Data processing system and method

Abstract

Provided in the embodiments of the present disclosure are a data processing system and method. The data processing system comprises a cloud-side device and a terminal-side device, wherein a container cluster is deployed in the terminal-side device; the cloud-side device is configured to establish a communication connection with a cluster scanning component deployed in the terminal-side device; the terminal-side device is configured to acquire, by means of the cluster scanning component, a cluster data collection task from the cloud-side device, acquire cluster resource information of the container cluster on the basis of the cluster data collection task, and send the cluster resource information to the cloud-side device; and the cloud-side device is further configured to perform information detection on the cluster resource information on the basis of a preset information detection rule, so as to obtain an information detection result corresponding to the cluster resource information.

Description

Data processing systems and methods Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to data processing systems and methods. Background Technology

[0002] Kubernetes is an open-source application used to manage containerized applications across multiple hosts in a cloud platform. Kubernetes aims to make deploying containerized applications simple and powerful, providing a mechanism for application deployment, planning, updating, and maintenance. KSPM (Kubernetes Security Posture Management) is a practice for monitoring, assessing, and ensuring the security and compliance of Kubernetes environments. It helps protect Kubernetes infrastructure from common risks such as misconfigurations, vulnerabilities, access control issues, and identity management problems.

[0003] Typically, solutions for Kubernetes cluster configuration checks face challenges such as network connectivity issues, inability to obtain access credentials, inability to dynamically update detection rules, and a black-box detection process. Therefore, resolving both network connectivity issues and ensuring the real-time nature of rule changes has become a pressing problem for technical personnel. Summary of the Invention

[0004] In view of the above, embodiments of this disclosure provide a data processing system. One or more embodiments of this disclosure also relate to a data processing method, an electronic device, a computer-readable storage medium, and a computer program product, to address the technical deficiencies existing in the prior art.

[0005] According to a first aspect of the present disclosure, a data processing system is provided, comprising: a cloud-side device and an edge-side device, wherein a container cluster is deployed in the edge-side device;

[0006] The cloud-side device is configured to establish a communication connection with the cluster scanning component deployed on the end-side device;

[0007] The endpoint device is configured to obtain cluster data collection tasks from the cloud-side device through the cluster scanning component, obtain cluster resource information of the container cluster based on the cluster data collection tasks, and send the cluster resource information to the cloud-side device.

[0008] The cloud-side device is also configured to perform information detection on the cluster resource information according to preset information detection rules, and obtain the information detection result corresponding to the cluster resource information.

[0009] According to a second aspect of the present disclosure, a data processing method is provided, applied to an end-side device, wherein a container cluster is deployed in the end-side device, the method comprising:

[0010] Receive a cluster scanning component installation request sent by a cloud-side device, and install the cluster scanning component in response to the cluster scanning component installation request;

[0011] Based on the cluster scanning component, acquire cluster data collection tasks from the cloud-side device;

[0012] The cluster resource information of the container cluster is obtained according to the cluster data acquisition task, and the cluster resource information is sent to the cloud-side device.

[0013] According to a third aspect of the present disclosure, a data processing method is provided, applied to a cloud-side device, the method comprising:

[0014] Establish a communication connection with the cluster scanning component deployed on the edge device, and receive task retrieval requests sent by the cluster scanning component;

[0015] In response to the task retrieval request, a cluster data acquisition task is sent to the end device so that the end device can obtain cluster resource information according to the cluster data acquisition task.

[0016] The system receives cluster resource information sent by the terminal device and performs information detection on the cluster resource information according to a preset information detection rule to obtain the information detection result corresponding to the cluster resource information.

[0017] According to a fourth aspect of the present disclosure, an electronic device is provided, comprising:

[0018] Memory and processor;

[0019] The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions, which, when executed by the processor, implement the steps of the above method.

[0020] According to a fifth aspect of the present disclosure, a computer-readable storage medium is provided that stores a computer program / instructions that, when executed by a processor, implement the steps of the above-described method.

[0021] According to a sixth aspect of the present disclosure, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described method.

[0022] One embodiment of this disclosure proposes a Kubernetes cluster security posture management scheme based on data collection and detection classification. A cluster scanner is deployed in the container cluster for data collection, and the collected data is sent to a cloud-based device for rule matching. This avoids establishing network connections between the scanning service and the container cluster, and avoids direct reliance on cluster access credentials, thus improving cluster security. Deploying the detection function on a cloud-based device allows for real-time adjustment of detection rules, improving the real-time performance of detection. Attached Figure Description

[0023] Figure 1 is a schematic diagram of the structure of a data processing system provided in an embodiment of this disclosure;

[0024] Figure 2 is a schematic diagram of the interface authentication process provided in an embodiment of this disclosure;

[0025] Figure 3 is a schematic diagram of data processing for incremental detection provided in an embodiment of this disclosure;

[0026] Figure 4 is a flowchart of a data processing method applied to an end-side device according to an embodiment of the present disclosure;

[0027] Figure 5 is a flowchart of a data processing method applied to a cloud-side device according to an embodiment of this disclosure;

[0028] Figure 6 is a schematic diagram of a data processing apparatus for an end-side device provided in an embodiment of the present disclosure;

[0029] Figure 7 is a schematic diagram of the structure of a data processing device applied to a cloud-side device according to an embodiment of the present disclosure;

[0030] Figure 8 is a structural block diagram of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0031] Numerous specific details are set forth in the following description to provide a full understanding of this disclosure. However, this disclosure can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this disclosure. Therefore, this disclosure is not limited to the specific implementations disclosed below.

[0032] The terminology used in one or more embodiments of this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this disclosure. The singular forms “a,” “the,” and “the” as used in one or more embodiments of this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this disclosure refers to and includes any or all possible combinations of one or more associated listed items.

[0033] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this disclosure, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this disclosure, and similarly, second may also be referred to as first. Depending on the context, the word “if” as used herein may be interpreted as “when”, “in response to a determination”, or “when…”.

[0034] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0035] First, the terms and concepts involved in one or more embodiments of this disclosure will be explained.

[0036] Kubernetes (K8s) is an open-source application used to manage containerized applications across multiple hosts in a cloud platform.

[0037] KSPM: Kubernetes Security Posture Management. KSPM is a practice for monitoring, assessing, and ensuring the security and compliance of Kubernetes environments. It helps protect Kubernetes infrastructure from a variety of common risks, such as misconfiguration, vulnerability risks, access control, and identity management.

[0038] KSPM works by ensuring that Kubernetes container clusters are properly protected, typically requiring the following:

[0039] 1. Scan containers and Pods for vulnerabilities or configuration errors.

[0040] 2. Run containers and Pods with lower privileges.

[0041] 3. Use network isolation to control the extent of damage that compromise may cause.

[0042] 4. Use a firewall to restrict unnecessary network connections and use encryption to protect confidentiality.

[0043] 5. Use strong authentication and authorization to restrict user and administrator access and limit the attack surface.

[0044] 6. Capture and monitor audit logs so that administrators can receive alerts about potential malicious activity.

[0045] 7. Regularly check Kubernetes settings and perform vulnerability scans to ensure that risks are properly considered and security patches are applied.

[0046] In a Kubernetes cluster, data collection and rule matching are required to perform configuration checks. Common detection methods currently have the following issues:

[0047] 1. Collecting data from an external environment requires establishing a network connection between the external environment and the cluster, as well as obtaining access credentials for the cluster, which can pose security risks to the cluster.

[0048] 2. By deploying collection containers within the cluster to collect and detect data within the cluster, the detection rules need to be sent to the cluster environment. When the detection rules change, the detection rules in the cluster environment cannot be updated in real time.

[0049] Based on this, this disclosure provides a data processing system, and also relates to a data processing method, an electronic device, a computer-readable storage medium, and a computer program product, which will be described in detail in the following embodiments.

[0050] Referring to Figure 1, Figure 1 shows a schematic diagram of a data processing system according to an embodiment of the present disclosure. The data processing system includes a cloud-side device 102 and an edge-side device 104. Specifically:

[0051] The cloud-side device 102 is configured to establish a communication connection with the cluster scanning component deployed on the end-side device;

[0052] The endpoint device 104 is configured to obtain cluster data collection tasks in the cloud device through the cluster scanning component, obtain cluster resource information of the container cluster based on the cluster data collection tasks, and send the cluster resource information to the cloud device 102.

[0053] The cloud-side device 102 is also configured to perform information detection on the cluster resource information according to preset information detection rules, and obtain the information detection result corresponding to the cluster resource information.

[0054] In this context, cloud-side devices can be understood as cloud servers, which are cloud-based services that receive and process detection tasks and rules. End-side devices are the clients that specifically deploy Kubernetes container clusters.

[0055] The data processing system provided in this disclosure offers a Kubernetes cluster security posture management solution with edge-cloud interaction for data acquisition and detection classification. Users can either operate the cloud-side device to install and deploy the cluster scanning component into the Kubernetes cluster on the edge device, or directly install the cluster scanning component into the Kubernetes cluster and establish a communication connection with the cloud-side device. The cluster scanning component collects data within the Kubernetes cluster and reports the collected data to the cloud-side device for data detection processing, simultaneously resolving issues related to network connectivity, access credential acquisition, and real-time rule implementation.

[0056] As shown in Figure 1, a cluster scanning component is created and edited in the cloud-side device 102, and then installed into the container cluster of the edge device 104. Since the cluster scanning component is deployed to the edge device via the cloud-side device 102, it can establish a communication connection with the cloud-side device 102. In practical applications, the cluster scanning component can communicate with the cloud-side device 102 via a heartbeat connection. The cluster scanning component can obtain information from the cloud-side device via the heartbeat connection and send the scanned information back to the cloud-side device. By deploying the cluster scanning component into the Kubernetes cluster on the cloud-side device, the network connection between the scanning service and the Kubernetes cluster is avoided. The cluster scanning component interacts directly with the kube-apiserver in the Kubernetes cluster within the cluster. This also avoids direct reliance on cluster access credentials, improving the security of the Kubernetes cluster.

[0057] The cluster scanning component can collect resource information of container clusters, including various types of resources such as ServiceAccount, ClusterRole, ClusterRoleBinding, and Deployment.

[0058] The cluster scanning component deployed in the container cluster can communicate with cloud-side devices to obtain cluster data collection tasks from those devices. A cluster data collection task can be understood as a task requiring cluster data collection. The cluster scanning component can then collect relevant cluster resource information from the container cluster according to this task and send the information back to the cloud-side devices. Finally, the cloud-side devices perform checks on the cluster resource information to obtain the final results.

[0059] In one specific embodiment provided in this disclosure, a security posture management service is deployed in the cloud-side device 102. In this embodiment, a cluster scanning component deployed on the endpoint device establishes a communication connection with the security posture management service, enabling communication between the container cluster and the security posture management service in the cloud-side device. This avoids direct reliance on cluster access credentials and improves the security of the Kubernetes cluster.

[0060] In one specific embodiment provided in this disclosure, the cloud-side device 102 is further configured to receive data acquisition requests and generate cluster data acquisition tasks in the security posture management service based on the data acquisition requests. In this embodiment, users or maintenance personnel can operate the cloud-side device by performing operations in the application corresponding to the security posture management service, converting data acquisition needs into data acquisition requests, and sending the data acquisition requests to the cloud-side device. The cloud-side device can then generate cluster data acquisition services in the security posture management service based on these data acquisition requests.

[0061] In practical applications, the cluster scanning component can periodically call interfaces such as `task` to poll for cluster data collection tasks. The cloud-side device updates the latest request time of the cluster scanning component to determine if it is functioning correctly. Besides being manually triggered by users or operations personnel in the console, cluster data collection tasks can also be generated periodically through pre-configured scheduling tasks.

[0062] Accordingly, in another specific embodiment provided in this disclosure, the edge device 104 is further configured to obtain cluster data collection tasks from the security posture management service through the communication connection between the cluster scanning component and the security posture management service. Specifically, a communication connection is established between the security posture management service of the cloud-side device and the cluster scanning component in the edge device. The edge device pulls cluster data collection tasks from the security posture management service as needed, and collects cluster resource information in the container cluster according to the cluster data collection tasks.

[0063] Because of the communication connection between the cluster scanning component and the security posture management service on the cloud device, after the cluster scanning component collects cluster resource information, it also sends the cluster resource information to the security posture management service on the cloud device through this communication connection. Therefore, by using the communication connection between the cluster scanning component deployed within the container cluster and the security posture management service deployed on the cloud device, the network connection between the scanning service and the container cluster is avoided, and direct reliance on cluster access credentials is also avoided, thus improving cluster security.

[0064] In one specific embodiment provided in this disclosure, the end-side device 104 is further configured to generate communication verification information through the cluster scanning component and send the communication verification information to the cloud-side device;

[0065] The cloud-side device 102 is also configured to generate communication authentication information based on the communication verification information;

[0066] The end-side device 104 is also configured to establish a communication connection with the security situation management service through the communication verification information and the communication authentication information.

[0067] Referring to Figure 2, which illustrates a flowchart of interface authentication provided in an embodiment of this disclosure, a cluster list is configured in the cloud-side device, and a cluster scanning component is installed in the container cluster through the cluster list. The cluster scanning component needs to transmit data with the cloud-side device, and authentication is required to verify identity. In other methods provided in this disclosure, a cluster token is generated using asymmetric encryption, and tokens are periodically rotated and updated (e.g., every hour, every five hours) to improve security. The private key is stored in the cloud-side device, and the public key is stored in the cluster scanning component. If the cluster scanning component on the endpoint device does not have a token, token generation is initiated, and the cluster identifier and token are encrypted using the public key and sent to the cloud-side device.

[0068] The cluster identifier and token are obtained by decrypting the private key on the cloud-side device, and then the token corresponding to the container cluster is updated. Subsequent API calls from the cluster scanning component will use the corresponding token for authentication, and only after successful authentication will real-time data interaction proceed.

[0069] In another specific embodiment provided in this disclosure, the end-side device 104 is further configured to, after obtaining the cluster resource information of the container cluster, compress the cluster resource information to obtain compressed resource information, and send the compressed resource information to the cloud-side device.

[0070] In practical applications, after acquiring cluster resource information, the cluster scanning component can directly send this information to the cloud-side device. If the cluster resource information is large, exceeding a preset threshold, it can be compressed using a preset compression algorithm to obtain compressed resource information, which is then sent to the cloud-side device. This reduces transmission time and improves data processing efficiency. Furthermore, cluster resource information can be reported in fragments to further enhance data transmission efficiency.

[0071] In another specific embodiment provided in this disclosure, a data detection service is deployed in the cloud-side device 102; the cloud-side device 102 is further configured to input the cluster resource information to the data detection service, the data detection service obtains preset information detection rules, and detects the cluster resource information based on the preset information detection rules.

[0072] In this embodiment, a data detection service is also deployed in the cloud-side device. The data detection service and the security posture management service are services that can run simultaneously on the cloud-side device and can interact with each other. Furthermore, after obtaining cluster resource information, the security posture management service needs to further detect this information. Based on this, the cluster resource information can also be input into the data detection service. The data detection service obtains preset information detection rules and performs information detection on the cluster resource information according to these rules, thereby obtaining the corresponding data detection results.

[0073] In practical applications, operations and maintenance personnel can pre-deploy a detection rule database on the cloud-side devices and add corresponding preset information detection rules to the database. Furthermore, they can send rule adjustment commands to the cloud-side devices at any time. These commands allow for real-time adjustments and updates to the preset information detection rules in the detection rule database.

[0074] In practical applications, the data inspection service can access the inspection rule database, retrieve preset information inspection rules from the database, match the corresponding preset information inspection rules according to the type of cluster resource information, and inspect the cluster resource information using the preset information inspection rules.

[0075] In another specific embodiment provided in this disclosure, the system also provides incremental detection. Specifically, the end-side device 104 is further configured to receive cluster adjustment information for the container cluster, the cluster scanning component obtains the resource information to be verified based on the cluster adjustment information, and sends the resource information to be verified to the cloud-side device;

[0076] The cloud-side device 102 is also configured to perform information detection on the resource information to be verified according to preset information detection rules, and obtain the information detection result corresponding to the resource information to be verified.

[0077] Referring to Figure 3, Figure 3 illustrates a data processing diagram for incremental detection provided in an embodiment of this disclosure. As shown in Figure 3, the user can also operate on the container cluster in the edge device, issuing cluster adjustment information for the container cluster. A corresponding cluster resource event is generated in the container cluster in response to the cluster adjustment information. The cluster scanning component can also obtain the cluster resource event, query the relevant dependency information of the cluster resource event, obtain the resource information to be verified, and send the resource information to be verified to the security posture management service of the cloud device. The security posture management service sends the resource information to be verified to the data detection service, which pulls the preset information detection rules from the detection rule database and verifies the resource information to be verified using the preset information detection rules to obtain the corresponding information detection result. In the case of an abnormal information detection result, the user-set interception rules are used to further determine whether the cluster adjustment information needs to be intercepted. If the user-set interception rule is to intercept, the cluster adjustment information for the container cluster cannot be executed. If the user's interception rule is set to not intercept, the information detection result will only be sent to the user in a visual manner, without any additional blocking processing of the cluster adjustment information.

[0078] In the system provided in this embodiment, the incremental detection and interception functions rely on the container cluster's own Webhook capabilities. In practical applications, additional resources for the Webhook function also need to be created.

[0079] The data processing system provided in this disclosure proposes a Kubernetes cluster security posture management scheme for data collection and detection classification. It deploys a cluster scanner in the container cluster for data collection and sends the collected data to a cloud-based device for rule matching. This avoids establishing network connections between the scanning service and the container cluster, and avoids direct reliance on cluster access credentials, thus improving cluster security. Deploying the detection function on the cloud-based device allows for real-time adjustment of detection rules, improving the real-time performance of detection.

[0080] Furthermore, the cluster data collection task built on cloud-side devices allows for control over the data collection progress, avoiding a black-box approach to data collection. The collection results are reported to cloud-side devices for rule matching, and rule updates are maintained on the cloud-side devices, improving the real-time nature of detection rule iteration.

[0081] Referring to Figure 4, which illustrates a flowchart of a data processing method for an edge device according to an embodiment of this disclosure, wherein a container cluster is deployed in the edge device, and the method specifically includes:

[0082] Step 402: Receive the cluster scanning component installation request sent by the cloud-side device, and install the cluster scanning component in response to the cluster scanning component installation request.

[0083] Step 404: Obtain cluster data acquisition tasks from the cloud-side device based on the cluster scanning component.

[0084] Step 406: Obtain the cluster resource information of the container cluster according to the cluster data acquisition task, and send the cluster resource information to the cloud-side device.

[0085] The method provided in this disclosure deploys a cluster scanner in a container cluster for data collection, and sends the collected data to a cloud-side device for rule matching. This avoids establishing a network connection between the scanning service and the container cluster, avoids direct reliance on cluster access credentials, and improves cluster security.

[0086] Referring to Figure 5, Figure 5 shows a flowchart of a data processing method for cloud-side devices according to an embodiment of this disclosure. The method specifically includes:

[0087] Step 502: Establish a communication connection with the cluster scanning component deployed on the end device and receive the task retrieval request sent by the cluster scanning component.

[0088] Step 504: In response to the task retrieval request, send a cluster data acquisition task to the end device so that the end device can obtain cluster resource information according to the cluster data acquisition task.

[0089] Step 506: Receive cluster resource information sent by the end device, and perform information detection on the cluster resource information according to the preset information detection rules to obtain the information detection result corresponding to the cluster resource information.

[0090] The method provided in this disclosure deploys the detection function on a cloud-side device, enabling real-time adjustment of detection rules and improving detection real-time performance. Furthermore, the cluster data acquisition task built on the cloud-side device allows for control over data acquisition progress, avoiding a black-box approach to data acquisition. Reporting the acquisition results to the cloud-side device for rule matching and maintaining rule updates on the cloud-side device further enhances the real-time iteration of detection rules.

[0091] Corresponding to the above-described data processing method embodiments applied to end-side devices, this disclosure also provides embodiments of data processing apparatus applied to end-side devices. Figure 6 shows a schematic structural diagram of a data processing apparatus applied to an end-side device according to an embodiment of this disclosure. As shown in Figure 6, the apparatus includes:

[0092] The receiving module 602 is configured to receive a cluster scanning component installation request sent by the cloud-side device, and to install the cluster scanning component in response to the cluster scanning component installation request.

[0093] The acquisition module 604 is configured to acquire cluster data collection tasks in the cloud-side device based on the cluster scanning component.

[0094] The sending module 606 is configured to obtain the cluster resource information of the container cluster according to the cluster data acquisition task, and send the cluster resource information to the cloud-side device.

[0095] The apparatus provided in this disclosure allows for the deployment of a cluster scanner in a container cluster for data collection. The collected data is then sent to a cloud-based device for rule matching. This avoids establishing a network connection between the scanning service and the container cluster, and avoids direct reliance on cluster access credentials, thereby improving cluster security.

[0096] The above is a schematic scheme of a data processing device applied to an end-side device according to this embodiment. It should be noted that the technical solution of the data processing device applied to the end-side device and the technical solution of the data processing method applied to the end-side device described above belong to the same concept. For details not described in detail in the technical solution of the data processing device applied to the end-side device, please refer to the description of the technical solution of the data processing method applied to the end-side device described above.

[0097] Corresponding to the above-described data processing method embodiments applied to cloud-side devices, this disclosure also provides an embodiment of a data processing apparatus applied to cloud-side devices. Figure 7 shows a schematic diagram of the structure of a data processing apparatus applied to cloud-side devices according to an embodiment of this disclosure. As shown in Figure 7, the apparatus includes:

[0098] The communication module 702 is configured to establish a communication connection with the cluster scanning component deployed on the end device and receive task retrieval requests sent by the cluster scanning component.

[0099] The sending module 704 is configured to send a cluster data acquisition task to the end device in response to the task retrieval request, so that the end device can obtain cluster resource information according to the cluster data acquisition task.

[0100] The detection module 706 is configured to receive cluster resource information sent by the end device, and perform information detection on the cluster resource information according to a preset information detection rule to obtain the information detection result corresponding to the cluster resource information.

[0101] The above is an illustrative scheme of a data processing device applied to a cloud-side device according to this embodiment. It should be noted that the technical solution of the data processing device applied to a cloud-side device and the technical solution of the data processing method applied to a cloud-side device described above belong to the same concept. For details not described in detail in the technical solution of the data processing device applied to a cloud-side device, please refer to the description of the technical solution of the data processing method applied to a cloud-side device described above.

[0102] Figure 8 shows a structural block diagram of an electronic device 800 according to an embodiment of the present disclosure. The components of the electronic device 800 include, but are not limited to, a memory 810 and a processor 820. The processor 820 is connected to the memory 810 via a bus 830, and a database 850 is used to store data.

[0103] Electronic device 800 also includes access device 840, which enables electronic device 800 to communicate via one or more networks 860. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. Access device 840 may include one or more of any type of wired or wireless network interface (e.g., network interface controller (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) wireless interface, a Wi-MAX (Worldwide Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0104] In one embodiment of this disclosure, the aforementioned components of the electronic device 800, as well as other components not shown in FIG. 8, may also be connected to each other, for example, via a bus. It should be understood that the electronic device structural block diagram shown in FIG. 8 is merely for illustrative purposes and is not intended to limit the scope of this disclosure. Those skilled in the art can add or replace other components as needed.

[0105] Electronic device 800 can be any type of stationary or mobile electronic device, including mobile computers or mobile electronic devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable electronic devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary electronic devices such as desktop computers or personal computers (PCs). Electronic device 800 can also be a mobile or stationary server.

[0106] The processor 820 is used to execute the following computer program / instructions, which, when executed by the processor, implement the steps of the above-described data processing method.

[0107] The above is an illustrative scheme of an electronic device according to this embodiment. It should be noted that the technical solution of this electronic device and the technical solution of the data processing method described above belong to the same concept. For details not described in detail in the technical solution of the electronic device, please refer to the description of the technical solution of the data processing method described above.

[0108] An embodiment of this disclosure also provides a computer-readable storage medium storing a computer program / instructions that, when executed by a processor, implement the steps of the above-described data processing method.

[0109] The various embodiments in this disclosure are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the computer-readable storage medium embodiments are basically similar to the data processing method embodiments, so the description is relatively simple; relevant parts can be referred to the description of the data processing method embodiments.

[0110] An embodiment of this disclosure also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described data processing method.

[0111] The above is an illustrative scheme of a computer program product according to this embodiment. It should be noted that the technical solution of this computer program product and the technical solution of the data processing method described above belong to the same concept. For details not described in detail in the technical solution of the computer program product, please refer to the description of the technical solution of the data processing method described above.

[0112] The foregoing has described specific embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0113] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or certain intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added or removed according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0114] It should be noted that the above description describes specific embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous. Secondly, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments of this disclosure.

[0115] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0116] The preferred embodiments disclosed above are merely illustrative of this disclosure. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments of this disclosure. These embodiments are selected and specifically described in this disclosure to better explain the principles and practical applications of the embodiments of this disclosure, thereby enabling those skilled in the art to better understand and utilize this disclosure. This disclosure is limited only by the claims and their full scope and equivalents.

Claims

1. A data processing system comprising: Cloud-side devices and edge devices, wherein container clusters are deployed in the edge devices; The cloud-side device is configured to establish a communication connection with the cluster scanning component deployed on the end-side device; The endpoint device is configured to obtain cluster data collection tasks from the cloud-side device through the cluster scanning component, obtain cluster resource information of the container cluster based on the cluster data collection tasks, and send the cluster resource information to the cloud-side device. The cloud-side device is also configured to perform information detection on the cluster resource information according to preset information detection rules, and obtain the information detection result corresponding to the cluster resource information.

2. The system as described in claim 1, wherein a security situation management service is deployed in the cloud-side device; The endpoint device is also configured to create a communication connection with the security posture management service based on the cluster scanning component.

3. The system of claim 2, further comprising: The cloud-side device is also configured to receive data collection requests and generate cluster data collection tasks in the security situation management service based on the data collection requests.

4. The system of claim 3, further comprising: The endpoint device is further configured to acquire cluster data collection tasks from the security situation management service through the communication connection between the cluster scanning component and the security situation management service.

5. The system of claim 2, further comprising: The endpoint device is also configured to send the cluster resource information to the security posture management service in the cloud-side device.

6. The system of claim 2, further comprising: The endpoint device is also configured to generate communication verification information through the cluster scanning component and send the communication verification information to the cloud-side device; The cloud-side device is also configured to generate communication authentication information based on the communication verification information; The endpoint device is also configured to establish a communication connection with the security situation management service through the communication verification information and the communication authentication information.

7. The system according to any one of claims 1-6, further comprising: The endpoint device is further configured to, after obtaining the cluster resource information of the container cluster, compress the cluster resource information to obtain compressed resource information, and send the compressed resource information to the cloud-side device.

8. The system as described in any one of claims 1-6, wherein a data detection service is deployed in the cloud-side device; The cloud-side device is also configured to input the cluster resource information into the data detection service, the data detection service obtains preset information detection rules, and detects the cluster resource information based on the preset information detection rules.

9. The system as described in claim 8, wherein a detection rule database is deployed in the cloud-side device; The cloud-side device is also configured to obtain preset information detection rules stored in the detection rule database for the data detection service.

10. The system of claim 9, further comprising: The cloud-side device is also configured to receive rule adjustment instructions and update the preset information detection rules in the detection rule database based on the rule adjustment instructions.

11. The system of claim 1, further comprising: the end-side device is further configured to receive cluster adjustment information for the container cluster, and the cluster scanning component acquires to-be-verified resource information according to the cluster adjustment information and sends the to-be-verified resource information to the cloud-side device; the cloud-side device is further configured to perform information detection on the to-be-verified resource information according to a preset information detection rule to obtain an information detection result corresponding to the to-be-verified resource information.

12. A data processing method applied to an end-side device, wherein a container cluster is deployed in the end-side device, and the method comprises: receiving a cluster scanning component installation request sent by a cloud-side device and installing a cluster scanning component in response to the cluster scanning component installation request; acquiring a cluster data collection task in the cloud-side device based on the cluster scanning component; acquiring cluster resource information of the container cluster according to the cluster data collection task and sending the cluster resource information to the cloud-side device.

13. The method of claim 12, further comprising: after acquiring the cluster resource information of the container cluster, compressing the cluster resource information to obtain compressed resource information and sending the compressed resource information to the cloud-side device.

14. A data processing method applied to a cloud-side device, the method comprising: establishing a communication connection with a cluster scanning component deployed in an end-side device, receiving a task pulling request sent by the cluster scanning component; sending a cluster data collection task to the end-side device in response to the task pulling request, so that the end-side device acquires cluster resource information according to the cluster data collection task; receiving cluster resource information sent by the end-side device and performing information detection on the cluster resource information according to a preset information detection rule to obtain an information detection result corresponding to the cluster resource information.

15. An electronic device, comprising: a memory and a processor; the memory is configured to store computer programs / instructions, and the processor is configured to execute the computer programs / instructions, which, when executed by the processor, implement a method of receiving a cluster scanning component installation request sent by a cloud-side device and installing a cluster scanning component in response to the cluster scanning component installation request; acquiring a cluster data collection task in the cloud-side device based on the cluster scanning component; acquiring cluster resource information of the container cluster according to the cluster data collection task and sending the cluster resource information to the cloud-side device.

16. The electronic device of claim 15, wherein the computer programs / instructions, when executed by the processor, further implement a method of compressing the cluster resource information to obtain compressed resource information and sending the compressed resource information to the cloud-side device after acquiring the cluster resource information of the container cluster.

17. The electronic device of claim 15, wherein the computer programs / instructions, when executed by the processor, further implement a method of establishing a communication connection with a cluster scanning component deployed on an end-side device, receiving a task pulling request sent by the cluster scanning component, sending a cluster data collection task to the end-side device in response to the task pulling request, so that the end-side device acquires cluster resource information according to the cluster data collection task, receiving cluster resource information sent by the end-side device, and performing information detection on the cluster resource information according to a preset information detection rule to obtain an information detection result corresponding to the cluster resource information.

18. A computer-readable storage medium storing computer programs / instructions, which, when executed by a processor, implement a method of receiving a cluster scanning component installation request sent by a cloud-side device, and installing a cluster scanning component in response to the cluster scanning component installation request, obtaining a cluster data collection task in the cloud-side device based on the cluster scanning component, obtaining cluster resource information of the container cluster according to the cluster data collection task, and sending the cluster resource information to the cloud-side device.

19. The computer-readable storage medium of claim 18, wherein the computer programs / instructions, when executed by the processor, further implement a method of compressing the cluster resource information to obtain compressed resource information after obtaining the cluster resource information of the container cluster, and sending the compressed resource information to the cloud-side device.

20. The computer-readable storage medium of claim 18, wherein the computer programs / instructions, when executed by the processor, further implement a method of establishing a communication connection with a cluster scanning component deployed on an end-side device, receiving a task pulling request sent by the cluster scanning component, sending a cluster data collection task to the end-side device in response to the task pulling request, so that the end-side device acquires cluster resource information according to the cluster data collection task, receiving cluster resource information sent by the end-side device, and performing information detection on the cluster resource information according to a preset information detection rule to obtain an information detection result corresponding to the cluster resource information.

Images