that various aspects of the present disclosure may be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods may be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the methods in the above embodiments may be performed by a program instructing the relevant hardware. This program may be stored in a computer-readable storage medium. When executed, this program includes one or a combination of the steps of the method embodiments. Furthermore, the functional units in the various embodiments of the present disclosure may be integrated into a single processing module, each unit may exist physically separately, or two or more units may be integrated into a single module. These integrated modules may be implemented in either hardware or software functional modules. If these integrated modules are implemented as software functional modules and sold or used as standalone products, they may also be stored in a computer-readable storage medium. This storage medium may be a read-only memory, a magnetic disk, or an optical disk. The above are merely exemplary embodiments of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any person skilled in the art can readily conceive of various modifications or substitutions within the technical scope of the present disclosure, and such modifications or substitutions are intended to fall within the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure shall be subject to the scope of protection of the claims.

Claims

Claims 1. A container isolation method, wherein: The method is applied to a sending end, and includes: obtaining a handshake message and an attribute tag group of a source container to which the handshake message belongs; sending the handshake message with a preset identifier added to it to a receiving end, where the preset identifier is used by the receiving end to obtain the attribute tag group and the target port of the target container and add them to a response message to the handshake message; determining the attribute tag group and the target port of the target container based on the response message; matching the attribute tag group of the source container, the attribute tag group of the target container, and the target port with a container network rule set to obtain a matching result; and performing a container isolation action based on the matching result.

2. The method according to claim 1, wherein: The method further includes: obtaining attribute tag groups of multiple source containers, attribute tag groups and target ports of multiple target containers; and configuring a container network rule set based on the attribute tag groups of the multiple source containers, the attribute tag groups and target ports of the multiple target containers.

3. The method according to claim 1 or 2, wherein: The matching result includes a label matching result and a port matching result; matching the attribute label group of the source container, the attribute label group of the target container, and the target port with the container network rule set to obtain a matching result includes: generating a rule label tree according to the container network rule set; matching the attribute label group of the source container and the attribute label group of the target container with the rule label tree to obtain the label matching result; matching the target port with the target port set in the container network rule set to obtain the port matching result; wherein the nodes in the rule label tree are attribute label description information, and the attribute label description information includes: attribute label text, a list of rule identifiers in which the current attribute label appears in the attribute label group of the source container, and a list of rule identifiers in which the current attribute label appears in the attribute label group of the target container, and the rule identifier list includes the identifier of at least one container network rule.

4. The method according to claim 3, wherein: Matching the attribute tag group of the source container and the attribute tag group of the target container with the rule tag tree to obtain a tag matching result includes: searching the rule tag tree for a first rule identifier list corresponding to multiple attribute tag groups of source containers that match the attribute tag group of the source container, and searching the rule tag tree for a second rule identifier list corresponding to multiple attribute tag groups of target containers that match the attribute tag group of the target container; and obtaining the tag matching result based on the first rule identifier list and the second rule identifier list.

5. The method according to claim 4, wherein: Obtaining the tag matching result according to the first rule identifier list and the second rule identifier list includes: obtaining a list of the number of multiple rule identifiers hit during the matching process according to the intersection of the first rule identifier list and the second rule identifier list; Generate a simplified rule set based on the rule label tree; the simplified rule set includes the number of attribute labels of the source container and the number of attribute labels of the target container in each rule in the container network rule set; and compare the list of hit quantities of the multiple rule identifiers with the simplified rule set to obtain the label matching result.

6. The method according to any one of claims 1 to 5, wherein: Acquiring the attribute tag group of the source container includes: acquiring a network namespace identifier of the source container to which the handshake message belongs, and acquiring the attribute tag group of the source container according to the network namespace identifier.

7. The method according to any one of claims 1 to 5, wherein: The container isolation action includes any of the following: interception, release, audit, and discard.

8. A container isolation method, wherein: The method is applied to a receiving end, and includes: receiving a handshake message sent by a sending end; if the handshake message contains a preset identifier, obtaining an attribute tag group and a target port of a target container and adding them to a response message to the handshake message; returning the response message to the sending end, where the sending end uses the response message to determine the attribute tag group and the target port of the target container, and matching the attribute tag group of the source container, the attribute tag group of the target container, and the target port with a container network rule set to obtain a matching result; and performing a container isolation action based on the matching result.

9. The method according to claim 8, wherein The obtaining and adding the attribute tag group and the target port of the target container to the response message of the handshake message includes: obtaining the attribute tag group and the target port of the target container and generating payload data; adding the payload data to the header of the response message, and calculating a checksum of the response message after adding the payload data.

10. A container isolation device, wherein: The device is applied to a sending end, and includes: an acquisition module, used to acquire a handshake message and an attribute tag group of a source container to which the handshake message belongs; a sending module, used to send the handshake message with a preset identifier added to the receiving end, wherein the preset identifier is used by the receiving end to obtain the attribute tag group and the target port of the target container and add them to a response message of the handshake message; a determination module, used to determine the attribute tag group and the target port of the target container according to the response message; a matching module, used to match the attribute tag group of the source container, the attribute tag group of the target container, and the target port with a container network rule set to obtain a matching result; and an execution module, used to execute a container isolation action according to the matching result.

11. A container isolation device, wherein: The device is applied to the receiving end, and the device includes: an acquisition module, which is used to receive the handshake message sent by the sending end, and if the handshake message contains a preset identifier, the attribute tag group and the target port of the target container are obtained and added to the response message of the handshake message; a sending module, which is used to return the response message to the sending end, and the response message is used for the sending end. The end determines the attribute tag group of the target container and the target port, matches the attribute tag group of the source container, the attribute tag group of the target container, and the target port with the container network rule set, obtains a matching result, and performs a container isolation action based on the matching result.

12. A container isolation system, wherein: The container isolation system includes a sending end and a receiving end; the sending end executes the method according to any one of claims 1 to 7; and the receiving end executes the method according to any one of claims 8 to 9.

13. An electronic device, wherein: The electronic device includes a memory, a processor, and a computer program stored in the memory, and the processor implements the method according to any one of claims 1 to 9 when executing the computer program.

14. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

15. A computer program product, wherein: The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented. 18

Images